Analysis
- max time kernel
149s - max time network
13s - platform
windows7_x64 - resource
win7v20201028 - submitted
29/11/2020, 21:33
Static task
static1
Behavioral task
behavioral1
Sample
sJpL0Ri5.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target sJpL0Ri5.exe
- Size 31KB
- Sample201129-hddttmlqa6
- SHA256 3b4dffe14c52cb879f4b6863d8a8cffcea4bdecf1d43f01a4326398348bf1186
- MD5 eb7587c666290559325b00e858cfa85f
- SHA1 116f8de87ec52e24b28d02fa18414c3f72ca43d8
- SHA512 220ec1cf90c576c807dc3a57418ba0571b076c7477ad0906d77a3371644b51e8ce3d55e6959215ee981e96292a857b2302a12ffb2ddc02982043cbba1f5c3c5f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs
- Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe Token: 33 1684 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 1684 sJpL0Ri5.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1560 1684 sJpL0Ri5.exe 29 PID 1684 wrote to memory of 1560 1684 sJpL0Ri5.exe 29 PID 1684 wrote to memory of 1560 1684 sJpL0Ri5.exe 29 PID 1684 wrote to memory of 1560 1684 sJpL0Ri5.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\sJpL0Ri5.exe"C:\Users\Admin\AppData\Local\Temp\sJpL0Ri5.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\sJpL0Ri5.exe" "sJpL0Ri5.exe" ENABLE2⤵PID:1560
-