Analysis
- max time kernel
149s - max time network
115s - platform
windows10_x64 - resource
win10v20201028 - submitted
29/11/2020, 21:33
Static task
static1
Behavioral task
behavioral1
Sample
sJpL0Ri5.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target sJpL0Ri5.exe
- Size 31KB
- Sample201129-hddttmlqa6
- SHA256 3b4dffe14c52cb879f4b6863d8a8cffcea4bdecf1d43f01a4326398348bf1186
- MD5 eb7587c666290559325b00e858cfa85f
- SHA1 116f8de87ec52e24b28d02fa18414c3f72ca43d8
- SHA512 220ec1cf90c576c807dc3a57418ba0571b076c7477ad0906d77a3371644b51e8ce3d55e6959215ee981e96292a857b2302a12ffb2ddc02982043cbba1f5c3c5f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe Token: 33 4076 sJpL0Ri5.exe Token: SeIncBasePriorityPrivilege 4076 sJpL0Ri5.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4076 wrote to memory of 3172 4076 sJpL0Ri5.exe 78 PID 4076 wrote to memory of 3172 4076 sJpL0Ri5.exe 78 PID 4076 wrote to memory of 3172 4076 sJpL0Ri5.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\sJpL0Ri5.exe"C:\Users\Admin\AppData\Local\Temp\sJpL0Ri5.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\sJpL0Ri5.exe" "sJpL0Ri5.exe" ENABLE2⤵PID:3172
-