Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-12-2021 15:31
Behavioral task
behavioral1
Sample
5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe
-
Size
37KB
-
MD5
cb69d40567868c1cc92eefb5e2b27af1
-
SHA1
d589126c2e18030f2e0f94d42c3f3a9e51bdc25a
-
SHA256
5bede66e2369345d341d7c9e0a343a1d781a1fde3a38373798ffb9ba9731b866
-
SHA512
bf79e9dccb542318314d38582691036d5a2a258aa133ca4fd94ee88c76fce1bb41374ad39588f2c9dec2e959d91ea2d3c6b6bf8c70794a72415b7cc9975e12e0
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\04d10446f5edc1673b6ff536d2b2ea65 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe\" .." 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\04d10446f5edc1673b6ff536d2b2ea65 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe\" .." 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exepid process 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exepid process 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exedescription pid process Token: SeDebugPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: 33 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe Token: SeIncBasePriorityPrivilege 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exedescription pid process target process PID 1692 wrote to memory of 1156 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe netsh.exe PID 1692 wrote to memory of 1156 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe netsh.exe PID 1692 wrote to memory of 1156 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe netsh.exe PID 1692 wrote to memory of 1156 1692 5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe"C:\Users\Admin\AppData\Local\Temp\5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe" "5BEDE66E2369345D341D7C9E0A343A1D781A1FDE3A383.exe" ENABLE2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1156-57-0x0000000000000000-mapping.dmp
-
memory/1692-55-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB
-
memory/1692-56-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/1692-59-0x0000000002361000-0x0000000002362000-memory.dmpFilesize
4KB