8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6

Analysis

Target

8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6.exe
Size

3.8MB
MD5

c7c39967e16500c37638ab24f1bb3ff9
SHA1

8d3db8e941510f50d5f97f4f9858439c81afbfc7
SHA256

8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6
SHA512

b9c3c7f83e2c4be9dd4527b53224b359beabf030a7e079332716a196df22f7ebd53f411bc26c19a2851f968881b16d1a1d9227c0fd7ea421f38dbca6fbc01aac

Score

8^/10

evasion

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6.exe

description	pid	process	target process
PID 812 wrote to memory of 1480	812	8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6.exe	netsh.exe
PID 812 wrote to memory of 1480	812	8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6.exe	netsh.exe
PID 812 wrote to memory of 1480	812	8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6.exe	netsh.exe
PID 812 wrote to memory of 4776	812	8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6.exe	netsh.exe
PID 812 wrote to memory of 4776	812	8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6.exe	netsh.exe
PID 812 wrote to memory of 4776	812	8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6.exe
"C:\Users\Admin\AppData\Local\Temp\8a04cb48e356af5b5ea78c7eac1b91ef6a0516fe815f7709205e55eb89d1d2d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
  2⤵
  PID:1480
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall set allprofiles state on
  2⤵
  PID:4776

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact