Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 21:33
Behavioral task
behavioral1
Sample
d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe
-
Size
93KB
-
MD5
41899bf2fbd18a2f86758eaf9c5a9c7c
-
SHA1
55fb04b65fcb6c95e8d4bce1bd16ef2c7ccb55b4
-
SHA256
d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc
-
SHA512
50f9bc2937430d82b189d240191bd13c882c086f67e95b9fe33e57bd8f14e3562ca72019681c36c284b73dd3338d22bab7d150c2d976837154363112e09d3279
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exepid process 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exedescription pid process Token: SeDebugPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: 33 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe Token: SeIncBasePriorityPrivilege 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exedescription pid process target process PID 2680 wrote to memory of 4124 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe netsh.exe PID 2680 wrote to memory of 4124 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe netsh.exe PID 2680 wrote to memory of 4124 2680 d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe"C:\Users\Admin\AppData\Local\Temp\d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe" "d143e8e7f7bd7b5761bb4657f5feccb7049c362728e6d30197c5089b2898d6dc.exe" ENABLE2⤵