Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 21:56
Behavioral task
behavioral1
Sample
3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe
-
Size
23KB
-
MD5
c09fcff493dd614093ea92ca607b9e8b
-
SHA1
da07efbdefcff230310d6fe7d00a13d668dfdeaa
-
SHA256
3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64
-
SHA512
c86ce55bc1311184b6d9cd53021d354500fed3054544a6e715d3824cc3e70cf224a2df3d83517989ab6334e04ff1843b4ac7432b36da4aa8c1a2d59a46f970e5
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exedescription pid process Token: SeDebugPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: 33 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe Token: SeIncBasePriorityPrivilege 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exedescription pid process target process PID 624 wrote to memory of 1460 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe netsh.exe PID 624 wrote to memory of 1460 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe netsh.exe PID 624 wrote to memory of 1460 624 3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe"C:\Users\Admin\AppData\Local\Temp\3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe" "3711caf74167cae35d4c23e7029680d496c3cda1ac195a8620165b21fc918d64.exe" ENABLE2⤵