0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1

General

Target

0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Size

37KB
MD5

07b030d2d9514eb342732e24f096b066
SHA1

ae675ffb75c89eac13848237240d724591211818
SHA256

0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1
SHA512

2975a45f7f6ac8ed1b07bc3db0bbec763637225ffe8727b6da6fe2e7d73a9bffbaec6e2c1baee4301bbe4f289e74dd8491690845007f9485e9c1bfcf916ca145

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops startup file 2 IoCs

Processes:

0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f5a2552a9a371bcdfe465098b6608089.exe	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f5a2552a9a371bcdfe465098b6608089.exe	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe

description	pid	process
Token: SeDebugPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: 33	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: SeIncBasePriorityPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: 33	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: SeIncBasePriorityPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: 33	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: SeIncBasePriorityPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: 33	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: SeIncBasePriorityPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: 33	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: SeIncBasePriorityPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: 33	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: SeIncBasePriorityPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: 33	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: SeIncBasePriorityPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: 33	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: SeIncBasePriorityPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: 33	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: SeIncBasePriorityPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: 33	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
Token: SeIncBasePriorityPrivilege	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe

description	pid	process	target process
PID 1008 wrote to memory of 1896	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe	netsh.exe
PID 1008 wrote to memory of 1896	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe	netsh.exe
PID 1008 wrote to memory of 1896	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe	netsh.exe
PID 1008 wrote to memory of 1896	1008	0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe
"C:\Users\Admin\AppData\Local\Temp\0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe" "0ae4dfe43308ce7d6e68d877c74e74e63d03089d9a36a0f3b3501c97137345c1.exe" ENABLE
2⤵
PID:1896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1008-55-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1896-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads