77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988

General

Target

77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Size

37KB
MD5

95e38a6641c8eef0834c36be400596b1
SHA1

47390ee7711ca63ea43972d27fbce813ce032a30
SHA256

77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988
SHA512

4c3fef80a81f195a63b0595e4b45005ea5c12a7d6137fade2f6a1ee66f599a22a5d185258fd07c5c8aa919da01172b023f082234f5bd0b96ccf77d31b47cfc86

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe

description	pid	process
Token: SeDebugPrivilege	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: 33	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: SeIncBasePriorityPrivilege	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: 33	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: SeIncBasePriorityPrivilege	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: 33	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: SeIncBasePriorityPrivilege	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: 33	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: SeIncBasePriorityPrivilege	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: 33	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: SeIncBasePriorityPrivilege	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: 33	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: SeIncBasePriorityPrivilege	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: 33	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: SeIncBasePriorityPrivilege	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: 33	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: SeIncBasePriorityPrivilege	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: 33	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
Token: SeIncBasePriorityPrivilege	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe

description	pid	process	target process
PID 2044 wrote to memory of 1968	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe	netsh.exe
PID 2044 wrote to memory of 1968	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe	netsh.exe
PID 2044 wrote to memory of 1968	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe	netsh.exe
PID 2044 wrote to memory of 1968	2044	77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe
"C:\Users\Admin\AppData\Local\Temp\77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe" "77d240e5732ec6217c1560ab43098785d109d9b87a9dc6a94f1272cf64b64988.exe" ENABLE
2⤵
PID:1968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-56-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000074720000-0x0000000074CCB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing