4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa

General

Target

4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Size

37KB
MD5

2db8f69266eb3fbda33b18d9c3cc8207
SHA1

8502438b2c2cf338e5f37f2b672d0c7628fa6689
SHA256

4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa
SHA512

0158fbe83619fa6024d04328848161c1c16b94552fdc336bf1b5ef11e8167fd05513ea8f27186cc735ca75a696489f7007f60520842495d9beff3e04945d6a9d

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe

description	pid	process
Token: SeDebugPrivilege	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: 33	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: SeIncBasePriorityPrivilege	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: 33	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: SeIncBasePriorityPrivilege	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: 33	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: SeIncBasePriorityPrivilege	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: 33	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: SeIncBasePriorityPrivilege	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: 33	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: SeIncBasePriorityPrivilege	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: 33	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: SeIncBasePriorityPrivilege	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: 33	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: SeIncBasePriorityPrivilege	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: 33	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: SeIncBasePriorityPrivilege	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: 33	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Token: SeIncBasePriorityPrivilege	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe

description	pid	process	target process
PID 1780 wrote to memory of 1692	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe	netsh.exe
PID 1780 wrote to memory of 1692	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe	netsh.exe
PID 1780 wrote to memory of 1692	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe	netsh.exe
PID 1780 wrote to memory of 1692	1780	4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
"C:\Users\Admin\AppData\Local\Temp\4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe" "4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe" ENABLE
2⤵
PID:1692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-56-0x0000000000000000-mapping.dmp

Download
memory/1780-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1780-55-0x0000000074860000-0x0000000074E0B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing