0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07

General

Target

0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Size

37KB
MD5

40154b9ad674d822f91993a2cf4e392e
SHA1

e92be4fe50e5d9656570a7c47cbf9449df52d6b9
SHA256

0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07
SHA512

057da7897bd97985f37ed489de774ae1c71bf3bd802b72b6de9d723eaec2247fbb70964a4688ffa4c257f2cbe30c1e946a49e5422621a5272c3057b5fc901219

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe

description	pid	process
Token: SeDebugPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: 33	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: SeIncBasePriorityPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: 33	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: SeIncBasePriorityPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: 33	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: SeIncBasePriorityPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: 33	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: SeIncBasePriorityPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: 33	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: SeIncBasePriorityPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: 33	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: SeIncBasePriorityPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: 33	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: SeIncBasePriorityPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: 33	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: SeIncBasePriorityPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: 33	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: SeIncBasePriorityPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: 33	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
Token: SeIncBasePriorityPrivilege	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe

description	pid	process	target process
PID 1080 wrote to memory of 1948	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe	netsh.exe
PID 1080 wrote to memory of 1948	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe	netsh.exe
PID 1080 wrote to memory of 1948	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe	netsh.exe
PID 1080 wrote to memory of 1948	1080	0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe
"C:\Users\Admin\AppData\Local\Temp\0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe" "0ca9fee2e1444913a937454e8ea5f0539e446246a9097a42dee4279b1bae2c07.exe" ENABLE
2⤵
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-60-0x0000000072140000-0x0000000072D1E000-memory.dmp

Filesize
11.9MB

Download
memory/1080-63-0x0000000072040000-0x0000000072131000-memory.dmp

Filesize
964KB

Download
memory/1080-56-0x0000000072D20000-0x0000000073818000-memory.dmp

Filesize
11.0MB

Download
memory/1080-57-0x0000000073E50000-0x00000000745EC000-memory.dmp

Filesize
7.6MB

Download
memory/1080-58-0x0000000073CB0000-0x0000000073E4B000-memory.dmp

Filesize
1.6MB

Download
memory/1080-59-0x00000000738F0000-0x0000000073A78000-memory.dmp

Filesize
1.5MB

Download
memory/1080-55-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/1080-67-0x0000000073E50000-0x00000000745EC000-memory.dmp

Filesize
7.6MB

Download
memory/1080-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1080-64-0x0000000071B00000-0x0000000072036000-memory.dmp

Filesize
5.2MB

Download
memory/1080-65-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/1080-66-0x0000000072D20000-0x0000000073818000-memory.dmp

Filesize
11.0MB

Download
memory/1080-68-0x0000000073CB0000-0x0000000073E4B000-memory.dmp

Filesize
1.6MB

Download
memory/1080-69-0x0000000072140000-0x0000000072D1E000-memory.dmp

Filesize
11.9MB

Download
memory/1948-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing