3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf

General

Target

3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Size

23KB
MD5

16b84dc3da35e7a412d7caff0dd1111b
SHA1

3e255fa00b7a49709d66e214791d92929f0650df
SHA256

3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf
SHA512

04116b87bf1c636a7908f239ba8a994d99020667509e8223271daa6a03792a3aab7c478410b1c4a1550f67e705ba1a045018ab297a2f076ea962822e7bdd174e

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1812 netsh.exe

pid	process
1812	netsh.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe

description	pid	process
Token: SeDebugPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: 33	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: SeIncBasePriorityPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: 33	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: SeIncBasePriorityPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: 33	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: SeIncBasePriorityPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: 33	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: SeIncBasePriorityPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: 33	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: SeIncBasePriorityPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: 33	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: SeIncBasePriorityPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: 33	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: SeIncBasePriorityPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: 33	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: SeIncBasePriorityPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: 33	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: SeIncBasePriorityPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: 33	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
Token: SeIncBasePriorityPrivilege	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe

description	pid	process	target process
PID 1668 wrote to memory of 1812	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe	netsh.exe
PID 1668 wrote to memory of 1812	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe	netsh.exe
PID 1668 wrote to memory of 1812	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe	netsh.exe
PID 1668 wrote to memory of 1812	1668	3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe
"C:\Users\Admin\AppData\Local\Temp\3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe" "3cee48eccc92a60c6c57bcdf9c9c12735e4064e6b7d0f12e0385e35c829166bf.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1668-55-0x0000000073FE0000-0x000000007458B000-memory.dmp

Filesize
5.7MB

Download
memory/1668-58-0x0000000073FE0000-0x000000007458B000-memory.dmp

Filesize
5.7MB

Download
memory/1812-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing