Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
25-07-2022 05:57
General
-
Target
files/12.exe
-
Size
32KB
-
MD5
7cf3aecad9d39a53f50786d6a8027029
-
SHA1
fb29cbd768bd1f8f3de4ad7e7e0d59266b51717b
-
SHA256
fff353843eb081d94aac5c048c7cbc41e62ecd476a2cbee970066199f81afdaa
-
SHA512
92df490a3e12087578d3d29cfe91e057aacbaa621e21484dc7f6867976536353d3f91ebc2d7aef644d8b345f9ba09ab07ca21811e2ed915cd131aab80c86a643
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 53 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\files\12.exe"C:\Users\Admin\AppData\Local\Temp\files\12.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\files\12.exe" "12.exe" ENABLE2⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3028-131-0x0000000000000000-mapping.dmp
-
memory/4980-130-0x00000000752B0000-0x0000000075861000-memory.dmpFilesize
5.7MB
-
memory/4980-132-0x00000000752B0000-0x0000000075861000-memory.dmpFilesize
5.7MB