8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Size

37KB
MD5

672a3fba476369ff78ca982969dbdef4
SHA1

8e8596805bb406fe0d1d1b658c099ec3444043e4
SHA256

8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d
SHA512

67fc4ca49c161fcd8954ae71a17308a4158cfc3e4ee965bacaea08a73adb45a57e3a65bab7256922d795b4a729df4f04548306e04a7c38ab2ea7225aef04511a

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

3100 netsh.exe

pid	process
3100	netsh.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe

description	pid	process
Token: SeDebugPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: 33	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
Token: SeIncBasePriorityPrivilege	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe

description	pid	process	target process
PID 3288 wrote to memory of 3100	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe	netsh.exe
PID 3288 wrote to memory of 3100	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe	netsh.exe
PID 3288 wrote to memory of 3100	3288	8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe
"C:\Users\Admin\AppData\Local\Temp\8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe" "8cebbfaf09dce741f57ffa81b139d6713a6d2e512614ac98a683aabe5ba7431d.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:3100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3100-132-0x0000000000000000-mapping.dmp

Download
memory/3288-130-0x00000000755A0000-0x0000000075B51000-memory.dmp

Filesize
5.7MB

Download
memory/3288-131-0x00000000755A0000-0x0000000075B51000-memory.dmp

Filesize
5.7MB

Download