5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e

Analysis

max time kernel
163s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Size

37KB
MD5

e12037809b4e42c71778a4b4bbc452ca
SHA1

2c58522f0f3a2baec1e6051d2c6555efeb727f5c
SHA256

5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e
SHA512

0784bc7c6c4063b3d15dea52fedba7aff37d1bd0da504772948c67f3016910685e60f2225bba3d8de3cce6001aede3d010370734f940eb85990d403564ab1510

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1708 netsh.exe

pid	process
1708	netsh.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe

description	pid	process
Token: SeDebugPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: 33	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
Token: SeIncBasePriorityPrivilege	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe

description	pid	process	target process
PID 4872 wrote to memory of 1708	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe	netsh.exe
PID 4872 wrote to memory of 1708	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe	netsh.exe
PID 4872 wrote to memory of 1708	4872	5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe
"C:\Users\Admin\AppData\Local\Temp\5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe" "5e0033cde518b79fac2006ab34068e0958f0b5a5add15f46ba0ea765ab51c38e.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-134-0x0000000000000000-mapping.dmp

Download
memory/4872-132-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/4872-133-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download