5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901

Analysis

max time kernel
147s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
01-08-2022 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Size

23KB
MD5

0a6313f82def3972901d2653ea69529d
SHA1

2a5d8417f4a32ae0f36ce014f6024fb661439210
SHA256

5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901
SHA512

f66093a9d3d9e0e7f0d027aec5e37052adc8588415e758196b4a982e75746225a0451a4f357629794656afb3b5d1b3751fb99a85af01d0c41b09981450aa37ae

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2004 netsh.exe

pid	process
2004	netsh.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe

description	pid	process
Token: SeDebugPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: 33	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: SeIncBasePriorityPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: 33	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: SeIncBasePriorityPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: 33	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: SeIncBasePriorityPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: 33	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: SeIncBasePriorityPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: 33	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: SeIncBasePriorityPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: 33	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: SeIncBasePriorityPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: 33	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: SeIncBasePriorityPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: 33	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: SeIncBasePriorityPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: 33	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: SeIncBasePriorityPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: 33	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
Token: SeIncBasePriorityPrivilege	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe

description	pid	process	target process
PID 852 wrote to memory of 2004	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe	netsh.exe
PID 852 wrote to memory of 2004	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe	netsh.exe
PID 852 wrote to memory of 2004	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe	netsh.exe
PID 852 wrote to memory of 2004	852	5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe
"C:\Users\Admin\AppData\Local\Temp\5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe" "5c6c81eeedd781de8fbf1805100b27da416cb6ffeda61a9e6068bd413aaff901.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-54-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/852-55-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download
memory/852-58-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-56-0x0000000000000000-mapping.dmp

Download