999fd9c215a2fdaf3bff8681d0c94d2d6411e63aca34680ef66bc84f0a29a27c

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
06-08-2022 16:26

Target

bDTb.exe
Size

36KB
MD5

f0e497ca736bc83a340b9f242ea3613c
SHA1

ff438abc6a2252d2e9ba29478425e081067e2353
SHA256

999fd9c215a2fdaf3bff8681d0c94d2d6411e63aca34680ef66bc84f0a29a27c
SHA512

6222582746e2cd1c0e39885fb1c8c201044a0e3cacb2022623b92fe856396d216c58bd4cb1ef72f4e046287ee62623fb0d01c34b06b756f04fa29075989394db

Score

8^/10

evasion

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1608 netsh.exe

pid	process
1608	netsh.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

bDTb.exe

description	pid	process
Token: SeDebugPrivilege	1172	bDTb.exe
Token: 33	1172	bDTb.exe
Token: SeIncBasePriorityPrivilege	1172	bDTb.exe
Token: 33	1172	bDTb.exe
Token: SeIncBasePriorityPrivilege	1172	bDTb.exe
Token: 33	1172	bDTb.exe
Token: SeIncBasePriorityPrivilege	1172	bDTb.exe
Token: 33	1172	bDTb.exe
Token: SeIncBasePriorityPrivilege	1172	bDTb.exe
Token: 33	1172	bDTb.exe
Token: SeIncBasePriorityPrivilege	1172	bDTb.exe
Token: 33	1172	bDTb.exe
Token: SeIncBasePriorityPrivilege	1172	bDTb.exe
Token: 33	1172	bDTb.exe
Token: SeIncBasePriorityPrivilege	1172	bDTb.exe
Token: 33	1172	bDTb.exe
Token: SeIncBasePriorityPrivilege	1172	bDTb.exe
Token: 33	1172	bDTb.exe
Token: SeIncBasePriorityPrivilege	1172	bDTb.exe
Token: 33	1172	bDTb.exe
Token: SeIncBasePriorityPrivilege	1172	bDTb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bDTb.exe

description	pid	process	target process
PID 1172 wrote to memory of 1608	1172	bDTb.exe	netsh.exe
PID 1172 wrote to memory of 1608	1172	bDTb.exe	netsh.exe
PID 1172 wrote to memory of 1608	1172	bDTb.exe	netsh.exe
PID 1172 wrote to memory of 1608	1172	bDTb.exe	netsh.exe

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\bDTb.exe" "bDTb.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1608

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1172-54-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/1172-55-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/1172-58-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/1608-56-0x0000000000000000-mapping.dmp

Download