7cc7e1f381c7ba108efde283d52ad7955e583e6f9192cf46a593a4a36e6250ef

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-08-2022 08:08

Target

bEhn.exe
Size

23KB
MD5

dffbd7034e49e8af1ffb55f1eb2a7401
SHA1

cb837595a4a74742e3c92b2c83cd04e4b8fc1992
SHA256

7cc7e1f381c7ba108efde283d52ad7955e583e6f9192cf46a593a4a36e6250ef
SHA512

4fb4fde9cd93d60ac321b613483b0eb7cdd69043282bb0d8829241a894c10a5eac96699ff353d9bed5605bd0705d7f0511a3df14f499b000c1b870ad6cd06792

Score

8^/10

evasion

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1048 netsh.exe

pid	process
1048	netsh.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

bEhn.exe

description	pid	process
Token: SeDebugPrivilege	1816	bEhn.exe
Token: 33	1816	bEhn.exe
Token: SeIncBasePriorityPrivilege	1816	bEhn.exe
Token: 33	1816	bEhn.exe
Token: SeIncBasePriorityPrivilege	1816	bEhn.exe
Token: 33	1816	bEhn.exe
Token: SeIncBasePriorityPrivilege	1816	bEhn.exe
Token: 33	1816	bEhn.exe
Token: SeIncBasePriorityPrivilege	1816	bEhn.exe
Token: 33	1816	bEhn.exe
Token: SeIncBasePriorityPrivilege	1816	bEhn.exe
Token: 33	1816	bEhn.exe
Token: SeIncBasePriorityPrivilege	1816	bEhn.exe
Token: 33	1816	bEhn.exe
Token: SeIncBasePriorityPrivilege	1816	bEhn.exe
Token: 33	1816	bEhn.exe
Token: SeIncBasePriorityPrivilege	1816	bEhn.exe
Token: 33	1816	bEhn.exe
Token: SeIncBasePriorityPrivilege	1816	bEhn.exe
Token: 33	1816	bEhn.exe
Token: SeIncBasePriorityPrivilege	1816	bEhn.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bEhn.exe

description	pid	process	target process
PID 1816 wrote to memory of 1048	1816	bEhn.exe	netsh.exe
PID 1816 wrote to memory of 1048	1816	bEhn.exe	netsh.exe
PID 1816 wrote to memory of 1048	1816	bEhn.exe	netsh.exe
PID 1816 wrote to memory of 1048	1816	bEhn.exe	netsh.exe

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\bEhn.exe" "bEhn.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1048

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1048-56-0x0000000000000000-mapping.dmp

Download
memory/1816-54-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download
memory/1816-55-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1816-58-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download