Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2022 19:17
Behavioral task
behavioral1
Sample
845e6c0d7cc883afd04ceecfb6037178.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
845e6c0d7cc883afd04ceecfb6037178.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
845e6c0d7cc883afd04ceecfb6037178.exe
-
Size
93KB
-
MD5
845e6c0d7cc883afd04ceecfb6037178
-
SHA1
7aff88c15a39074586ce7397a5f6730fdf5775ec
-
SHA256
bd340c283098f70367d0bc051ade99259897d50a2d44d2302f5c29ca28ff1f01
-
SHA512
fbcefa613b75401c28b67c26306c04fce11db0fec9bb07ec5cd7a4f95227da548b98a451e3f0777854e9aeeda8814b2ed73055225e9e5d1667a962bad8f30f41
-
SSDEEP
1536:3lRs5p8k2HGjTpL5HoTjEwzGi1dDgDUgS:3lbk2HGjtL5IYi1dWN
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 4768 netsh.exe 1952 netsh.exe 4032 netsh.exe -
Drops startup file 4 IoCs
Processes:
845e6c0d7cc883afd04ceecfb6037178.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\95cb92103dd3679a12cfd813b03dba8eWindows Update.exe 845e6c0d7cc883afd04ceecfb6037178.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 845e6c0d7cc883afd04ceecfb6037178.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 845e6c0d7cc883afd04ceecfb6037178.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\95cb92103dd3679a12cfd813b03dba8eWindows Update.exe 845e6c0d7cc883afd04ceecfb6037178.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
845e6c0d7cc883afd04ceecfb6037178.exepid process 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe 2100 845e6c0d7cc883afd04ceecfb6037178.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
845e6c0d7cc883afd04ceecfb6037178.exepid process 2100 845e6c0d7cc883afd04ceecfb6037178.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
845e6c0d7cc883afd04ceecfb6037178.exedescription pid process Token: SeDebugPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: 33 2100 845e6c0d7cc883afd04ceecfb6037178.exe Token: SeIncBasePriorityPrivilege 2100 845e6c0d7cc883afd04ceecfb6037178.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
845e6c0d7cc883afd04ceecfb6037178.exedescription pid process target process PID 2100 wrote to memory of 4768 2100 845e6c0d7cc883afd04ceecfb6037178.exe netsh.exe PID 2100 wrote to memory of 4768 2100 845e6c0d7cc883afd04ceecfb6037178.exe netsh.exe PID 2100 wrote to memory of 4768 2100 845e6c0d7cc883afd04ceecfb6037178.exe netsh.exe PID 2100 wrote to memory of 1952 2100 845e6c0d7cc883afd04ceecfb6037178.exe netsh.exe PID 2100 wrote to memory of 1952 2100 845e6c0d7cc883afd04ceecfb6037178.exe netsh.exe PID 2100 wrote to memory of 1952 2100 845e6c0d7cc883afd04ceecfb6037178.exe netsh.exe PID 2100 wrote to memory of 4032 2100 845e6c0d7cc883afd04ceecfb6037178.exe netsh.exe PID 2100 wrote to memory of 4032 2100 845e6c0d7cc883afd04ceecfb6037178.exe netsh.exe PID 2100 wrote to memory of 4032 2100 845e6c0d7cc883afd04ceecfb6037178.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\845e6c0d7cc883afd04ceecfb6037178.exe"C:\Users\Admin\AppData\Local\Temp\845e6c0d7cc883afd04ceecfb6037178.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\845e6c0d7cc883afd04ceecfb6037178.exe" "845e6c0d7cc883afd04ceecfb6037178.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\845e6c0d7cc883afd04ceecfb6037178.exe"2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\845e6c0d7cc883afd04ceecfb6037178.exe" "845e6c0d7cc883afd04ceecfb6037178.exe" ENABLE2⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1952-134-0x0000000000000000-mapping.dmp
-
memory/2100-132-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/2100-136-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/4032-135-0x0000000000000000-mapping.dmp
-
memory/4768-133-0x0000000000000000-mapping.dmp