7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-10-2022 09:17

Target

7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe
Size

229KB
MD5

738af33a3b684c3eb1fcb735b3c9d910
SHA1

e1b34cf168ef9ffaf30c1857d1de83ffeb352a29
SHA256

7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82
SHA512

30618b870068f57b1eb0642468618b5ed3bcd8acf137a57a5f506a4120424a82103c4ddb46c1f849814a5278b5fd9c6373d1cc8fef9952cac54839ef1226c4df
SSDEEP

3072:o05J4NVYRPoamujbI/bpzoMGET0v/rzlxyjNVQvfrIvBF6VlP6HaH976xuT76Y2E:o+J4Ni0pznrInPlxugG8OadmI76Y2j

Score

8^/10

evasion

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

pid	Process
2016	netsh.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1812	7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2016	1812	7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe	28
PID 1812 wrote to memory of 2016	1812	7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe	28
PID 1812 wrote to memory of 2016	1812	7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe	28
PID 1812 wrote to memory of 2016	1812	7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe	28

C:\Users\Admin\AppData\Local\Temp\7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe
"C:\Users\Admin\AppData\Local\Temp\7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe" "7f13d89e67f90a66320266137b8bb74ba28e36fd609e124a083c06d7f567bc82.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:2016

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1812-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1812-56-0x0000000074970000-0x0000000074F1B000-memory.dmp

Filesize
5.7MB

Download
memory/1812-58-0x0000000074970000-0x0000000074F1B000-memory.dmp

Filesize
5.7MB

Download
memory/2016-55-0x0000000000000000-mapping.dmp

Download