d438c32bcbfb0c9d9e04df397222b766dfc3502b3635b4ea63f11d6bc965a9ee

Analysis

max time kernel
18s
max time network
29s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d438c32bcbfb0c9d9e04df397222b766dfc3502b3635b4ea63f11d6bc965a9ee.exe
Size

67KB
MD5

0abf477c3e51e37c0987ae792f434d60
SHA1

edbfbf52a0e5276cca1bea89214ca0231987b71a
SHA256

d438c32bcbfb0c9d9e04df397222b766dfc3502b3635b4ea63f11d6bc965a9ee
SHA512

0da16f89be7ec8735154a8c7b3c275799fd2fbd0d182d800d97fbbeefd16510cd73fff39f8e3f592773b55f9184cfe4650508afae175007409edf22bcfed4fa4
SSDEEP

768:HOmaTzJ8ytcXzS6ig/ir+9WTW2il581g6HhjHGoqvtq14IQJ1XHCbYNCqPiHCCjS:IeWfZVNUWK3CbYsHCCrkboUW5C

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2160	netsh.exe

C:\Users\Admin\AppData\Local\Temp\d438c32bcbfb0c9d9e04df397222b766dfc3502b3635b4ea63f11d6bc965a9ee.exe
"C:\Users\Admin\AppData\Local\Temp\d438c32bcbfb0c9d9e04df397222b766dfc3502b3635b4ea63f11d6bc965a9ee.exe"
1⤵
PID:1624
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  PID:1284
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
27KB

MD5
95c40acc74a1c1b85335da23f6fa68d8

SHA1
d7cac26fb6a2afc00a245c035364d6a84d754bb7

SHA256
91d9da1c5cef2a85d16d1912f970e6b97b4e0626372418f27827ce9d3d665c23

SHA512
e8ec79cbbccfaa266e9421451c4fda5003a40f8fcf48507e007a94df01a479eaa709573ae9fadc6b4cb785b9df8059d63001b627f38b652e91f8e4cbc919780c

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
31KB

MD5
ac8d1068bcfdfca7bc60dca501ffda79

SHA1
079f756e68d4cf4063c0df7414370f2786a5e0ea

SHA256
bc78f418ece82844f115cb461c6df7354d267d345a46ca1b0d1c49228dad6dc7

SHA512
ea0e36c0343b83a89135b76dde048b3a6b776e544abe4399e253b7f83ad4439413b8c4cfe0abdfae1fcce82fba311a0d17ef4a89964d020ee35aab2dc620f77a

Download Submit
memory/1284-133-0x0000000000000000-mapping.dmp

Download
memory/1284-138-0x0000000074FD0000-0x0000000075581000-memory.dmp

Filesize
5.7MB

Download
memory/1284-139-0x0000000074FD0000-0x0000000075581000-memory.dmp

Filesize
5.7MB

Download
memory/1624-132-0x0000000074FD0000-0x0000000075581000-memory.dmp

Filesize
5.7MB

Download
memory/1624-136-0x0000000074FD0000-0x0000000075581000-memory.dmp

Filesize
5.7MB

Download
memory/2160-137-0x0000000000000000-mapping.dmp

Download