822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Size

37KB
MD5

d7fedad434c8b6a9d112896006a072a0
SHA1

96276c663e47772edce627e1d2d64709dd168506
SHA256

822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb
SHA512

aff5e3b6753031ee8a179d3242760926b1ed97c08490406533677ed18cc5b2ae18ee11b4b835c8d8ca2500362d0574eb741f5a12a1efdf664c704553a6ed7e2f
SSDEEP

384:V6l+yw7BeAaXaEiVbzdmB0O4yUvNixgp+Z2v/RFJ/oM6IxrAF+rMRTyN/0L+EcoO:Mcyw79POTUvNZBv64rM+rMRa8NukEt

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1708 netsh.exe

pid	process
1708	netsh.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe

description	pid	process
Token: SeDebugPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: 33	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
Token: SeIncBasePriorityPrivilege	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe

description	pid	process	target process
PID 1556 wrote to memory of 1708	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe	netsh.exe
PID 1556 wrote to memory of 1708	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe	netsh.exe
PID 1556 wrote to memory of 1708	1556	822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe
"C:\Users\Admin\AppData\Local\Temp\822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe" "822ac77de47d345d09da7c2a93916bb251710bfe61b2ec179564f09bcb5ea6cb.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-132-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/1556-133-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/1708-134-0x0000000000000000-mapping.dmp

Download