cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0

Analysis

max time kernel
173s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:53

Target

cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe
Size

412KB
MD5

daba3d3b126030a50f007189f1e14e7a
SHA1

a43808350b8e80b104f17e3b2ee37d8966d3ba57
SHA256

cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0
SHA512

06460ca0ab18fb32c34aa499226fa73550859bbb10817730e08d9744a9270bb7d14100ef25574a09859fea5893fb8165662add87db3818ee3d3ed32c20be1ef6
SSDEEP

6144:f2JhcuSp6IppqRbqWmlnhId0rA/4XZnGp61+2hu5bvYShiUAAvXQIQNlP6hM:f2E0ILqRWWyh5zXBIv1HQPPqM

Score

8^/10

evasion

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

pid	Process
1744	netsh.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe
2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe
2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe
2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1988	2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe	28
PID 2028 wrote to memory of 1988	2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe	28
PID 2028 wrote to memory of 1988	2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe	28
PID 2028 wrote to memory of 1988	2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe	28
PID 2028 wrote to memory of 1744	2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe	30
PID 2028 wrote to memory of 1744	2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe	30
PID 2028 wrote to memory of 1744	2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe	30
PID 2028 wrote to memory of 1744	2028	cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe	30
PID 1988 wrote to memory of 268	1988	net.exe	32
PID 1988 wrote to memory of 268	1988	net.exe	32
PID 1988 wrote to memory of 268	1988	net.exe	32
PID 1988 wrote to memory of 268	1988	net.exe	32

C:\Users\Admin\AppData\Local\Temp\cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe
"C:\Users\Admin\AppData\Local\Temp\cd86717ae3551cc6aa16a7c149af6b3b27125538015af7c7a4502882cee138c0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\net.exe
  net stop alg
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop alg
    3⤵
    PID:268
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  PID:1744

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1744-59-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download