986318ede14f0c866a87c7a9afb87a86cf126e223608c017e94a9b6cedada3a1

Analysis

max time kernel
143s
max time network
135s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-03-2023 22:25

Target

7eabcccdd626bbb3883ec3984f0fe573.exe
Size

37KB
MD5

7eabcccdd626bbb3883ec3984f0fe573
SHA1

bd03afef8d7c4398edf3be8256d98e195b371aa3
SHA256

986318ede14f0c866a87c7a9afb87a86cf126e223608c017e94a9b6cedada3a1
SHA512

827009e45bbf3a3110658c5c546325174f334e6533cb4633fc3ed15063180e30457d83f3cae5b6d23e5fd0a12c1ebd5fa3b362b1d5c69bbb6c57bbdb3e1048b5
SSDEEP

384:p6l+yw7BeAaXaEiVbzdmB0O4yUvNixgp+Z2v/RYJ/oM6IMrAF+rMRTyN/0L+Ecoi:ocyw79POTUvNZYv6trM+rMRa8Nu2qt

Score

8^/10

evasion

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1420 netsh.exe

pid	process
1420	netsh.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

7eabcccdd626bbb3883ec3984f0fe573.exe

description	pid	process
Token: SeDebugPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: 33	1540	7eabcccdd626bbb3883ec3984f0fe573.exe
Token: SeIncBasePriorityPrivilege	1540	7eabcccdd626bbb3883ec3984f0fe573.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7eabcccdd626bbb3883ec3984f0fe573.exe

description	pid	process	target process
PID 1540 wrote to memory of 1420	1540	7eabcccdd626bbb3883ec3984f0fe573.exe	netsh.exe
PID 1540 wrote to memory of 1420	1540	7eabcccdd626bbb3883ec3984f0fe573.exe	netsh.exe
PID 1540 wrote to memory of 1420	1540	7eabcccdd626bbb3883ec3984f0fe573.exe	netsh.exe
PID 1540 wrote to memory of 1420	1540	7eabcccdd626bbb3883ec3984f0fe573.exe	netsh.exe

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\7eabcccdd626bbb3883ec3984f0fe573.exe" "7eabcccdd626bbb3883ec3984f0fe573.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1420

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1540-54-0x00000000001C0000-0x0000000000200000-memory.dmp

Filesize
256KB

Download
memory/1540-55-0x00000000001C0000-0x0000000000200000-memory.dmp

Filesize
256KB

Download