546d7be50a9f2e5172fe46d3e20031f8d743d1f1cca29a432dfa3df9d109e292

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-03-2023 05:08

Target

bK7F.exe
Size

23KB
MD5

59645ca85405fac3881899a293149272
SHA1

a6fe815e16b0f0dbec37b553ec1d7ff4ac97f08f
SHA256

546d7be50a9f2e5172fe46d3e20031f8d743d1f1cca29a432dfa3df9d109e292
SHA512

ea3ff11fcad38c916a0b7c5266f9eaa69ff0d8bd36e9b1a768b407a70b32460d3d80e1b068c82e3981a6fb399a8fac02b2b914493df5ad7900627d6b27ee62e1
SSDEEP

384:3oWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZMo:Q7O89p2rRpcnu6

Score

8^/10

evasion

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1700 netsh.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
1700	netsh.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

bK7F.exe

description	pid	process
Token: SeDebugPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe
Token: 33	1476	bK7F.exe
Token: SeIncBasePriorityPrivilege	1476	bK7F.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bK7F.exe

description	pid	process	target process
PID 1476 wrote to memory of 1700	1476	bK7F.exe	netsh.exe
PID 1476 wrote to memory of 1700	1476	bK7F.exe	netsh.exe
PID 1476 wrote to memory of 1700	1476	bK7F.exe	netsh.exe
PID 1476 wrote to memory of 1700	1476	bK7F.exe	netsh.exe

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\bK7F.exe" "bK7F.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1700

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

memory/1476-54-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1476-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1476-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download