Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
21/04/2023, 01:12
General
-
Target
svchost.exe
-
Size
283KB
-
MD5
820999a17f6c2b1d67b4d81db8a9be4a
-
SHA1
db2349dde07e3bc8ecd9ef8704be7fe8d923a587
-
SHA256
b0cf99edf8af0ae79fa70a46fd38f03fea4146067ab41e9aea100aa4c96a2d38
-
SHA512
211433be1d58b14c7f7d229a27607716b3f6db94aeeb054888d48f167b7ad0a996c5ccf413ff6b2857545a2f4b178d883e97ebbff0bcf4d6caa350dcabc746bb
-
SSDEEP
6144:Aj12paTknvnpNjsxpwcG+eYkmlynjsETa4HXueA1qDf0eTL2gFK:i2pbvCtGvYkm1ETx3ueAADTag
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE2⤵
- Modifies Windows Firewall
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283KB
MD5820999a17f6c2b1d67b4d81db8a9be4a
SHA1db2349dde07e3bc8ecd9ef8704be7fe8d923a587
SHA256b0cf99edf8af0ae79fa70a46fd38f03fea4146067ab41e9aea100aa4c96a2d38
SHA512211433be1d58b14c7f7d229a27607716b3f6db94aeeb054888d48f167b7ad0a996c5ccf413ff6b2857545a2f4b178d883e97ebbff0bcf4d6caa350dcabc746bb
-
Filesize
304KB
-
Filesize
512KB
-
Filesize
56KB
-
Filesize
512KB
-
Filesize
512KB