711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2023, 18:43

Target

711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe
Size

956KB
MD5

1fb784f1150ce83f15a9ae7a704d5249
SHA1

479d665aa8af5b0f65b15ee854f8e88d355f9e9b
SHA256

711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580
SHA512

bd1fe1df2fdf547fe22330b9202f07bbfabdff9321f6e17548126a33c5fb3e80f266b15be4ba56c6c5de2586cfdbfcc9913b52bf5990b9f64ed10e4acfc302d8
SSDEEP

12288:XetS/tubFgV/xP/IU60zZYINgGmcxFhmp0NhQv2HcjOmXnzU/Ai:Xwj6p3N60zZYI5brcUQ+Uja

Score

8^/10

evasion

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Modify Existing Service

pid	Process
1412	netsh.exe
2068	netsh.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4248	711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe
4248	711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4248	711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 1412	4248	711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe	83
PID 4248 wrote to memory of 1412	4248	711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe	83
PID 4248 wrote to memory of 1412	4248	711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe	83
PID 4248 wrote to memory of 2068	4248	711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe	85
PID 4248 wrote to memory of 2068	4248	711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe	85
PID 4248 wrote to memory of 2068	4248	711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe	85

C:\Users\Admin\AppData\Local\Temp\711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe
"C:\Users\Admin\AppData\Local\Temp\711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall del rule program = "C:\Users\Admin\AppData\Local\Temp\711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe" name = "711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580" dir=in
  2⤵
  - Modifies Windows Firewall
  PID:1412
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule program = "C:\Users\Admin\AppData\Local\Temp\711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580.exe" name = "711463f70ff7c96892d33d2baadc0b7d5cf7b92ee34dd522c329f3843db6e580" dir=in action=allow
  2⤵
  - Modifies Windows Firewall
  PID:2068

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4248-133-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/4248-134-0x0000000000400000-0x00000000004F7000-memory.dmp

Filesize
988KB

Download
memory/4248-136-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/4248-137-0x0000000000400000-0x00000000004F7000-memory.dmp

Filesize
988KB

Download
memory/4248-139-0x0000000000400000-0x00000000004F7000-memory.dmp

Filesize
988KB

Download
memory/4248-143-0x0000000000400000-0x00000000004F7000-memory.dmp

Filesize
988KB

Download
memory/4248-144-0x0000000000400000-0x00000000004F7000-memory.dmp

Filesize
988KB

Download