d9be23f04b3af31b16247e792983bd73bf6016c05822614afe545b9f7c291a79

Analysis

max time kernel
144s
max time network
150s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
25-06-2023 11:24

Target

Server.exe
Size

37KB
MD5

0ceb4f5cf4dde9a4641c6575f78f72ab
SHA1

eb9f46fc0fafd4fd80321444ce642529366534de
SHA256

d9be23f04b3af31b16247e792983bd73bf6016c05822614afe545b9f7c291a79
SHA512

3f08b4c2f6b7c4c76f27b73a0e1ac911352c70ebd26b13da11ef64591bd3111b9d253f466815d89960c3bf103afb0d5d9561237a1d250593521355babd87915e
SSDEEP

384:sNQCT0i9HdTe/kCOyU73oflQDXSikrAF+rMRTyN/0L+EcoinblneHQM3epzXqNrJ:yVt1CFU73oSDSPrM+rMRa8NuA9t

Score

8^/10

evasion

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1416 netsh.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
1416	netsh.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe
Token: 33	816	Server.exe
Token: SeIncBasePriorityPrivilege	816	Server.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Server.exe

description	pid	process	target process
PID 816 wrote to memory of 1416	816	Server.exe	netsh.exe
PID 816 wrote to memory of 1416	816	Server.exe	netsh.exe
PID 816 wrote to memory of 1416	816	Server.exe	netsh.exe
PID 816 wrote to memory of 1416	816	Server.exe	netsh.exe

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1416

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

memory/816-54-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/816-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/816-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download