7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06/08/2023, 09:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Size

37KB
MD5

27f40a5673ac55f47d781331ef416de6
SHA1

2391e533a1c95f8fd20ee73cac60f5971bdd9f0b
SHA256

7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90
SHA512

dde5c40ee024a7a6e5a872f6ef1b2e102dfd9e9e2dbe1bea2810cdc738ee79b0ee5bc4d1330aa1ec4abab74bff1899ec5103acc4154cf97c1a13da875904b08e
SSDEEP

384:8kqBkiyjnDNGRn5IyUvapIrPbh+/VsIt6xrAF+rMRTyN/0L+EcoinblneHQM3epW:X35M5jUvairANsIQxrM+rMRa8NuCzt

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2976	netsh.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: 33	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
Token: SeIncBasePriorityPrivilege	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2976	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe	28
PID 1796 wrote to memory of 2976	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe	28
PID 1796 wrote to memory of 2976	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe	28
PID 1796 wrote to memory of 2976	1796	7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe" "7c7ba89ee3046a45f2fbec7bb10cc437782bdd347152fb47199a776a75756a90exe_JC.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-54-0x0000000074CB0000-0x000000007525B000-memory.dmp

Filesize
5.7MB

Download
memory/1796-56-0x0000000000410000-0x0000000000450000-memory.dmp

Filesize
256KB

Download
memory/1796-55-0x0000000074CB0000-0x000000007525B000-memory.dmp

Filesize
5.7MB

Download
memory/1796-57-0x0000000074CB0000-0x000000007525B000-memory.dmp

Filesize
5.7MB

Download
memory/1796-58-0x0000000074CB0000-0x000000007525B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads