c4edeb1befa9d2125c24938dfa1ac106d35f6992793a5ebc8c2b09ec38777ca8 | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-08-2023 18:37

Sharing

Report Analysis Logs

General

Target

1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Size

93KB
MD5

1fb97ee37a2c5a979bc4dff4613f9fb2
SHA1

13679e8eb6e8995bfda6590f3dd04c6d99104b67
SHA256

c4edeb1befa9d2125c24938dfa1ac106d35f6992793a5ebc8c2b09ec38777ca8
SHA512

913f3b430ea169ae91079a65982b15b913c89ee9eb43eb15a09bb44f052e27597e598017b1c3cc47b2633e8ef9c9b5f056e447beb5b61f3453e2280c0c52a727
SSDEEP

1536:ghnR8lZc+/2HK1j+58dljEwzGi1dDUDPgS:ghnKc+/2HK1a8dSi1dyo

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Modifies Windows Firewall 1 TTPs 3 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exenetsh.exe

pid process

2832 netsh.exe
2848 netsh.exe
2932 netsh.exe

Drops startup file 6 IoCs

Processes:

1fb97ee37a2c5a979bc4dff4613f9fb2.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af200c2dc24146f167c6cde4523f107fSteam.exe	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af200c2dc24146f167c6cde4523f107fSteam.exe	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	1fb97ee37a2c5a979bc4dff4613f9fb2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 2 IoCs

Processes:

1fb97ee37a2c5a979bc4dff4613f9fb2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Explower.exe	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
File opened for modification	C:\Windows\SysWOW64\Explower.exe	1fb97ee37a2c5a979bc4dff4613f9fb2.exe

Drops file in Program Files directory 2 IoCs

Processes:

1fb97ee37a2c5a979bc4dff4613f9fb2.exe

description	ioc	process
File created	C:\Program Files (x86)\Explower.exe	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
File opened for modification	C:\Program Files (x86)\Explower.exe	1fb97ee37a2c5a979bc4dff4613f9fb2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1fb97ee37a2c5a979bc4dff4613f9fb2.exe

pid	process
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

1fb97ee37a2c5a979bc4dff4613f9fb2.exe

pid process

1132 1fb97ee37a2c5a979bc4dff4613f9fb2.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

1fb97ee37a2c5a979bc4dff4613f9fb2.exe

description	pid	process
Token: SeDebugPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: 33	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Token: SeIncBasePriorityPrivilege	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1fb97ee37a2c5a979bc4dff4613f9fb2.exe

description	pid	process	target process
PID 1132 wrote to memory of 2848	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2848	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2848	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2848	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2932	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2932	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2932	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2932	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2832	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2832	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2832	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe
PID 1132 wrote to memory of 2832	1132	1fb97ee37a2c5a979bc4dff4613f9fb2.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe
"C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe" "1fb97ee37a2c5a979bc4dff4613f9fb2.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:2848
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe"
  2⤵
  - Modifies Windows Firewall
  PID:2932
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe" "1fb97ee37a2c5a979bc4dff4613f9fb2.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Explower.exe

Filesize
93KB

MD5
1fb97ee37a2c5a979bc4dff4613f9fb2

SHA1
13679e8eb6e8995bfda6590f3dd04c6d99104b67

SHA256
c4edeb1befa9d2125c24938dfa1ac106d35f6992793a5ebc8c2b09ec38777ca8

SHA512
913f3b430ea169ae91079a65982b15b913c89ee9eb43eb15a09bb44f052e27597e598017b1c3cc47b2633e8ef9c9b5f056e447beb5b61f3453e2280c0c52a727

Download Submit
memory/1132-0-0x0000000073ED0000-0x000000007447B000-memory.dmp

Filesize
5.7MB

Download
memory/1132-1-0x0000000073ED0000-0x000000007447B000-memory.dmp

Filesize
5.7MB

Download
memory/1132-2-0x00000000009D0000-0x0000000000A10000-memory.dmp

Filesize
256KB

Download
memory/1132-19-0x0000000073ED0000-0x000000007447B000-memory.dmp

Filesize
5.7MB

Download
memory/1132-20-0x0000000073ED0000-0x000000007447B000-memory.dmp

Filesize
5.7MB

Download