d4d76221e7967902519c3524609eb8c2c32dff6d626a7b520a221095a38bf476

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Size

37KB
MD5

1ca1d798cf068a8ec73eb68cd8cf5d97
SHA1

932382d5d4b09915cfde98bd823f188cfad721a4
SHA256

d4d76221e7967902519c3524609eb8c2c32dff6d626a7b520a221095a38bf476
SHA512

98fa9020224063db62a8c099eaf1f62956c2eafc1ef57f93bc743ab2bcb74dda8e60e3f36ffa054601454fd5f9e36f9972c9834063e980dc50787c4b0f41d874
SSDEEP

384:1eSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzX9:YS7TZ38fvCv3E1cQrM+rMRa8Nutjt

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
300	netsh.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: 33	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Token: SeIncBasePriorityPrivilege	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 300	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe	30
PID 2308 wrote to memory of 300	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe	30
PID 2308 wrote to memory of 300	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe	30
PID 2308 wrote to memory of 300	2308	1ca1d798cf068a8ec73eb68cd8cf5d97.exe	30

C:\Users\Admin\AppData\Local\Temp\1ca1d798cf068a8ec73eb68cd8cf5d97.exe
"C:\Users\Admin\AppData\Local\Temp\1ca1d798cf068a8ec73eb68cd8cf5d97.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1ca1d798cf068a8ec73eb68cd8cf5d97.exe" "1ca1d798cf068a8ec73eb68cd8cf5d97.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-0-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2308-1-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2308-2-0x0000000000B10000-0x0000000000B50000-memory.dmp

Filesize
256KB

Download
memory/2308-3-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2308-4-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2308-5-0x0000000000B10000-0x0000000000B50000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads