Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2023, 01:07
Behavioral task
behavioral1
Sample
dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe
Resource
win7-20231023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe
-
Size
37KB
-
MD5
1f4b7d2f534977627fa2a529013a5b58
-
SHA1
88077cc48814bc2743ab721f4ae6a5a09724e6ee
-
SHA256
dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517
-
SHA512
739d25226f323c141fbda2dbf5cf7f98787487be36621186b6815f147bd1e8c04dfc0cbc057a3f5bf83aa676f1c939a3e571f324142528dbc5e0a9ceeb207186
-
SSDEEP
384:FuSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXz:4S7TZ38fvCv3E1c1rM+rMRa8NuUet
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4456 netsh.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: 33 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe Token: SeIncBasePriorityPrivilege 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3672 wrote to memory of 4456 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 91 PID 3672 wrote to memory of 4456 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 91 PID 3672 wrote to memory of 4456 3672 dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe"C:\Users\Admin\AppData\Local\Temp\dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe" "dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:4456
-