1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d

General

Target

1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Size

37KB
MD5

a1a88671237a04541b15257398625905
SHA1

c8442846b3484b99e2525da119474f89322fc58a
SHA256

1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d
SHA512

1ec2dba9adec2159271409364e31e021e9265b29c68fbd6860cb67913000cd5fd4feda98f87a0c2130050e6418103be8f01afc451392105313da575d529e401d
SSDEEP

384:peSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzXL:MS7TZ38fvCv3E1cQrM+rMRa8NuIyt

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

2236 netsh.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
2236	netsh.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe

description	pid	process
Token: SeDebugPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: 33	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
Token: SeIncBasePriorityPrivilege	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe

description	pid	process	target process
PID 3572 wrote to memory of 2236	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe	netsh.exe
PID 3572 wrote to memory of 2236	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe	netsh.exe
PID 3572 wrote to memory of 2236	3572	1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe
"C:\Users\Admin\AppData\Local\Temp\1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe" "1f7b3c14df18b53233421d630468fba392e0ea3058502cf73fbd83bf77bb994d.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3572-2-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/3572-1-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/3572-0-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/3572-3-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/3572-4-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/3572-5-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing