Analysis

  • max time kernel
    299s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-02-2024 23:04

General

  • Target

    66666.exe

  • Size

    93KB

  • MD5

    5391f790fd71a00202e64b0b9aabd3e7

  • SHA1

    b1645aa8d59fabada9f1ba0fbd9cbd8167793642

  • SHA256

    feae432dd8804bc4193b1632ebf7fc5244f49408ba28462a944d90e0b200418a

  • SHA512

    3ae4f82ac3ef7184b440afbbba4f6e552994eddc89a2d6f535b246cfd6351e1d9d84acdae11d8f751b7d53a845d127711b0c44e85533142bf152f93236d681c5

  • SSDEEP

    768:MY33UYSgmnldjcRoMwrx7Y+DIkIITJbXX0pOtzux82WXxrjEtCdnl2pi1Rz4Rk3/:DUmmlbrq+1NTZrOojEwzGi1dDNDpgS

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66666.exe
    "C:\Users\Admin\AppData\Local\Temp\66666.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\66666.exe" "66666.exe" ENABLE
      2⤵
      • Modifies Windows Firewall
      PID:2892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2804-0-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2804-1-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2804-2-0x0000000000160000-0x00000000001A0000-memory.dmp

    Filesize

    256KB

  • memory/2804-4-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2804-5-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2804-6-0x0000000000160000-0x00000000001A0000-memory.dmp

    Filesize

    256KB