c7cc2d0b72eba9ef36f0ec9ad721b8a9e0dbaacb9121ccbead85b9751eb6f45b

General

Target

wscript.exe
Size

93KB
MD5

50af5e7d5d665f6e9cca447af7e8b1e5
SHA1

8cde307749103cf895cd8c2d87a8a73aa1017fa8
SHA256

c7cc2d0b72eba9ef36f0ec9ad721b8a9e0dbaacb9121ccbead85b9751eb6f45b
SHA512

abdcb709f2c1c7e951b9f4a61b0766db965376476043fba7c8f182740ece3e2be6ca2e7a66e09c1327274af2f507fb2cf3f5e39b2b80619f5aa33b8fb28117e2
SSDEEP

768:QY3CUfhWXxyFcxovUKUJuROprXtWNEpeYhYbmXxrjEtCdnl2pi1Rz4Rk3lsGdpc3:KU5WhIUKcuOJRpPhBjEwzGi1dD1DcgS

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1988 netsh.exe

pid	process
1988	netsh.exe

Drops startup file 4 IoCs

Processes:

wscript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7cf4c2536f30115b1e3e9ebf8675233aWindows Update.exe	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7cf4c2536f30115b1e3e9ebf8675233aWindows Update.exe	wscript.exe

Drops file in System32 directory 2 IoCs

Processes:

wscript.exe

description ioc process

File created C:\Windows\SysWOW64\Explower.exe wscript.exe
File opened for modification C:\Windows\SysWOW64\Explower.exe wscript.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Explower.exe	wscript.exe
File opened for modification	C:\Windows\SysWOW64\Explower.exe	wscript.exe

Drops file in Program Files directory 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Program Files (x86)\Explower.exe	wscript.exe
File opened for modification	C:\Program Files (x86)\Explower.exe	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

wscript.exe

pid process

2224 wscript.exe

pid	process
2224	wscript.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

wscript.exe

description	pid	process
Token: SeDebugPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe
Token: 33	2224	wscript.exe
Token: SeIncBasePriorityPrivilege	2224	wscript.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2224 wrote to memory of 1988	2224	wscript.exe	netsh.exe
PID 2224 wrote to memory of 1988	2224	wscript.exe	netsh.exe
PID 2224 wrote to memory of 1988	2224	wscript.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\wscript.exe
"C:\Users\Admin\AppData\Local\Temp\wscript.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\wscript.exe" "wscript.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Explower.exe
Filesize
93KB

MD5
50af5e7d5d665f6e9cca447af7e8b1e5

SHA1
8cde307749103cf895cd8c2d87a8a73aa1017fa8

SHA256
c7cc2d0b72eba9ef36f0ec9ad721b8a9e0dbaacb9121ccbead85b9751eb6f45b

SHA512
abdcb709f2c1c7e951b9f4a61b0766db965376476043fba7c8f182740ece3e2be6ca2e7a66e09c1327274af2f507fb2cf3f5e39b2b80619f5aa33b8fb28117e2

Download Submit
memory/2224-0-0x00000000747F0000-0x0000000074DA1000-memory.dmp

Filesize
5.7MB

Download
memory/2224-1-0x00000000747F0000-0x0000000074DA1000-memory.dmp

Filesize
5.7MB

Download
memory/2224-2-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Filesize
64KB

Download
memory/2224-13-0x00000000747F0000-0x0000000074DA1000-memory.dmp

Filesize
5.7MB

Download
memory/2224-14-0x00000000747F0000-0x0000000074DA1000-memory.dmp

Filesize
5.7MB

Download
memory/2224-15-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Filesize
64KB

Download
memory/2224-16-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Filesize
64KB

Download
memory/2224-17-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads