af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 21:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Size 93KB
Sample240802-1n8m4swfle
SHA256 af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea
MD5 ad185b3c650db0fa347fa6b28fd200d4
SHA1 8b8e91aee9231fead2c1e844f4f89ee0fb375128
SHA512 1219a6911e276d7f4e5b71e7f053499ee99ffabbe665b03bab250eb25d1c794d1f17de5799e9e1e17d795bdc6635663f6dad9cf0ba1ae0a03a9d918063dd17af
SSDEEP 1536:+gwC+xhUa9urgOBPRNvM4jEwzGi1dDYD+gS:+gmUa9urgObdGi1dOj
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3788	netsh.exe
1236	netsh.exe
1816	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: 33	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
Token: SeIncBasePriorityPrivilege	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3788	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe	84
PID 4496 wrote to memory of 3788	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe	84
PID 4496 wrote to memory of 3788	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe	84
PID 4496 wrote to memory of 1236	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe	86
PID 4496 wrote to memory of 1236	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe	86
PID 4496 wrote to memory of 1236	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe	86
PID 4496 wrote to memory of 1816	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe	87
PID 4496 wrote to memory of 1816	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe	87
PID 4496 wrote to memory of 1816	4496	af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe	87

C:\Users\Admin\AppData\Local\Temp\af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe
"C:\Users\Admin\AppData\Local\Temp\af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe" "af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3788
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1236
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe" "af8d289e7d88de7b99f7c92b3403f705ee548d50211acc3fe918af1b35abebea.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1816