Overview
overview
8Static
static
1.exe
windows7_x64
11.exe
windows10_x64
8Fallen.exe
windows7_x64
8Fallen.exe
windows10_x64
8Inte.exe
windows7_x64
8Inte.exe
windows10_x64
8LX64
windows7_x64
1LX64
windows10_x64
1Server.exe
windows7_x64
8Server.exe
windows10_x64
8hfs.exe
windows7_x64
6hfs.exe
windows10_x64
6hfs_1.exe
windows7_x64
6hfs_1.exe
windows10_x64
6hg
windows7_x64
1hg
windows10_x64
1java
windows7_x64
1java
windows10_x64
1moren.exe
windows7_x64
6moren.exe
windows10_x64
6Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10_x64 -
resource
win10v200217 -
submitted
10-03-2020 00:09
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7v200217
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v200217
Behavioral task
behavioral3
Sample
Fallen.exe
Resource
win7v200217
Behavioral task
behavioral4
Sample
Fallen.exe
Resource
win10v200217
Behavioral task
behavioral5
Sample
Inte.exe
Resource
win7v200217
Behavioral task
behavioral6
Sample
Inte.exe
Resource
win10v200217
Behavioral task
behavioral7
Sample
LX64
Resource
win7v200217
Behavioral task
behavioral8
Sample
LX64
Resource
win10v200217
Behavioral task
behavioral9
Sample
Server.exe
Resource
win7v200217
Behavioral task
behavioral10
Sample
Server.exe
Resource
win10v200217
Behavioral task
behavioral11
Sample
hfs.exe
Resource
win7v200217
Behavioral task
behavioral12
Sample
hfs.exe
Resource
win10v200217
Behavioral task
behavioral13
Sample
hfs_1.exe
Resource
win7v200217
Behavioral task
behavioral14
Sample
hfs_1.exe
Resource
win10v200217
Behavioral task
behavioral15
Sample
hg
Resource
win7v200217
Behavioral task
behavioral16
Sample
hg
Resource
win10v200217
Behavioral task
behavioral17
Sample
java
Resource
win7v200217
Behavioral task
behavioral18
Sample
java
Resource
win10v200217
Behavioral task
behavioral19
Sample
moren.exe
Resource
win7v200217
Behavioral task
behavioral20
Sample
moren.exe
Resource
win10v200217
General
-
Target
Server.exe
-
Size
96KB
-
MD5
bfd0dcf57209068cc25907ff8ddc17e1
-
SHA1
8b913990c8691231e1d8e249d6d7f9a59b85dc1e
-
SHA256
8a16390f705599cacaba51ccf440f7f0a8320e614f71710a594312756788b28d
-
SHA512
8a2838fd69419a249a37b7569a7c0333e8c36a71df0dc7b8ea414f87392b42e885bcd3fc41b6bda181c6f69d98a5a5367d06b8ff6c7d3e577ea4d2581c2bfe09
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3988 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Server.exedescription pid process Token: SeIncBasePriorityPrivilege 4020 Server.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Server.exedescription pid process target process PID 4020 wrote to memory of 4040 4020 Server.exe cmd.exe PID 4020 wrote to memory of 4040 4020 Server.exe cmd.exe PID 4020 wrote to memory of 4040 4020 Server.exe cmd.exe -
Drops file in Program Files directory 3 IoCs
Processes:
Server.exedescription ioc process File opened for modification C:\Program Files\nannaa\svchost.exe Server.exe File opened for modification C:\Program Files\nannaa Server.exe File created C:\Program Files\nannaa\svchost.exe Server.exe -
Modifies service 2 TTPs 1 IoCs
Processes:
Server.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Test 111.0\Description = "This is Windows Server 511.0" Server.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Modifies service
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\Server.exe > nul2⤵
-
C:\Program Files\nannaa\svchost.exe"C:\Program Files\nannaa\svchost.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry