Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2022 15:19
Behavioral task
behavioral1
Sample
server.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
server.exe
Resource
win10v2004-20220721-en
General
-
Target
server.exe
-
Size
37KB
-
MD5
4bc8c9f0374e9e8b462ba68c3c05cbc8
-
SHA1
d23e233c019deb218dc12656b6068ed6bb1e0f09
-
SHA256
1caefcd78f2581528f9ffe0dd5e3832dff1d4cc72168716145d59ceb0388f000
-
SHA512
302068d057b831233057f3fd033f7d5a4b4fabca328ac135d637fc80119a2be938681e04951734b8078ad6a08a69dc59b279d0ae94f2db844c9a37adfcdb55d5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
tmp2357.tmp.exepid process 3444 tmp2357.tmp.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
server.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation server.exe -
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c79c8749d02e545a8c69b1379eed97c4.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c79c8749d02e545a8c69b1379eed97c4.exe server.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
server.exetmp2357.tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c79c8749d02e545a8c69b1379eed97c4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c79c8749d02e545a8c69b1379eed97c4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlocker-2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2357.tmp.exe" tmp2357.tmp.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
server.exedescription ioc process File created C:\autorun.inf server.exe File opened for modification C:\autorun.inf server.exe File created D:\autorun.inf server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4396 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
server.exepid process 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe 4144 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
server.exepid process 4144 server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
server.exetaskkill.exetmp2357.tmp.exedescription pid process Token: SeDebugPrivilege 4144 server.exe Token: SeDebugPrivilege 4396 taskkill.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: SeDebugPrivilege 3444 tmp2357.tmp.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe Token: 33 4144 server.exe Token: SeIncBasePriorityPrivilege 4144 server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
server.exedescription pid process target process PID 4144 wrote to memory of 2360 4144 server.exe netsh.exe PID 4144 wrote to memory of 2360 4144 server.exe netsh.exe PID 4144 wrote to memory of 2360 4144 server.exe netsh.exe PID 4144 wrote to memory of 4396 4144 server.exe taskkill.exe PID 4144 wrote to memory of 4396 4144 server.exe taskkill.exe PID 4144 wrote to memory of 4396 4144 server.exe taskkill.exe PID 4144 wrote to memory of 3444 4144 server.exe tmp2357.tmp.exe PID 4144 wrote to memory of 3444 4144 server.exe tmp2357.tmp.exe PID 4144 wrote to memory of 3444 4144 server.exe tmp2357.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp2357.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2357.tmp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2357.tmp.exeFilesize
39KB
MD55deb505257c4620dd4f384400530be29
SHA1c70445b1cd19ab6e0d6061a54de54d172a32c8df
SHA25608d688326886c51307f250f56b43cc13a6e90c516107f3f8bc0ddf675247c0ec
SHA5124a90cb76532a03c53990a34c1cbb4bd539b68b9b2d603f58119a4ef2c2be26ce9ed822af98d7ceb9c7dc126970789754f45fce63ea146fe7ca481c07b4454813
-
C:\Users\Admin\AppData\Local\Temp\tmp2357.tmp.exeFilesize
39KB
MD55deb505257c4620dd4f384400530be29
SHA1c70445b1cd19ab6e0d6061a54de54d172a32c8df
SHA25608d688326886c51307f250f56b43cc13a6e90c516107f3f8bc0ddf675247c0ec
SHA5124a90cb76532a03c53990a34c1cbb4bd539b68b9b2d603f58119a4ef2c2be26ce9ed822af98d7ceb9c7dc126970789754f45fce63ea146fe7ca481c07b4454813
-
memory/2360-131-0x0000000000000000-mapping.dmp
-
memory/3444-134-0x0000000000000000-mapping.dmp
-
memory/3444-137-0x00000000008A0000-0x00000000008B0000-memory.dmpFilesize
64KB
-
memory/3444-138-0x0000000005830000-0x0000000005DD4000-memory.dmpFilesize
5.6MB
-
memory/3444-139-0x0000000005180000-0x0000000005212000-memory.dmpFilesize
584KB
-
memory/3444-140-0x0000000005110000-0x000000000511A000-memory.dmpFilesize
40KB
-
memory/4144-130-0x0000000074760000-0x0000000074D11000-memory.dmpFilesize
5.7MB
-
memory/4144-133-0x0000000074760000-0x0000000074D11000-memory.dmpFilesize
5.7MB
-
memory/4396-132-0x0000000000000000-mapping.dmp