0bb78df6c8e049c7a33d2656555e15388a59ee96bde6f221ac5494b959cd60eb

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2023 04:53

Target

server.exe
Size

22KB
MD5

3e5b7dedb99563e687b56384bcd24823
SHA1

17425dd4f9c65e1a5c8b4bcbef298d4dc625ae30
SHA256

c154d0f2c61353e96026f7036e79e8217b078bbf1947d7a2d7753cab657022f1
SHA512

ee97b1e8ab38bced198206a8b78d324c43df4eeb5bd96d484569cafe5527a55b52736708d7e38fcf2925f252e823efe894b5cae443025580c1507c0d920ad389
SSDEEP

384:IMWFbYuh12fGSjkd867JswS/oyVFiGspJjHO5rf1k7SWOoD21pE3nZ6IML:I38uhkfGS8W/rVFiGspJGrq7SAspcyL

Score

8^/10

evasion

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1604 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

2404 server.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1604	netsh.exe

pid	process
2404	server.exe

Modifies data under HKEY_USERS 7 IoCs

Processes:

server.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	server.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d9c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	server.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	server.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	server.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	server.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

server.exe

description pid process target process

PID 2404 wrote to memory of 1604 2404 server.exe netsh.exe
PID 2404 wrote to memory of 1604 2404 server.exe netsh.exe

description	pid	process	target process
PID 2404 wrote to memory of 1604	2404	server.exe	netsh.exe
PID 2404 wrote to memory of 1604	2404	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
1⤵
PID:1680

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" firewall set allowedprogram program = C:\backconnect\server.exe name = backconnect mode = ENABLE
2⤵
- Modifies Windows Firewall
PID:1604

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\backconnect\server.exe

Filesize
22KB

MD5
3e5b7dedb99563e687b56384bcd24823

SHA1
17425dd4f9c65e1a5c8b4bcbef298d4dc625ae30

SHA256
c154d0f2c61353e96026f7036e79e8217b078bbf1947d7a2d7753cab657022f1

SHA512
ee97b1e8ab38bced198206a8b78d324c43df4eeb5bd96d484569cafe5527a55b52736708d7e38fcf2925f252e823efe894b5cae443025580c1507c0d920ad389

Download Submit
C:\backconnect\server.exe

Filesize
22KB

MD5
3e5b7dedb99563e687b56384bcd24823

SHA1
17425dd4f9c65e1a5c8b4bcbef298d4dc625ae30

SHA256
c154d0f2c61353e96026f7036e79e8217b078bbf1947d7a2d7753cab657022f1

SHA512
ee97b1e8ab38bced198206a8b78d324c43df4eeb5bd96d484569cafe5527a55b52736708d7e38fcf2925f252e823efe894b5cae443025580c1507c0d920ad389

Download Submit