Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2023 11:39
Behavioral task
behavioral1
Sample
Server2.exe
Resource
win7-20230712-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server2.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
Server2.exe
-
Size
93KB
-
MD5
99e853cafc9f7388bfb2c589befa031c
-
SHA1
dafdcf6b18fc510749bc8954f061f3746c1213b2
-
SHA256
32064b227c71528839b8e12b5b146ca30c7c8b14dd2de844a7f9ac33447d9e1b
-
SHA512
6885636a339fd11c16b8d54ee4a3579d8abbd101d24802d944bf6b05d57c846061c4c20b322cede761b5349d0710855a7cab3f6db14c510a4aa322f161143894
-
SSDEEP
1536:i55edxQJ9waK7jh7CQjEwzGi1dDJDrgS:i50QJ9waK7jtCBi1d1k
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4864 netsh.exe -
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\826b22ef700aaefcf31da94d3a2fb0b7Windows Update.exe Server2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\826b22ef700aaefcf31da94d3a2fb0b7Windows Update.exe Server2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe 4940 Server2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4940 Server2.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe Token: 33 4940 Server2.exe Token: SeIncBasePriorityPrivilege 4940 Server2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4940 wrote to memory of 4864 4940 Server2.exe 86 PID 4940 wrote to memory of 4864 4940 Server2.exe 86 PID 4940 wrote to memory of 4864 4940 Server2.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server2.exe"C:\Users\Admin\AppData\Local\Temp\Server2.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server2.exe" "Server2.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:4864
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
Filesize93KB
MD599e853cafc9f7388bfb2c589befa031c
SHA1dafdcf6b18fc510749bc8954f061f3746c1213b2
SHA25632064b227c71528839b8e12b5b146ca30c7c8b14dd2de844a7f9ac33447d9e1b
SHA5126885636a339fd11c16b8d54ee4a3579d8abbd101d24802d944bf6b05d57c846061c4c20b322cede761b5349d0710855a7cab3f6db14c510a4aa322f161143894