39449ed5c7216f72854dd70892f232a9bf18d2fadfa11815241e945fe8b9f693

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2023 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

93KB
MD5

4df32b61307af55a1af2834da73b1ba8
SHA1

3b0d10a30541a44b379fc803eae7b517c4d8c49f
SHA256

39449ed5c7216f72854dd70892f232a9bf18d2fadfa11815241e945fe8b9f693
SHA512

14c8bb72a473f27018d438fd7377c5d05a31a35f5150446156721fadc15eba97fe69b6c65dd4de3982ca2628b09b3ef278e7c68a0ab153ec74698d60b15c4057
SSDEEP

768:VY3MUgSgmnldjcRoMwrx7Y+DIkIITJbXX0pOtqux82WXxrjEtCdnl2pi1Rz4Rk3F:DUumlbrq+1NTZCOojEwzGi1dDlDHgS

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

1812 netsh.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Server.exe

pid process

1220 Server.exe

pid	process
1812	netsh.exe

pid	process
1220	Server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe
Token: 33	1220	Server.exe
Token: SeIncBasePriorityPrivilege	1220	Server.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Server.exe

description	pid	process	target process
PID 1220 wrote to memory of 1812	1220	Server.exe	netsh.exe
PID 1220 wrote to memory of 1812	1220	Server.exe	netsh.exe
PID 1220 wrote to memory of 1812	1220	Server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-0-0x0000000075410000-0x00000000759C1000-memory.dmp

Filesize
5.7MB

Download
memory/1220-1-0x0000000075410000-0x00000000759C1000-memory.dmp

Filesize
5.7MB

Download
memory/1220-2-0x00000000007B0000-0x00000000007C0000-memory.dmp

Filesize
64KB

Download
memory/1220-4-0x0000000075410000-0x00000000759C1000-memory.dmp

Filesize
5.7MB

Download
memory/1220-5-0x0000000075410000-0x00000000759C1000-memory.dmp

Filesize
5.7MB

Download
memory/1220-6-0x00000000007B0000-0x00000000007C0000-memory.dmp

Filesize
64KB

Download