Resubmissions

24-02-2024 04:53

240224-fjakasaf61 10

24-02-2024 04:37

240224-e889gshd68 10

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-02-2024 04:37

General

  • Target

    Server11.exe

  • Size

    93KB

  • MD5

    d888c07a6879d77124aa52938acf9ab9

  • SHA1

    fa359a08e8c19b324a26fde61a144ae57beccbd1

  • SHA256

    915be1f438915d9e334d6fd0021073e25a16ac5c0c5e6e8f945b30cbcfbeea90

  • SHA512

    8f1c8474f318faea11c408922f35b64826c904c91668d24665564d152eb6ae4d2e39761847ad5cd93f1dfeaf6681ec7474322a2af0a651b960e64e2ec356e42c

  • SSDEEP

    768:xY33UYSgmnldjcRoMwrx7Y+DIkIITJbXX0pOt8ux82WXxrjEtCdnl2pi1Rz4Rk3z:8Ummlbrq+1NTZ0OojEwzGi1dD2DCgS

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Server11.exe
    "C:\Users\Admin\AppData\Local\Temp\Server11.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server11.exe" "Server11.exe" ENABLE
      2⤵
      • Modifies Windows Firewall
      PID:2992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2516-0-0x0000000074AE0000-0x000000007508B000-memory.dmp

    Filesize

    5.7MB

  • memory/2516-1-0x0000000074AE0000-0x000000007508B000-memory.dmp

    Filesize

    5.7MB

  • memory/2516-2-0x00000000009D0000-0x0000000000A10000-memory.dmp

    Filesize

    256KB

  • memory/2516-4-0x0000000074AE0000-0x000000007508B000-memory.dmp

    Filesize

    5.7MB

  • memory/2516-5-0x0000000074AE0000-0x000000007508B000-memory.dmp

    Filesize

    5.7MB

  • memory/2516-6-0x00000000009D0000-0x0000000000A10000-memory.dmp

    Filesize

    256KB