e126486113c5ed19d1ba547793b8613257418215bcd0bc582f813068c8022d7a

Analysis

max time kernel
150s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e126486113c5ed19d1ba547793b8613257418215bcd0bc582f813068c8022d7a.exe
Size 92KB
Sample240504-ephx7acg4v
SHA256 e126486113c5ed19d1ba547793b8613257418215bcd0bc582f813068c8022d7a
MD5 9fa7a74a142d40e791b9d41ceca76f65
SHA1 937c31aa93bca3f08966bced801724aa6272f3d7
SHA512 9c0d2df0f8dd94b96364dee5d35cd40062d78a25d2aaf9d36224a24209d55a3792dafb1353cb58fbbf7c88840ff53da4ca0ff21878a49d77cd521eec91091490
SSDEEP 1536:ZvID0OefVX9KX4Izzd/HKGW1ZTRgFn1YqrSI:ZvID0OefVNtI5TW1Z1qnO4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3548	netsh.exe
4848	netsh.exe
3872	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	e126486113c5ed19d1ba547793b8613257418215bcd0bc582f813068c8022d7a.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\290d132e93c29ace54ba5345b76003faWindows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\290d132e93c29ace54ba5345b76003faWindows Update.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Systemroot%.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Systemroot%.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe

Executes dropped EXE 1 IoCs

pid	Process
1372	server.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\%Systemroot%.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\%Systemroot%.exe	server.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\%Systemroot%.exe	server.exe
File opened for modification	C:\Program Files (x86)\%Systemroot%.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe
1372	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1372	server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe
Token: 33	1372	server.exe
Token: SeIncBasePriorityPrivilege	1372	server.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 1372	4436	e126486113c5ed19d1ba547793b8613257418215bcd0bc582f813068c8022d7a.exe	88
PID 4436 wrote to memory of 1372	4436	e126486113c5ed19d1ba547793b8613257418215bcd0bc582f813068c8022d7a.exe	88
PID 4436 wrote to memory of 1372	4436	e126486113c5ed19d1ba547793b8613257418215bcd0bc582f813068c8022d7a.exe	88
PID 1372 wrote to memory of 3548	1372	server.exe	92
PID 1372 wrote to memory of 3548	1372	server.exe	92
PID 1372 wrote to memory of 3548	1372	server.exe	92
PID 1372 wrote to memory of 4848	1372	server.exe	94
PID 1372 wrote to memory of 4848	1372	server.exe	94
PID 1372 wrote to memory of 4848	1372	server.exe	94
PID 1372 wrote to memory of 3872	1372	server.exe	95
PID 1372 wrote to memory of 3872	1372	server.exe	95
PID 1372 wrote to memory of 3872	1372	server.exe	95

C:\Users\Admin\AppData\Local\Temp\e126486113c5ed19d1ba547793b8613257418215bcd0bc582f813068c8022d7a.exe
"C:\Users\Admin\AppData\Local\Temp\e126486113c5ed19d1ba547793b8613257418215bcd0bc582f813068c8022d7a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Roaming\server.exe
  "C:\Users\Admin\AppData\Roaming\server.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:3548
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"
    3⤵
    - Modifies Windows Firewall
    PID:4848
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app

Path C:\Users\Admin\AppData\Roaming\app
Size 4B
SHA256 afd43463eba279dc102afa66f3ef7173885c540c02776217638de34e03486125
MD5 047dda8d29bbbf2b6e1c3f4212189eba
SHA1 eb10217bbf887b1ad9b984cb7a559b177e2c762a
SHA512 84c38a784fa77686de5be91738fffd0371ca667eff0e117c87e8e2d676ef29b7defe21c7bfa83f00ef967d73d3983fb038bd07b93fde963ec5ae10a2f569a822
MD5 SHA1 SHA512

Submit Download

server.exe

Path C:\Users\Admin\AppData\Roaming\server.exe
Size 92KB
SHA256 e126486113c5ed19d1ba547793b8613257418215bcd0bc582f813068c8022d7a
MD5 9fa7a74a142d40e791b9d41ceca76f65
SHA1 937c31aa93bca3f08966bced801724aa6272f3d7
SHA512 9c0d2df0f8dd94b96364dee5d35cd40062d78a25d2aaf9d36224a24209d55a3792dafb1353cb58fbbf7c88840ff53da4ca0ff21878a49d77cd521eec91091490
SSDEEP 1536:ZvID0OefVX9KX4Izzd/HKGW1ZTRgFn1YqrSI:ZvID0OefVNtI5TW1Z1qnO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1372-14-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/1372-15-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/1372-16-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/1372-41-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/4436-0-0x0000000075042000-0x0000000075043000-memory.dmp

Download

memory/4436-1-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/4436-2-0x0000000075040000-0x00000000755F1000-memory.dmp

Download

memory/4436-13-0x0000000075040000-0x00000000755F1000-memory.dmp

Download