Analysis
-
max time kernel
463s -
max time network
464s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-05-2024 11:52
Static task
static1
Behavioral task
behavioral1
Sample
ShadowNet.cmd
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
ShadowNet.cmd
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
ShadowRatControll.cmd
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
ShadowRatControll.cmd
Resource
win11-20240426-en
General
-
Target
ShadowNet.cmd
-
Size
1KB
-
MD5
eff4712f45313d0756a8f37028e9b155
-
SHA1
ef57f064430d43a2600df395e50c025ec760fcbe
-
SHA256
310b1f085793d2f4c0bbfd20f841ba3ead35e2d7d6f454849efb9c80d5c65834
-
SHA512
2bbd3e1d7f11ee62e7378f1b00d2eae448143d3e894be6a7133e0126e61160b73fc83a5ad8b981212b94d4dcaeeb2d1f4ace0d795d5e0d762e531a7d36f956f7
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 7 IoCs
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exepid process 1476 netsh.exe 4708 netsh.exe 2720 netsh.exe 1084 netsh.exe 3088 netsh.exe 4696 netsh.exe 4912 netsh.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 4092 powershell.exe 4092 powershell.exe 4092 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4092 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
cmd.exedescription pid process target process PID 1028 wrote to memory of 4092 1028 cmd.exe powershell.exe PID 1028 wrote to memory of 4092 1028 cmd.exe powershell.exe PID 1028 wrote to memory of 1084 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 1084 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 3088 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 3088 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 4696 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 4696 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 4912 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 4912 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 1476 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 1476 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 4708 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 4708 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 2720 1028 cmd.exe netsh.exe PID 1028 wrote to memory of 2720 1028 cmd.exe netsh.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ShadowNet.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ExecutionPolicy RemoteSigned -Scope CurrentUser"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092 -
C:\Windows\system32\netsh.exenetsh firewall set opmode disable2⤵
- Modifies Windows Firewall
PID:1084 -
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=DISABLE2⤵
- Modifies Windows Firewall
PID:3088 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off2⤵
- Modifies Windows Firewall
PID:4696 -
C:\Windows\system32\netsh.exenetsh advfirewall set domainprofile state off2⤵
- Modifies Windows Firewall
PID:4912 -
C:\Windows\system32\netsh.exenetsh advfirewall set privateprofile state off2⤵
- Modifies Windows Firewall
PID:1476 -
C:\Windows\system32\netsh.exenetsh advfirewall set publicprofile state off2⤵
- Modifies Windows Firewall
PID:4708 -
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vchkhoge.l1k.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/4092-0-0x00007FFFE77F3000-0x00007FFFE77F5000-memory.dmpFilesize
8KB
-
memory/4092-9-0x0000020656F10000-0x0000020656F32000-memory.dmpFilesize
136KB
-
memory/4092-10-0x00007FFFE77F0000-0x00007FFFE82B2000-memory.dmpFilesize
10.8MB
-
memory/4092-11-0x00007FFFE77F0000-0x00007FFFE82B2000-memory.dmpFilesize
10.8MB
-
memory/4092-12-0x00007FFFE77F0000-0x00007FFFE82B2000-memory.dmpFilesize
10.8MB
-
memory/4092-15-0x00007FFFE77F0000-0x00007FFFE82B2000-memory.dmpFilesize
10.8MB