Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 20:00
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
test.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
test.exe
-
Size
93KB
-
MD5
f54e0d56b07dc0717370c6fd9a2876a8
-
SHA1
f1ca27d34d9eda21b94b7a716f8b396e5c3babec
-
SHA256
42708afda854ba9b4cfd7e74a4545ac54e7ef780b1f1eb52e183a8a343d3bc31
-
SHA512
3cf3f7d661a4cc973ab5b052e1184408e687ad11000b735f2e575bf7b7f6bea0f46d8332befa99071b21d0da7dce4f54c76a0849747a327268f02a503cf646b9
-
SSDEEP
1536:YxPdrvzeKQVfi5Q3K1QjEwzGi1dDvDEgS:YxlzeKQV53K1Bi1dP9
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2604 netsh.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2f6b1aa2fadca937ee48ee219c054948Windows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2f6b1aa2fadca937ee48ee219c054948Windows Update.exe server.exe -
Executes dropped EXE 1 IoCs
pid Process 2144 server.exe -
Loads dropped DLL 2 IoCs
pid Process 1636 test.exe 1636 test.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe server.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Explower.exe server.exe File opened for modification C:\Program Files (x86)\Explower.exe server.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe 2144 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2144 server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe Token: 33 2144 server.exe Token: SeIncBasePriorityPrivilege 2144 server.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2144 server.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2144 1636 test.exe 28 PID 1636 wrote to memory of 2144 1636 test.exe 28 PID 1636 wrote to memory of 2144 1636 test.exe 28 PID 1636 wrote to memory of 2144 1636 test.exe 28 PID 2144 wrote to memory of 2604 2144 server.exe 29 PID 2144 wrote to memory of 2604 2144 server.exe 29 PID 2144 wrote to memory of 2604 2144 server.exe 29 PID 2144 wrote to memory of 2604 2144 server.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2604
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5aa3cce4f6c83d5adfcfc45934b274cc6
SHA120e102f0ad9f95951786af279e5215d2ecf85126
SHA25657a8ff317e913b7e08c0a1758997ed0ffc2f1aba0a3b3310c7697bc207fd15e5
SHA512f9ec7cd14188f6f7cc00d64dfd7781fc425b7dd24d8fa70d9382cd127bbcc657c734812bc50ba0761393b1a89de9dc02f0d90e8377d6387f24e2d36c98d185cf
-
Filesize
93KB
MD5f54e0d56b07dc0717370c6fd9a2876a8
SHA1f1ca27d34d9eda21b94b7a716f8b396e5c3babec
SHA25642708afda854ba9b4cfd7e74a4545ac54e7ef780b1f1eb52e183a8a343d3bc31
SHA5123cf3f7d661a4cc973ab5b052e1184408e687ad11000b735f2e575bf7b7f6bea0f46d8332befa99071b21d0da7dce4f54c76a0849747a327268f02a503cf646b9