Analysis
- max time kernel
150s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
02/06/2024, 10:39
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win11-20240508-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target Server.exe
- Size 93KB
- Sample240602-mp3xcsbd83
- SHA256 ff1b40bca0a0fd53dbbb347ccabb52021ac2199e64a6989e539202aa40622f76
- MD5 cddfed5bdcddff32a858707889a098c2
- SHA1 19a6536d526eac180482b62bb39fe6bb7b39a085
- SHA512 e9591804ff1830c1388af5f358952e512b41b5e54086f904af8c338bc518902d5046babe2f14b00f1b6e799ed407cc8527f2ac2c571adf810628af98ad67d658
- SSDEEP 768:QY30g3lorpLocxYZJ6aL+2apOXKC/WendwruXxrjEtCdnl2pi1Rz4Rk3PsGdpigM:cgVo966aL9a+7Jd5jEwzGi1dDbDigS
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 8 netsh.exe 1256 netsh.exe 3196 netsh.exe - Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\799cfab9603f75052b3506e464ecce5eWindows Update.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\799cfab9603f75052b3506e464ecce5eWindows Update.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe 3040 Server.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3040 Server.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe Token: 33 3040 Server.exe Token: SeIncBasePriorityPrivilege 3040 Server.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3040 wrote to memory of 8 3040 Server.exe 77 PID 3040 wrote to memory of 8 3040 Server.exe 77 PID 3040 wrote to memory of 8 3040 Server.exe 77 PID 3040 wrote to memory of 3196 3040 Server.exe 79 PID 3040 wrote to memory of 3196 3040 Server.exe 79 PID 3040 wrote to memory of 3196 3040 Server.exe 79 PID 3040 wrote to memory of 1256 3040 Server.exe 80 PID 3040 wrote to memory of 1256 3040 Server.exe 80 PID 3040 wrote to memory of 1256 3040 Server.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:8
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Modifies Windows Firewall
PID:3196
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:1256
-