f646652723994218114d688def2e56f990a8efb100871b691b41ae4c41582176

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/instsvc.bat
Size 2KB
Sample240605-2e4s8sag81
SHA256 b1f3b4370fa8e86d8d86a7ee5dbaccaff73f6fc2f04b5ff43205751d1c152918
MD5 21e90735471f64b9b71b37c7d8492574
SHA1 05a2effac79c01bcb1f3798b11b542c63588d51c
SHA512 f746d1fb930a77b36a3ffe8823abfcb8e7d81dbcd49e719e33ec82535a7464e4a0cb8df6b6ec5309e2bc7dab3dd21b02041bf88b668dad03c3578be1d2c7e053
MD5 SHA1 SHA512

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 18 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2264	netsh.exe
2268	netsh.exe
2780	netsh.exe
2940	netsh.exe
2724	netsh.exe
2944	netsh.exe
2280	netsh.exe
2836	netsh.exe
2640	netsh.exe
2664	netsh.exe
1608	netsh.exe
2580	netsh.exe
2676	netsh.exe
2592	netsh.exe
2696	netsh.exe
2488	netsh.exe
636	netsh.exe
2804	netsh.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/1048-4-0x0000000000400000-0x000000000050A000-memory.dmp	upx
behavioral3/memory/1048-38-0x0000000000400000-0x000000000050A000-memory.dmp	upx
behavioral3/memory/2600-43-0x0000000000400000-0x000000000050A000-memory.dmp	upx
behavioral3/memory/2600-77-0x0000000000400000-0x000000000050A000-memory.dmp	upx

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1048	nxwrapper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2836	1936	cmd.exe	29
PID 1936 wrote to memory of 2836	1936	cmd.exe	29
PID 1936 wrote to memory of 2836	1936	cmd.exe	29
PID 1936 wrote to memory of 2264	1936	cmd.exe	30
PID 1936 wrote to memory of 2264	1936	cmd.exe	30
PID 1936 wrote to memory of 2264	1936	cmd.exe	30
PID 1936 wrote to memory of 2640	1936	cmd.exe	31
PID 1936 wrote to memory of 2640	1936	cmd.exe	31
PID 1936 wrote to memory of 2640	1936	cmd.exe	31
PID 1936 wrote to memory of 2580	1936	cmd.exe	32
PID 1936 wrote to memory of 2580	1936	cmd.exe	32
PID 1936 wrote to memory of 2580	1936	cmd.exe	32
PID 1936 wrote to memory of 2676	1936	cmd.exe	33
PID 1936 wrote to memory of 2676	1936	cmd.exe	33
PID 1936 wrote to memory of 2676	1936	cmd.exe	33
PID 1936 wrote to memory of 2724	1936	cmd.exe	34
PID 1936 wrote to memory of 2724	1936	cmd.exe	34
PID 1936 wrote to memory of 2724	1936	cmd.exe	34
PID 1936 wrote to memory of 2664	1936	cmd.exe	35
PID 1936 wrote to memory of 2664	1936	cmd.exe	35
PID 1936 wrote to memory of 2664	1936	cmd.exe	35
PID 1936 wrote to memory of 2592	1936	cmd.exe	36
PID 1936 wrote to memory of 2592	1936	cmd.exe	36
PID 1936 wrote to memory of 2592	1936	cmd.exe	36
PID 1936 wrote to memory of 2696	1936	cmd.exe	37
PID 1936 wrote to memory of 2696	1936	cmd.exe	37
PID 1936 wrote to memory of 2696	1936	cmd.exe	37
PID 1936 wrote to memory of 2488	1936	cmd.exe	38
PID 1936 wrote to memory of 2488	1936	cmd.exe	38
PID 1936 wrote to memory of 2488	1936	cmd.exe	38
PID 1936 wrote to memory of 2944	1936	cmd.exe	39
PID 1936 wrote to memory of 2944	1936	cmd.exe	39
PID 1936 wrote to memory of 2944	1936	cmd.exe	39
PID 1936 wrote to memory of 2280	1936	cmd.exe	40
PID 1936 wrote to memory of 2280	1936	cmd.exe	40
PID 1936 wrote to memory of 2280	1936	cmd.exe	40
PID 1936 wrote to memory of 1608	1936	cmd.exe	41
PID 1936 wrote to memory of 1608	1936	cmd.exe	41
PID 1936 wrote to memory of 1608	1936	cmd.exe	41
PID 1936 wrote to memory of 636	1936	cmd.exe	42
PID 1936 wrote to memory of 636	1936	cmd.exe	42
PID 1936 wrote to memory of 636	1936	cmd.exe	42
PID 1936 wrote to memory of 2268	1936	cmd.exe	43
PID 1936 wrote to memory of 2268	1936	cmd.exe	43
PID 1936 wrote to memory of 2268	1936	cmd.exe	43
PID 1936 wrote to memory of 2780	1936	cmd.exe	44
PID 1936 wrote to memory of 2780	1936	cmd.exe	44
PID 1936 wrote to memory of 2780	1936	cmd.exe	44
PID 1936 wrote to memory of 2804	1936	cmd.exe	45
PID 1936 wrote to memory of 2804	1936	cmd.exe	45
PID 1936 wrote to memory of 2804	1936	cmd.exe	45
PID 1936 wrote to memory of 2940	1936	cmd.exe	46
PID 1936 wrote to memory of 2940	1936	cmd.exe	46
PID 1936 wrote to memory of 2940	1936	cmd.exe	46
PID 1936 wrote to memory of 1048	1936	cmd.exe	47
PID 1936 wrote to memory of 1048	1936	cmd.exe	47
PID 1936 wrote to memory of 1048	1936	cmd.exe	47
PID 1936 wrote to memory of 1048	1936	cmd.exe	47
PID 1936 wrote to memory of 2700	1936	cmd.exe	48
PID 1936 wrote to memory of 2700	1936	cmd.exe	48
PID 1936 wrote to memory of 2700	1936	cmd.exe	48
PID 2700 wrote to memory of 2744	2700	net.exe	49
PID 2700 wrote to memory of 2744	2700	net.exe	49
PID 2700 wrote to memory of 2744	2700	net.exe	49

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bin\instsvc.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_53_in
  2⤵
  - Modifies Windows Firewall
  PID:2836
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_80_in
  2⤵
  - Modifies Windows Firewall
  PID:2264
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_443_in
  2⤵
  - Modifies Windows Firewall
  PID:2640
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_19002_in
  2⤵
  - Modifies Windows Firewall
  PID:2580
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_19003_in
  2⤵
  - Modifies Windows Firewall
  PID:2676
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_19004_in
  2⤵
  - Modifies Windows Firewall
  PID:2724
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_19003_out
  2⤵
  - Modifies Windows Firewall
  PID:2664
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_19004_out
  2⤵
  - Modifies Windows Firewall
  PID:2592
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_1813_in
  2⤵
  - Modifies Windows Firewall
  PID:2696
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_53_in protocol=UDP dir=in localport=53 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:2488
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_80_in protocol=TCP dir=in localport=80 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:2944
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_443_in protocol=TCP dir=in localport=443 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:2280
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_19002_in protocol=TCP dir=in localport=19002 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:1608
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_19003_in protocol=TCP dir=in localport=19003 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:636
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_19004_in protocol=TCP dir=in localport=19004 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:2268
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_19003_out protocol=TCP dir=out remoteport=19003 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:2780
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_19004_out protocol=TCP dir=out remoteport=19004 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:2804
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_1813_in protocol=UDP dir=in localport=1813 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:2940
- C:\Users\Admin\AppData\Local\Temp\nxwrapper.exe
  nxwrapper.exe --startup=auto install
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1048
- C:\Windows\system32\net.exe
  net start NxFilter
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start NxFilter
    3⤵
    PID:2744

C:\Users\Admin\AppData\Local\Temp\nxwrapper.exe
"C:\Users\Admin\AppData\Local\Temp\nxwrapper.exe"
1⤵
PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %PATH%
  2⤵
  PID:3052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:/Users/Admin/AppData/Local/Temp/bin/startup.bat"
  2⤵
  PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-4-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1048-0-0x000000001E000000-0x000000001E0F1000-memory.dmp

Download

memory/1048-5-0x000000001E1B0000-0x000000001E1BF000-memory.dmp

Download

memory/1048-8-0x000000001E7A0000-0x000000001E7BE000-memory.dmp

Download

memory/1048-16-0x000000001ECB0000-0x000000001ECBD000-memory.dmp

Download

memory/1048-20-0x000000001E8C0000-0x000000001E8DA000-memory.dmp

Download

memory/1048-12-0x000000001E7D0000-0x000000001E7D9000-memory.dmp

Download

memory/1048-24-0x000000001E9B0000-0x000000001E9B7000-memory.dmp

Download

memory/1048-28-0x000000001E1E0000-0x000000001E1EE000-memory.dmp

Download

memory/1048-31-0x0000000010000000-0x0000000010016000-memory.dmp

Download

memory/1048-34-0x000000001E1D0000-0x000000001E1DC000-memory.dmp

Download

memory/1048-38-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2600-43-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2600-60-0x000000001E8C0000-0x000000001E8DA000-memory.dmp

Download

memory/2600-77-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads