Analysis
- max time kernel
526s - max time network
601s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
06/06/2024, 17:38
Behavioral task
behavioral1
Sample
Shellbag anylizer.exe
Resource
win7-20240508-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral2
Sample
Shellbag anylizer.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
600 seconds
General
- Target Shellbag anylizer.exe
- Size 93KB
- Sample240606-v7ydlahd2s
- SHA256 87c56f65f79b61d29d121d490066f75cb5160ec0ac800279374fe90fe446cccb
- MD5 a9a93cf921439f33e029758172568efc
- SHA1 921060307d2d033f8111b9fbf8637f3a5fc25b79
- SHA512 2c9c3b8a09f8ce286e0188234020c429c172ec6e8add43a8c0c504eac06f392a26ca8d1a25baf4e9544da23ef67e5d3e02ce3e6160bb70c0d5487d83bde25a6e
- SSDEEP 1536:Ll+gg1XvKE3IrXH3BujEwzGi1dDdDsgS:LlqXvKE3IrX3BXi1dxF
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 1812 netsh.exe 1444 netsh.exe 2024 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation Shellbag anylizer.exe - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fec0f18c985870df02c3b8b0664f760aWindows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fec0f18c985870df02c3b8b0664f760aWindows Update.exe server.exe - Executes dropped EXE 1 IoCs
pid Process 2296 server.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
flow ioc 31 0.tcp.in.ngrok.io 57 0.tcp.in.ngrok.io 94 0.tcp.in.ngrok.io 122 0.tcp.in.ngrok.io 181 0.tcp.in.ngrok.io 206 0.tcp.in.ngrok.io 150 0.tcp.in.ngrok.io 194 0.tcp.in.ngrok.io 220 0.tcp.in.ngrok.io 234 0.tcp.in.ngrok.io - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe server.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe 2296 server.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2296 server.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe Token: SeIncBasePriorityPrivilege 2296 server.exe Token: 33 2296 server.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 740 wrote to memory of 2296 740 Shellbag anylizer.exe 85 PID 740 wrote to memory of 2296 740 Shellbag anylizer.exe 85 PID 740 wrote to memory of 2296 740 Shellbag anylizer.exe 85 PID 2296 wrote to memory of 1812 2296 server.exe 87 PID 2296 wrote to memory of 1812 2296 server.exe 87 PID 2296 wrote to memory of 1812 2296 server.exe 87 PID 2296 wrote to memory of 1444 2296 server.exe 96 PID 2296 wrote to memory of 1444 2296 server.exe 96 PID 2296 wrote to memory of 1444 2296 server.exe 96 PID 2296 wrote to memory of 2024 2296 server.exe 97 PID 2296 wrote to memory of 2024 2296 server.exe 97 PID 2296 wrote to memory of 2024 2296 server.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shellbag anylizer.exe"C:\Users\Admin\AppData\Local\Temp\Shellbag anylizer.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1812
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"3⤵
- Modifies Windows Firewall
PID:1444
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2024
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\app
- Size 4B
- SHA256 d3d1d98df443947ab0b52378acbb5f5c21593677b45f0403b3831c93d8be7fca
- MD5 3eb8a6afa534fadc147aa70dea76e863
- SHA1 03b827d99098f69c9f126679598f7166c99d1624
- SHA512 b9d20e1f18dd2dc9a71e436e5c27854196f1f8f0adfbf59aed9d70ab83b88c2c39958720508e87d98f8cb23dcb7bbaa81825406439edcc07b6d2ee310acd4327
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\server.exe
- Size 93KB
- SHA256 87c56f65f79b61d29d121d490066f75cb5160ec0ac800279374fe90fe446cccb
- MD5 a9a93cf921439f33e029758172568efc
- SHA1 921060307d2d033f8111b9fbf8637f3a5fc25b79
- SHA512 2c9c3b8a09f8ce286e0188234020c429c172ec6e8add43a8c0c504eac06f392a26ca8d1a25baf4e9544da23ef67e5d3e02ce3e6160bb70c0d5487d83bde25a6e
- SSDEEP 1536:Ll+gg1XvKE3IrXH3BujEwzGi1dDdDsgS:LlqXvKE3IrX3BXi1dxF
- MD5 SHA1 SHA512 SSDEEP