2a01e85a22beabf2892d58e15efb8afe2d34eac48e6a97895889ae38474bb0ff

Analysis

max time kernel
100s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Server.exe
Size 93KB
Sample240613-ad5klazeql
SHA256 2a01e85a22beabf2892d58e15efb8afe2d34eac48e6a97895889ae38474bb0ff
MD5 42adf0b9ff0dc65504886644f8599cd0
SHA1 e1ba67621002cdc625ef43f9e528abdbb4e01a44
SHA512 80246caffdd2adf9fd9a7c1e924a0ad08d3036544a2991ed4c96bd162ebc15843827fa29eb86691a06344344dbcb424b8626d1bc768314c423aa0dfa346df959
SSDEEP 1536:JUk1GkeUqZJO5iNSimjEwzGi1dDYDigS:JUPUqZJOQAOi1dmH
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1612	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "206"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2348	Server.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe
Token: SeShutdownPrivilege	4364	shutdown.exe
Token: SeRemoteShutdownPrivilege	4364	shutdown.exe
Token: 33	2348	Server.exe
Token: SeIncBasePriorityPrivilege	2348	Server.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4088	LogonUI.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1612	2348	Server.exe	85
PID 2348 wrote to memory of 1612	2348	Server.exe	85
PID 2348 wrote to memory of 1612	2348	Server.exe	85
PID 2348 wrote to memory of 888	2348	Server.exe	93
PID 2348 wrote to memory of 888	2348	Server.exe	93
PID 2348 wrote to memory of 888	2348	Server.exe	93
PID 2348 wrote to memory of 2576	2348	Server.exe	95
PID 2348 wrote to memory of 2576	2348	Server.exe	95
PID 2348 wrote to memory of 2576	2348	Server.exe	95
PID 2348 wrote to memory of 3784	2348	Server.exe	97
PID 2348 wrote to memory of 3784	2348	Server.exe	97
PID 2348 wrote to memory of 3784	2348	Server.exe	97
PID 2348 wrote to memory of 448	2348	Server.exe	99
PID 2348 wrote to memory of 448	2348	Server.exe	99
PID 2348 wrote to memory of 448	2348	Server.exe	99
PID 2348 wrote to memory of 4256	2348	Server.exe	101
PID 2348 wrote to memory of 4256	2348	Server.exe	101
PID 2348 wrote to memory of 4256	2348	Server.exe	101
PID 888 wrote to memory of 4364	888	cmd.exe	103
PID 888 wrote to memory of 4364	888	cmd.exe	103
PID 888 wrote to memory of 4364	888	cmd.exe	103
PID 3784 wrote to memory of 4772	3784	cmd.exe	105
PID 3784 wrote to memory of 4772	3784	cmd.exe	105
PID 3784 wrote to memory of 4772	3784	cmd.exe	105
PID 448 wrote to memory of 1632	448	cmd.exe	106
PID 448 wrote to memory of 1632	448	cmd.exe	106
PID 1632 wrote to memory of 1772	1632	msedge.exe	108
PID 1632 wrote to memory of 1772	1632	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB939.tmp.BAT" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -s -t 1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB9C7.tmp.BAT" "
  2⤵
  PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB9E7.tmp.BAT" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 USER32.DLL,SwapMouseButton
    3⤵
    PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBA65.tmp.BAT" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbf2f846f8,0x7ffbf2f84708,0x7ffbf2f84718
      4⤵
      PID:1772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBAC4.tmp.BAT" "
  2⤵
  PID:4256

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395a855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

tmpB939.tmp.BAT

Path C:\Users\Admin\AppData\Local\Temp\tmpB939.tmp.BAT
Size 37B
SHA256 6a207f770478d59da0d2aa43a9719ef05b3f85c8c700400746ca3ab0463d08f0
MD5 1cbc3a2f81d4259e3bf61249711fec81
SHA1 7ba62560df466c6dcd794854a25aeb5b088968d8
SHA512 74ba85a391d769686c95001af6e29f9fe2ccaa4d119247fac31e65c8becda7be1ea9fa3eb9f2a06c1d48ac4b580ad8e63c14e06d94e8dd07b26129df7f1f4bc0
MD5 SHA1 SHA512

Submit Download

tmpB9C7.tmp.BAT

Path C:\Users\Admin\AppData\Local\Temp\tmpB9C7.tmp.BAT
Size 183B
SHA256 71385e3fb017bb452466ab1ad8764950c14a7af856d0ee8c147cf8f7f073b2ec
MD5 ab45b6913751e20d60d6c9a44a229a66
SHA1 fbf98231ced1c5667bb8b83114ca2f83b044698f
SHA512 b462bd82a58ff51d3351ae5168028439fe3dbfbaeb2465c8b300419fb5d9115eb2091aa6fe4e11cf30ba9ee37e3ef175211e5053d6fc7a3398deace787180f4e
MD5 SHA1 SHA512

Submit Download

tmpB9E7.tmp.BAT

Path C:\Users\Admin\AppData\Local\Temp\tmpB9E7.tmp.BAT
Size 67B
SHA256 32c699ebb7394ddb2d56f092ef10fde4d9f4bcf808dbe11bad777e7bc73f7aae
MD5 1cc401169ef8cf1e8977f4e92dfe72c7
SHA1 d04c32295d4e563978fa0abb1b32ba52699cb08d
SHA512 076eb06d9fbf8bf1d6a4c5043d803ee7b5cf0307253de6358f8ea70e0bf240f5ae2208fbe9a44778e782e29c54751936f393ade6e292064d2134ed223506866b
MD5 SHA1 SHA512

Submit Download

tmpBA65.tmp.BAT

Path C:\Users\Admin\AppData\Local\Temp\tmpBA65.tmp.BAT
Size 83B
SHA256 37d23694738615464be8a3234bcc59592987432c8863db67e30385b8bb3ef450
MD5 cc795c9c4a83aa1ede067f96f1eb8d15
SHA1 32b8e1c43787353f7d87514e279288aff5f7d4f6
SHA512 ec0b8f6600b2b0443ea6f271fcf16804e380b6f51f3f74997dc5c53ed28ece8ece58a12686b451532ed31941a67fa075305314fba7fa8555a7fb8cf6424c6fc5
MD5 SHA1 SHA512

Submit Download

tmpBAC4.tmp.BAT

Path C:\Users\Admin\AppData\Local\Temp\tmpBAC4.tmp.BAT
Size 76B
SHA256 3be1adc56cfae9722bfa25df2ed2b112349b7aa4d8088cbf694e560dd9e53817
MD5 18dc60bfb068d99a80fd22499ec5f252
SHA1 4939c87a7ff6456971aa4baf517646d3df2a7710
SHA512 890ba3a69f516df93154b7534f2530a5004f9d6ccc01e4f59a434e4c2c49912cc2630d34afcb24a60208173a089b8934ace4acad4cc587d21988a150d9ad32e3
MD5 SHA1 SHA512

Submit Download

memory/2348-4-0x0000000075022000-0x0000000075023000-memory.dmp

Download

memory/2348-7-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/2348-6-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/2348-5-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/2348-0-0x0000000075022000-0x0000000075023000-memory.dmp

Download

memory/2348-2-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/2348-29-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/2348-1-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads