Analysis
- max time kernel
1800s - max time network
1798s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Server_protected.exe
Resource
win7-20240611-en
windows7-x64
15 signatures
1800 seconds
General
- Target Server_protected.exe
- Size 1.1MB
- Sample240613-csfacs1cqd
- SHA256 a5a847504cbc643ad813b58addde599f2897d55a4527d3818690a7d49cc04f80
- MD5 f2ae44ecd391ca8f803a96360398cfa2
- SHA1 dc0c69eb34984f6e2d113a35b055c144357e1157
- SHA512 3ef633184d99191c347fe3f9869c14118df59477bd375e6e581790966a704ff894c8297c5feb18802c255e2842191cdabb26ea4cd08c75fb8fb94e80ee9af7f8
- SSDEEP 24576:jf+CdBMbb1NDRxAqk/GIJ7t0mz9qhRj8PxVHkH+NxIWuLAHIQq:jftBqDKGIJ7t0hCvJUAIQ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 1200 netsh.exe 324 netsh.exe 2152 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation Server_protected.exe - Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EasyAntiCheat.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EasyAntiCheat.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\da11cea5581bd3bb198e530836f83dfeWindows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\da11cea5581bd3bb198e530836f83dfeWindows Update.exe server.exe - Executes dropped EXE 1 IoCs
pid Process 3896 server.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf server.exe File opened for modification C:\autorun.inf server.exe File created F:\autorun.inf server.exe File opened for modification F:\autorun.inf server.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\EasyAntiCheat.exe server.exe File opened for modification C:\Windows\SysWOW64\EasyAntiCheat.exe server.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 4556 Server_protected.exe 4556 Server_protected.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\EasyAntiCheat.exe server.exe File opened for modification C:\Program Files (x86)\EasyAntiCheat.exe server.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\server.exe Server_protected.exe File opened for modification C:\Windows\server.exe server.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe 3896 server.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3896 server.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe Token: SeIncBasePriorityPrivilege 3896 server.exe Token: 33 3896 server.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4556 Server_protected.exe 3896 server.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4556 wrote to memory of 3896 4556 Server_protected.exe 85 PID 4556 wrote to memory of 3896 4556 Server_protected.exe 85 PID 4556 wrote to memory of 3896 4556 Server_protected.exe 85 PID 3896 wrote to memory of 1200 3896 server.exe 86 PID 3896 wrote to memory of 1200 3896 server.exe 86 PID 3896 wrote to memory of 1200 3896 server.exe 86 PID 3896 wrote to memory of 2152 3896 server.exe 88 PID 3896 wrote to memory of 2152 3896 server.exe 88 PID 3896 wrote to memory of 2152 3896 server.exe 88 PID 3896 wrote to memory of 324 3896 server.exe 89 PID 3896 wrote to memory of 324 3896 server.exe 89 PID 3896 wrote to memory of 324 3896 server.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server_protected.exe"C:\Users\Admin\AppData\Local\Temp\Server_protected.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\server.exe"C:\Windows\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1200
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Windows\server.exe"3⤵
- Modifies Windows Firewall
PID:2152
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:324
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\app
- Size 5B
- SHA256 a7aa76f137ba550c381cfb8e5195a01963ae49db167e1cd1e0a8b902ed81eda1
- MD5 bbcd2be775370c1e106e66d077a93f3b
- SHA1 a44b6a98f30e3275fc304bc3b29e0eab8ae47f20
- SHA512 bb6e0d1f24253a9525fd538debf8ca68eb7078cb8539140c184331a854ecdea192fbcc314c4154a0a474c9aec41a79efeb8150922454c3c9e71eeb5297ae2f72
- MD5 SHA1 SHA512
- Path C:\Windows\server.exe
- Size 1.1MB
- SHA256 a5a847504cbc643ad813b58addde599f2897d55a4527d3818690a7d49cc04f80
- MD5 f2ae44ecd391ca8f803a96360398cfa2
- SHA1 dc0c69eb34984f6e2d113a35b055c144357e1157
- SHA512 3ef633184d99191c347fe3f9869c14118df59477bd375e6e581790966a704ff894c8297c5feb18802c255e2842191cdabb26ea4cd08c75fb8fb94e80ee9af7f8
- SSDEEP 24576:jf+CdBMbb1NDRxAqk/GIJ7t0mz9qhRj8PxVHkH+NxIWuLAHIQq:jftBqDKGIJ7t0hCvJUAIQ
- MD5 SHA1 SHA512 SSDEEP