Analysis
- max time kernel
67s - max time network
65s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
21/06/2024, 05:59
Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target Server.exe
- Size 93KB
- Sample240621-gp8vqazbpb
- SHA256 b7c6a5302d5f4a65a78882bf56eb82e8892269ccde66fd43b766fe66a0ba563a
- MD5 a8aeec49a688d8f46c57327a3b295be1
- SHA1 967aa4a414a18e475f6ac2186f919713fbac1173
- SHA512 a38031f94997d9b7c88bbb91005721c39893188b864b003fe6280fd844b90792d8b3683baa4d76f21c076861d82e2fc6fa2d04f2de48311cf287c2d8300a60aa
- SSDEEP 1536:ll3BNvGfr2p4dTa/hDjEwzGi1dDsDGgS:llufr2p4dW/Gi1dar
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 2208 netsh.exe 2028 netsh.exe 2024 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Server.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0bc07c8603a03109f7c69532f4ad60a3Windows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0bc07c8603a03109f7c69532f4ad60a3Windows Update.exe server.exe - Executes dropped EXE 1 IoCs
pid Process 1348 server.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe 1348 server.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1348 server.exe - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1348 server.exe Token: 33 1348 server.exe Token: SeIncBasePriorityPrivilege 1348 server.exe Token: 33 1348 server.exe Token: SeIncBasePriorityPrivilege 1348 server.exe Token: 33 1348 server.exe Token: SeIncBasePriorityPrivilege 1348 server.exe Token: 33 1348 server.exe Token: SeIncBasePriorityPrivilege 1348 server.exe Token: 33 1348 server.exe Token: SeIncBasePriorityPrivilege 1348 server.exe Token: 33 1348 server.exe Token: SeIncBasePriorityPrivilege 1348 server.exe Token: 33 1348 server.exe Token: SeIncBasePriorityPrivilege 1348 server.exe Token: 33 1348 server.exe Token: SeIncBasePriorityPrivilege 1348 server.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4724 wrote to memory of 1348 4724 Server.exe 84 PID 4724 wrote to memory of 1348 4724 Server.exe 84 PID 4724 wrote to memory of 1348 4724 Server.exe 84 PID 1348 wrote to memory of 2208 1348 server.exe 86 PID 1348 wrote to memory of 2208 1348 server.exe 86 PID 1348 wrote to memory of 2208 1348 server.exe 86 PID 1348 wrote to memory of 2028 1348 server.exe 88 PID 1348 wrote to memory of 2028 1348 server.exe 88 PID 1348 wrote to memory of 2028 1348 server.exe 88 PID 1348 wrote to memory of 2024 1348 server.exe 89 PID 1348 wrote to memory of 2024 1348 server.exe 89 PID 1348 wrote to memory of 2024 1348 server.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\ProgramData\server.exe"C:\ProgramData\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2208
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\ProgramData\server.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2028
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2024
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\server.exe
- Size 93KB
- SHA256 b7c6a5302d5f4a65a78882bf56eb82e8892269ccde66fd43b766fe66a0ba563a
- MD5 a8aeec49a688d8f46c57327a3b295be1
- SHA1 967aa4a414a18e475f6ac2186f919713fbac1173
- SHA512 a38031f94997d9b7c88bbb91005721c39893188b864b003fe6280fd844b90792d8b3683baa4d76f21c076861d82e2fc6fa2d04f2de48311cf287c2d8300a60aa
- SSDEEP 1536:ll3BNvGfr2p4dTa/hDjEwzGi1dDsDGgS:llufr2p4dW/Gi1dar
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log
- Size 408B
- SHA256 8f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2
- MD5 661cab77d3b907e8057f2e689e995af3
- SHA1 5d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c
- SHA512 2523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\app
- Size 5B
- SHA256 d7a0af52f260c87ef40bdfc1f1196faf7797593d62c6120ae99957d78762ed1a
- MD5 f478c76bbb3174dbc7fabae62224f818
- SHA1 bed239508bad9fcd15a9bdea1e132f62468d07d1
- SHA512 b653aa05746c721c9129456de3798d9e94385a0e5630c5d497fa0d6076274560885edd5875232b40d07aafa3f0e929e9b3bf2ff388ad2c21b3589cb01b79f94b
- MD5 SHA1 SHA512