Analysis
- max time kernel
152s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
24/06/2024, 01:26
Behavioral task
behavioral1
Sample
e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3.exe
Resource
win7-20240611-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3.exe
- Size 93KB
- Sample240624-btymnashnh
- SHA256 e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3
- MD5 4ec3c45f792c1fd2fe21cb347341bea1
- SHA1 d203965f41b808c2e9c625b9182760facc4f4232
- SHA512 4dcfcad31fd3bb477426acc2926109ea6df1edf5512c50ad4fa883723f300e81c3ea58ee4b4312e6a156a121a6bf6de879bfb45454f1708edbedc89d4726efa0
- SSDEEP 1536:gSqC+xhUa9urgOB9RNvM4jEwzGi1dDmDFgS:gSkUa9urgONdGi1doS
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 228 netsh.exe 3944 netsh.exe 4860 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3.exe - Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2c4e926790276e38258669eceec311e9Windows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2c4e926790276e38258669eceec311e9Windows Update.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe - Executes dropped EXE 3 IoCs
pid Process 2128 server.exe 4908 StUpdate.exe 4852 StUpdate.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 19 0.tcp.eu.ngrok.io 52 0.tcp.eu.ngrok.io 69 0.tcp.eu.ngrok.io - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4164 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe 2128 server.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2128 server.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe Token: 33 2128 server.exe Token: SeIncBasePriorityPrivilege 2128 server.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1444 wrote to memory of 2128 1444 e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3.exe 93 PID 1444 wrote to memory of 2128 1444 e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3.exe 93 PID 1444 wrote to memory of 2128 1444 e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3.exe 93 PID 2128 wrote to memory of 228 2128 server.exe 94 PID 2128 wrote to memory of 228 2128 server.exe 94 PID 2128 wrote to memory of 228 2128 server.exe 94 PID 2128 wrote to memory of 3944 2128 server.exe 96 PID 2128 wrote to memory of 3944 2128 server.exe 96 PID 2128 wrote to memory of 3944 2128 server.exe 96 PID 2128 wrote to memory of 4860 2128 server.exe 97 PID 2128 wrote to memory of 4860 2128 server.exe 97 PID 2128 wrote to memory of 4860 2128 server.exe 97 PID 2128 wrote to memory of 4164 2128 server.exe 100 PID 2128 wrote to memory of 4164 2128 server.exe 100 PID 2128 wrote to memory of 4164 2128 server.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3.exe"C:\Users\Admin\AppData\Local\Temp\e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:228
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3944
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4860
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe3⤵
- Scheduled Task/Job: Scheduled Task
PID:4164
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3548 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
PID:4908
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
PID:4852
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\StUpdate.exe.log
- Size 408B
- SHA256 8f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2
- MD5 661cab77d3b907e8057f2e689e995af3
- SHA1 5d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c
- SHA512 2523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\server.exe
- Size 93KB
- SHA256 e4d839e15ada21514ee62145d58ed8224f78ca5a799496279c749a09bc4a4cc3
- MD5 4ec3c45f792c1fd2fe21cb347341bea1
- SHA1 d203965f41b808c2e9c625b9182760facc4f4232
- SHA512 4dcfcad31fd3bb477426acc2926109ea6df1edf5512c50ad4fa883723f300e81c3ea58ee4b4312e6a156a121a6bf6de879bfb45454f1708edbedc89d4726efa0
- SSDEEP 1536:gSqC+xhUa9urgOB9RNvM4jEwzGi1dDmDFgS:gSkUa9urgONdGi1doS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\app
- Size 5B
- SHA256 ba0e21ceb11b1ec62709b0141373ce65de5a156b822c9b6d3c3f9ed9ab224a46
- MD5 8fc22f973bec7f0525710dcf02f05edf
- SHA1 418f88fe2c59f8d9579994aec4034d785e8ac00c
- SHA512 ac280118b4b0ee9643ecc464bfc91682ccccd530efa81dcc3d9471044305d59de661f865560206f089822299cb431dbad9f81a16ad667251375746d406f2b44d
- MD5 SHA1 SHA512