25b48c2f91a8ad55b946a746fd5d99d231fc684e25674908bfd7d11cd77d00d7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SniffX/手动安装npf驱动.bat
Size

252B
MD5

67ee57c82088d2bd6203b628039bb855
SHA1

dd08c780d93cd892999eeb53801f192e228d64f1
SHA256

fcef30261f0ffdf3330e4dddd49399892c67eca5fafbd19b1ad6e8d160d4eee6
SHA512

051eb00a293d7fc55c9c90440e72765458fc2a945956b4b326ccaffe6afd3aa5f1ecf14b00337801ca50643195a06808fbe1bbbaedc393a2cc83535f74e7b93b

Score

8^/10

execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\npf.sys	cmd.exe
File opened for modification	C:\Windows\system32\drivers\npf.sys	cmd.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\packet.dll	cmd.exe
File opened for modification	C:\Windows\system32\packet.dll	cmd.exe
File created	C:\Windows\system32\wpcap.dll	cmd.exe
File opened for modification	C:\Windows\system32\wpcap.dll	cmd.exe
File created	C:\Windows\system32\wanpacket.dll	cmd.exe
File opened for modification	C:\Windows\system32\wanpacket.dll	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2532	sc.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2532	sc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2532	1912	cmd.exe	31
PID 1912 wrote to memory of 2532	1912	cmd.exe	31
PID 1912 wrote to memory of 2532	1912	cmd.exe	31
PID 1912 wrote to memory of 2532	1912	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SniffX\手动安装npf驱动.bat"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\SniffX\sc.exe
  sc create npf binpath= system32\drivers\npf.sys type= kernel start= demand
  2⤵
  - Launches sc.exe
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads