Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 00:53
Static task
static1
Behavioral task
behavioral1
Sample
939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe
Resource
win10v2004-20240802-en
General
-
Target
939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe
-
Size
388KB
-
MD5
437061eecf8e0d4a5882238aa581b9e9
-
SHA1
441f22d0835170fcffa8da65e7a035c229b6e315
-
SHA256
939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd
-
SHA512
4e52228ac20d3d685de0bf6bf439d4ef8996bb36d1adc9820de11ecb3200fb5119dd018f7456cf80575d1e4992219343f7d7084c905f73c2ae27efd5f5670b02
-
SSDEEP
12288:R2iNY2iNY2iNY2iNY2iNY2iNY2iNY2iNF+pABsJ:R1a1a1a1a1a1a1a1O
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2788 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc655fad1a463f0cb2e139b58ae90f51.exe AarSvc.dll.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc655fad1a463f0cb2e139b58ae90f51.exe AarSvc.dll.exe -
Executes dropped EXE 1 IoCs
pid Process 2756 AarSvc.dll.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc655fad1a463f0cb2e139b58ae90f51 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AarSvc.dll.exe\" .." AarSvc.dll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc655fad1a463f0cb2e139b58ae90f51 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AarSvc.dll.exe\" .." AarSvc.dll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3056 939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe 3056 939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeDebugPrivilege 3056 939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe Token: SeDebugPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe Token: 33 2756 AarSvc.dll.exe Token: SeIncBasePriorityPrivilege 2756 AarSvc.dll.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2756 3056 939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe 30 PID 3056 wrote to memory of 2756 3056 939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe 30 PID 3056 wrote to memory of 2756 3056 939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe 30 PID 2756 wrote to memory of 2788 2756 AarSvc.dll.exe 31 PID 2756 wrote to memory of 2788 2756 AarSvc.dll.exe 31 PID 2756 wrote to memory of 2788 2756 AarSvc.dll.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe"C:\Users\Admin\AppData\Local\Temp\939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\AarSvc.dll.exe"C:\Users\Admin\AppData\Local\Temp\AarSvc.dll.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\AarSvc.dll.exe" "AarSvc.dll.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2788
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
388KB
MD5437061eecf8e0d4a5882238aa581b9e9
SHA1441f22d0835170fcffa8da65e7a035c229b6e315
SHA256939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd
SHA5124e52228ac20d3d685de0bf6bf439d4ef8996bb36d1adc9820de11ecb3200fb5119dd018f7456cf80575d1e4992219343f7d7084c905f73c2ae27efd5f5670b02