f70f25aa2bdb13440fe1f8a2ba8fdd4709a4ebe47cc03bf15e5822b0fbe73afb

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ตัวไหล.bat
Size

401B
MD5

a52d6fa560c6a65a8bf5b3c1602fa532
SHA1

e515aab8fecc60e1c8217098bc94d03597e2dc59
SHA256

f70f25aa2bdb13440fe1f8a2ba8fdd4709a4ebe47cc03bf15e5822b0fbe73afb
SHA512

f9f8f6e88238c128d4f2a620287a8c55cf34325c7dd2a9cc659d2619d687e716cb02e216fd60ae69f94d4942374b975d65eee62ab561da2aa164fef33f33d5fe

Score

3^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2780	net.exe
2768	net1.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
1436	timeout.exe
2728	timeout.exe
2764	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2788	ipconfig.exe

Runs net.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2728	2556	cmd.exe	30
PID 2556 wrote to memory of 2728	2556	cmd.exe	30
PID 2556 wrote to memory of 2728	2556	cmd.exe	30
PID 2556 wrote to memory of 2764	2556	cmd.exe	31
PID 2556 wrote to memory of 2764	2556	cmd.exe	31
PID 2556 wrote to memory of 2764	2556	cmd.exe	31
PID 2556 wrote to memory of 1436	2556	cmd.exe	32
PID 2556 wrote to memory of 1436	2556	cmd.exe	32
PID 2556 wrote to memory of 1436	2556	cmd.exe	32
PID 2556 wrote to memory of 2876	2556	cmd.exe	33
PID 2556 wrote to memory of 2876	2556	cmd.exe	33
PID 2556 wrote to memory of 2876	2556	cmd.exe	33
PID 2556 wrote to memory of 2788	2556	cmd.exe	34
PID 2556 wrote to memory of 2788	2556	cmd.exe	34
PID 2556 wrote to memory of 2788	2556	cmd.exe	34
PID 2556 wrote to memory of 2780	2556	cmd.exe	35
PID 2556 wrote to memory of 2780	2556	cmd.exe	35
PID 2556 wrote to memory of 2780	2556	cmd.exe	35
PID 2780 wrote to memory of 2768	2780	net.exe	36
PID 2780 wrote to memory of 2768	2780	net.exe	36
PID 2780 wrote to memory of 2768	2780	net.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ตัวไหล.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2728
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:2764
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1436
- C:\Windows\system32\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2876
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:2788
- C:\Windows\system32\net.exe
  net stop w32time
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop w32time
    3⤵
    - System Time Discovery
    PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads