Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2024 06:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
Server.exe
-
Size
351KB
-
MD5
f8a5dcac2eabec079cfee8ac1e2ef67e
-
SHA1
e31ea67bf7bf105659c09a39078a6ba5e4563272
-
SHA256
fdf5122030edff5285eae21fe310343e992ec380cb7d28b02bc6bad85bf47510
-
SHA512
19e9e7db895bf705e98450a2a5e1ee193eebf084c53b9668344c9215902b67a89e0573e4b82598eaab43c32ed2cd9676ca5afce98aeb9ec647674adc9fde58f6
-
SSDEEP
6144:fxMBXiDRG9W6ecU7ktNr8JjGBTbuEfNyz8NZKePzPl:OBu+ecvDCS94+vR
Score
9/10
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Server.exe -
Deletes itself 1 IoCs
pid Process 3156 Server.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.exe Server.exe -
Executes dropped EXE 1 IoCs
pid Process 3156 Server.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dropbox = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Updates\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dropbox = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Updates\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe" Server.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf Server.exe File created C:\autorun.inf Server.exe File opened for modification C:\autorun.inf Server.exe File created F:\autorun.inf Server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 Server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Server.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe 4688 Server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3156 Server.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4688 Server.exe Token: SeDebugPrivilege 3156 Server.exe Token: SeDebugPrivilege 812 taskmgr.exe Token: SeSystemProfilePrivilege 812 taskmgr.exe Token: SeCreateGlobalPrivilege 812 taskmgr.exe Token: 33 812 taskmgr.exe Token: SeIncBasePriorityPrivilege 812 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4688 Server.exe 3156 Server.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe -
Suspicious use of SendNotifyMessage 62 IoCs
pid Process 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe 812 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4688 Server.exe 3156 Server.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4688 wrote to memory of 3156 4688 Server.exe 86 PID 4688 wrote to memory of 3156 4688 Server.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Roaming\Adobe\Updates\Server.exe"C:\Users\Admin\AppData\Roaming\Adobe\Updates\Server.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3156
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:812
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44B
MD55389b11510f65424863e2e9724bd65e4
SHA1071102005e3217b50283b71ee33858bb15606549
SHA256fecb0cdb9664c0c83a84dff897fecff3773df1d4d5a6fc5c84e2187027315fa7
SHA512ba78a6c2619bd7a4d4428a5b0b739e109dfa9ddb8925a005067f8b7091744bd9e16e007d32f62ae42768f3f45fb8aefe496f5a3ef617862127b53a88f86514ff
-
Filesize
351KB
MD5f8a5dcac2eabec079cfee8ac1e2ef67e
SHA1e31ea67bf7bf105659c09a39078a6ba5e4563272
SHA256fdf5122030edff5285eae21fe310343e992ec380cb7d28b02bc6bad85bf47510
SHA51219e9e7db895bf705e98450a2a5e1ee193eebf084c53b9668344c9215902b67a89e0573e4b82598eaab43c32ed2cd9676ca5afce98aeb9ec647674adc9fde58f6