Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 11:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cool.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
cool.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
cool.exe
-
Size
27KB
-
MD5
1ee7cc05d97af21a41db79474906ba91
-
SHA1
9a6434526b3d4766d044da5753de220be164eca1
-
SHA256
1838d564a975fa0c341a4849b8ee1770be6ed48e8d1a0c2a0d8a4e67cc8f567f
-
SHA512
cff758f21406bcbdd1b6a7a749462a751a511e373ef61b978bb5d1ebcd46612f3e53c33de014d473ee623b5445ba03a695252ce354f3fd02f93a9ac996387fea
-
SSDEEP
384:dNqGSj1dStBzyUt5Ldxhw+LGlMz/T/oO7Waqf+BvvE9q+cNB0zS0i5RT44:WGSjeIs++L2MIO78+Bk94zM4
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2388 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1992 cool.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe Token: SeIncBasePriorityPrivilege 1992 cool.exe Token: 33 1992 cool.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2508 1992 cool.exe 30 PID 1992 wrote to memory of 2508 1992 cool.exe 30 PID 1992 wrote to memory of 2508 1992 cool.exe 30 PID 1992 wrote to memory of 2508 1992 cool.exe 30 PID 2508 wrote to memory of 2388 2508 cmd.exe 32 PID 2508 wrote to memory of 2388 2508 cmd.exe 32 PID 2508 wrote to memory of 2388 2508 cmd.exe 32 PID 2508 wrote to memory of 2388 2508 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\cool.exe"C:\Users\Admin\AppData\Local\Temp\cool.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MyFolder\\.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\cool.exe" "cool.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2388
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159B
MD54ba9602a5b672444376badef7b11b4ed
SHA167c1af161bb7dc35d2ba03ac2f82102065e86e92
SHA25635c4a10ad67b3a19ada80c11d00e8b6adb765ab764b8c9ccce99b86d041bfaac
SHA5122cba746114d15b1c7da714fedcbb80c83c1697ed68baa42524be4d3db65cddeabdd68efc7fd1facaf225004446ad1814e9e012c064d2e23f311b5fc327c3122e