1838d564a975fa0c341a4849b8ee1770be6ed48e8d1a0c2a0d8a4e67cc8f567f

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cool.exe
Size

27KB
MD5

1ee7cc05d97af21a41db79474906ba91
SHA1

9a6434526b3d4766d044da5753de220be164eca1
SHA256

1838d564a975fa0c341a4849b8ee1770be6ed48e8d1a0c2a0d8a4e67cc8f567f
SHA512

cff758f21406bcbdd1b6a7a749462a751a511e373ef61b978bb5d1ebcd46612f3e53c33de014d473ee623b5445ba03a695252ce354f3fd02f93a9ac996387fea
SSDEEP

384:dNqGSj1dStBzyUt5Ldxhw+LGlMz/T/oO7Waqf+BvvE9q+cNB0zS0i5RT44:WGSjeIs++L2MIO78+Bk94zM4

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2024	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3400	cool.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe
Token: SeIncBasePriorityPrivilege	3400	cool.exe
Token: 33	3400	cool.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 3248	3400	cool.exe	86
PID 3400 wrote to memory of 3248	3400	cool.exe	86
PID 3400 wrote to memory of 3248	3400	cool.exe	86
PID 3248 wrote to memory of 2024	3248	cmd.exe	88
PID 3248 wrote to memory of 2024	3248	cmd.exe	88
PID 3248 wrote to memory of 2024	3248	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\cool.exe
"C:\Users\Admin\AppData\Local\Temp\cool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MyFolder\\.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\cool.exe" "cool.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MyFolder\.bat

Filesize
159B

MD5
4ba9602a5b672444376badef7b11b4ed

SHA1
67c1af161bb7dc35d2ba03ac2f82102065e86e92

SHA256
35c4a10ad67b3a19ada80c11d00e8b6adb765ab764b8c9ccce99b86d041bfaac

SHA512
2cba746114d15b1c7da714fedcbb80c83c1697ed68baa42524be4d3db65cddeabdd68efc7fd1facaf225004446ad1814e9e012c064d2e23f311b5fc327c3122e

Download Submit
memory/3400-0-0x0000000074EC2000-0x0000000074EC3000-memory.dmp

Filesize
4KB

Download
memory/3400-1-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/3400-2-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/3400-6-0x0000000074EC2000-0x0000000074EC3000-memory.dmp

Filesize
4KB

Download
memory/3400-7-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/3400-8-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads