Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/09/2024, 10:20
Behavioral task
behavioral1
Sample
1f41f02970cfdce69e628299a96d754d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f41f02970cfdce69e628299a96d754d.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
1f41f02970cfdce69e628299a96d754d.exe
-
Size
93KB
-
MD5
1f41f02970cfdce69e628299a96d754d
-
SHA1
fb04fa7cbe25caccd197dac9af74496e3b513866
-
SHA256
6d48ccbf40f5f43149cb69f1659d683fc7eaf5cee527f724a1761e548c1a5fe2
-
SHA512
aeec12de9fdffa33fa7123809c2e67b1a6fa786d7c8db210d622b76ddeb40ae631a1cc370644836618670e976dde42367818ce53097b1760493e63c73fa6ba29
-
SSDEEP
1536:QxNJD/HBZbszKu9AZp77r1jEwzGi1dDrD7gS:QxUzK4AZtHCi1dr0
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2316 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f41f02970cfdce69e628299a96d754d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe 548 1f41f02970cfdce69e628299a96d754d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 548 1f41f02970cfdce69e628299a96d754d.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe Token: 33 548 1f41f02970cfdce69e628299a96d754d.exe Token: SeIncBasePriorityPrivilege 548 1f41f02970cfdce69e628299a96d754d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 548 wrote to memory of 2316 548 1f41f02970cfdce69e628299a96d754d.exe 31 PID 548 wrote to memory of 2316 548 1f41f02970cfdce69e628299a96d754d.exe 31 PID 548 wrote to memory of 2316 548 1f41f02970cfdce69e628299a96d754d.exe 31 PID 548 wrote to memory of 2316 548 1f41f02970cfdce69e628299a96d754d.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f41f02970cfdce69e628299a96d754d.exe"C:\Users\Admin\AppData\Local\Temp\1f41f02970cfdce69e628299a96d754d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1f41f02970cfdce69e628299a96d754d.exe" "1f41f02970cfdce69e628299a96d754d.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2316
-