Analysis
-
max time kernel
120s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 00:53
Behavioral task
behavioral1
Sample
2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe
-
Size
93KB
-
MD5
bc86b969a1c887c1d0bec9807bd59c20
-
SHA1
6145f1a5aa846d5592038b5018bff50f249ba6c7
-
SHA256
2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116
-
SHA512
0d8ba7e09704512dca244d03e7f3658d2562cdc8065996d0f31da772adbf65fe449a3a015f71fee73db79aa9cc786ed8c3a7fdc76d78f365af7352124c4fc443
-
SSDEEP
1536:+mzJD/HBZbszKu9AZpt7r1jEwzGi1dDLD6gS:+mSzK4AZHHCi1dT/
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1252 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation 2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6a5ef65cabb4f7e7f2ef0d8156f8282bWindows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6a5ef65cabb4f7e7f2ef0d8156f8282bWindows Update.exe server.exe -
Executes dropped EXE 1 IoCs
pid Process 4612 server.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Explower.exe server.exe File created C:\Program Files (x86)\Explower.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe 4612 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4612 server.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe Token: 33 4612 server.exe Token: SeIncBasePriorityPrivilege 4612 server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4600 wrote to memory of 4612 4600 2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe 83 PID 4600 wrote to memory of 4612 4600 2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe 83 PID 4600 wrote to memory of 4612 4600 2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe 83 PID 4612 wrote to memory of 1252 4612 server.exe 86 PID 4612 wrote to memory of 1252 4612 server.exe 86 PID 4612 wrote to memory of 1252 4612 server.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe"C:\Users\Admin\AppData\Local\Temp\2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1252
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5bc86b969a1c887c1d0bec9807bd59c20
SHA16145f1a5aa846d5592038b5018bff50f249ba6c7
SHA2562303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116
SHA5120d8ba7e09704512dca244d03e7f3658d2562cdc8065996d0f31da772adbf65fe449a3a015f71fee73db79aa9cc786ed8c3a7fdc76d78f365af7352124c4fc443
-
Filesize
5B
MD553ce6d1ae8885b5d12e654469f456c83
SHA19d8b30c523ddef4d24134072b27716bec7d94d6f
SHA256d7ebf92ad6e3bc44fbc3cfbb234ef4afafd7ea339f712229641a2849b6f87ce2
SHA512c15df9281e9ccbb8d30e24e751b77a030e734f8cda4bd9482d3ca02f6b23e463a8e90ddd78a582ca059e57b8d0492c22583d792bc7368094ffc06e12cd145d9d