Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 01:04
Behavioral task
behavioral1
Sample
18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4.exe
Resource
win7-20240729-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4.exe
-
Size
93KB
-
MD5
2545b47e98ffb00e68912dbedcb8f5db
-
SHA1
0612d0f4417ebb63e52ad1da47db3209e848332a
-
SHA256
18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4
-
SHA512
d480f7713618938a6239445c4e5ccdbdc1305fa3d45e958d7b4656cee09e792ad5892e18c0c590f2aa9c2e904f00a271fbbb8da5db3d14846a9819ba5cba7788
-
SSDEEP
1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 3284 netsh.exe 4268 netsh.exe 1888 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe server.exe -
Executes dropped EXE 3 IoCs
pid Process 3644 server.exe 4572 StUpdate.exe 2480 StUpdate.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 15 5.tcp.eu.ngrok.io 51 5.tcp.eu.ngrok.io 64 5.tcp.eu.ngrok.io -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explore.exe server.exe File opened for modification C:\Windows\SysWOW64\Explore.exe server.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Explore.exe server.exe File created C:\Program Files (x86)\Explore.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1656 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe 3644 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3644 server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe Token: 33 3644 server.exe Token: SeIncBasePriorityPrivilege 3644 server.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 968 wrote to memory of 3644 968 18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4.exe 82 PID 968 wrote to memory of 3644 968 18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4.exe 82 PID 968 wrote to memory of 3644 968 18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4.exe 82 PID 3644 wrote to memory of 3284 3644 server.exe 83 PID 3644 wrote to memory of 3284 3644 server.exe 83 PID 3644 wrote to memory of 3284 3644 server.exe 83 PID 3644 wrote to memory of 4268 3644 server.exe 85 PID 3644 wrote to memory of 4268 3644 server.exe 85 PID 3644 wrote to memory of 4268 3644 server.exe 85 PID 3644 wrote to memory of 1888 3644 server.exe 86 PID 3644 wrote to memory of 1888 3644 server.exe 86 PID 3644 wrote to memory of 1888 3644 server.exe 86 PID 3644 wrote to memory of 1656 3644 server.exe 88 PID 3644 wrote to memory of 1656 3644 server.exe 88 PID 3644 wrote to memory of 1656 3644 server.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4.exe"C:\Users\Admin\AppData\Local\Temp\18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3284
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4268
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1888
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1656
-
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4572
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2480
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD5661cab77d3b907e8057f2e689e995af3
SHA15d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c
SHA2568f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2
SHA5122523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67
-
Filesize
93KB
MD52545b47e98ffb00e68912dbedcb8f5db
SHA10612d0f4417ebb63e52ad1da47db3209e848332a
SHA25618240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4
SHA512d480f7713618938a6239445c4e5ccdbdc1305fa3d45e958d7b4656cee09e792ad5892e18c0c590f2aa9c2e904f00a271fbbb8da5db3d14846a9819ba5cba7788
-
Filesize
4B
MD5931db99e42055249760280846b3d667a
SHA19e0e0cea04560fcbf4ded54640a65a6987943672
SHA2562a6b5dd5f6530a184eba6f0cced2c935751cf2c27fc3ab2e7124e76a249fdee6
SHA51266471125ec18e0573e51decaf82bd7e1c792bad12ee0d98697a0870d1ddc670a6407912a648f44d5500ee543f37180ddf8825c86c8f990c2f8305620cf1ea6e0