Overview
overview
6Static
static
3easy-servi...et.dll
windows7-x64
1easy-servi...et.dll
windows10-2004-x64
1easy-servi...th.bat
windows7-x64
6easy-servi...th.bat
windows10-2004-x64
6easy-servi...10.bat
windows7-x64
6easy-servi...10.bat
windows10-2004-x64
6easy-servi...vc.exe
windows7-x64
1easy-servi...vc.exe
windows10-2004-x64
1easy-servi...er.exe
windows7-x64
1easy-servi...er.exe
windows10-2004-x64
1easy-servi...dex.js
windows7-x64
3easy-servi...dex.js
windows10-2004-x64
3easy-servi...ain.py
windows7-x64
3easy-servi...ain.py
windows10-2004-x64
3easy-servi...onf.js
windows7-x64
3easy-servi...onf.js
windows10-2004-x64
3easy-servi...ibs.js
windows7-x64
3easy-servi...ibs.js
windows10-2004-x64
3easy-servi...ain.js
windows7-x64
3easy-servi...ain.js
windows10-2004-x64
3easy-servi...ger.js
windows7-x64
3easy-servi...ger.js
windows10-2004-x64
3easy-servi...ker.js
windows7-x64
3easy-servi...ker.js
windows10-2004-x64
3easy-servi...ils.js
windows7-x64
3easy-servi...ils.js
windows10-2004-x64
3easy-servi...ker.js
windows7-x64
3easy-servi...ker.js
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 06:07
Static task
static1
Behavioral task
behavioral1
Sample
easy-service-1.0.11/bin/log4net.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
easy-service-1.0.11/bin/log4net.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
easy-service-1.0.11/bin/register-this-path.bat
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
easy-service-1.0.11/bin/register-this-path.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
easy-service-1.0.11/bin/register-this-path.win10.bat
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
easy-service-1.0.11/bin/register-this-path.win10.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
easy-service-1.0.11/bin/svc.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
easy-service-1.0.11/bin/svc.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
easy-service-1.0.11/samples/csharp-version/worker/sample-worker.exe
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
easy-service-1.0.11/samples/csharp-version/worker/sample-worker.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
easy-service-1.0.11/samples/nodejs-version/worker/index.js
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
easy-service-1.0.11/samples/nodejs-version/worker/index.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
easy-service-1.0.11/samples/python-version/worker/main.py
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
easy-service-1.0.11/samples/python-version/worker/main.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
easy-service-1.0.11/src/Conf.js
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
easy-service-1.0.11/src/Conf.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
easy-service-1.0.11/src/Libs.js
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
easy-service-1.0.11/src/Libs.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
easy-service-1.0.11/src/Main.js
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
easy-service-1.0.11/src/Main.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
easy-service-1.0.11/src/MyFileLogger.js
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
easy-service-1.0.11/src/MyFileLogger.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
easy-service-1.0.11/src/SampleWorker.js
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
easy-service-1.0.11/src/SampleWorker.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
easy-service-1.0.11/src/SvcUtils.js
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
easy-service-1.0.11/src/SvcUtils.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
easy-service-1.0.11/src/Worker.js
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
easy-service-1.0.11/src/Worker.js
Resource
win10v2004-20241007-en
General
-
Target
easy-service-1.0.11/bin/register-this-path.win10.bat
-
Size
77B
-
MD5
3e136a9b9973643280cb3152412a58bf
-
SHA1
784625d88b16b076c9a6c0e179bd02b06d6716a8
-
SHA256
4d336d48ddb64566d990d74702d4b6a7cd4d3c093dae95e7e6bfb23ee9482f5d
-
SHA512
b56292e56d4d2a5e5525854a71b67db11cb3f6a79acce89cd14e5c90de4ba9bf6ee332557a50c0ee01e020d292712b3e087fbf0156fed3641bfeaf25e4c5a33a
Malware Config
Signatures
-
pid Process 2712 powershell.exe 2288 powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2712 powershell.exe 2712 powershell.exe 2712 powershell.exe 2288 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2712 powershell.exe Token: SeDebugPrivilege 2288 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2712 1924 cmd.exe 31 PID 1924 wrote to memory of 2712 1924 cmd.exe 31 PID 1924 wrote to memory of 2712 1924 cmd.exe 31 PID 2712 wrote to memory of 1160 2712 powershell.exe 32 PID 2712 wrote to memory of 1160 2712 powershell.exe 32 PID 2712 wrote to memory of 1160 2712 powershell.exe 32 PID 1160 wrote to memory of 2288 1160 cmd.exe 34 PID 1160 wrote to memory of 2288 1160 cmd.exe 34 PID 1160 wrote to memory of 2288 1160 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\easy-service-1.0.11\bin\register-this-path.win10.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "Start-Process .\register-this-path.bat -Verb RunAs"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\easy-service-1.0.11\bin\register-this-path.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c [Environment]::SetEnvironmentVariable('Path',[Environment]::GetEnvironmentVariable('Path','Machine')+';C:\Users\Admin\AppData\Local\Temp\easy-service-1.0.11\bin\','Machine')4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ACXXYAO944ZU949J7JKX.temp
Filesize7KB
MD5e6535dd2313ebbb73d853cc171f6e616
SHA19f413d6d5f227d6894412909af491564195625d3
SHA2568934676afe43e5027451bfcf5b35c3b2505722018b0969db55fa0d58acf61f09
SHA5126894c2b524d62363cb8996900eb585056fdfd95e5032612810dc53b4f77d1a13803d0e5eb678c5a36060d61ea589d7326cbd24bca02149483d35273971fffe03