Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2024 19:07
Behavioral task
behavioral1
Sample
bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
120 seconds
Behavioral task
behavioral2
Sample
bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
120 seconds
General
-
Target
bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exe
-
Size
93KB
-
MD5
4a738bcc7d3f87bfc4fb036aaeae2d30
-
SHA1
320f2d0131365e2b3f35449d862ec398b7d678de
-
SHA256
bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1
-
SHA512
9c6cb71cdd51d45fb4f1e075b3edbe29267dcd65609059560db656eba331e0634f359c4cf8e43cf24812c70d981a60439c83d51f21c6df977684e38bfc2d4b4b
-
SSDEEP
1536:OKjJD/HBZbszKu9AZpd7r1jEwzGi1dDyDggS:OKCzK4AZ3HCi1dsJ
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid Process 2104 netsh.exe 3528 netsh.exe 3928 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exe -
Drops startup file 6 IoCs
Processes:
server.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\68b83221d2442765871a07d141d8ff45Windows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\68b83221d2442765871a07d141d8ff45Windows Update.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe server.exe -
Executes dropped EXE 1 IoCs
Processes:
server.exepid Process 440 server.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
server.exedescription ioc Process File created C:\autorun.inf server.exe File opened for modification C:\autorun.inf server.exe File created F:\autorun.inf server.exe File opened for modification F:\autorun.inf server.exe -
Drops file in System32 directory 2 IoCs
Processes:
server.exedescription ioc Process File created C:\Windows\SysWOW64\Explower.exe server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe server.exe -
Drops file in Program Files directory 2 IoCs
Processes:
server.exedescription ioc Process File opened for modification C:\Program Files (x86)\Explower.exe server.exe File created C:\Program Files (x86)\Explower.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exenetsh.exedescription ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
netsh.exenetsh.exebcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exeserver.exenetsh.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
server.exepid Process 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe 440 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
server.exepid Process 440 server.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
server.exedescription pid Process Token: SeDebugPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe Token: 33 440 server.exe Token: SeIncBasePriorityPrivilege 440 server.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exeserver.exedescription pid Process procid_target PID 2124 wrote to memory of 440 2124 bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exe 87 PID 2124 wrote to memory of 440 2124 bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exe 87 PID 2124 wrote to memory of 440 2124 bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exe 87 PID 440 wrote to memory of 2104 440 server.exe 88 PID 440 wrote to memory of 2104 440 server.exe 88 PID 440 wrote to memory of 2104 440 server.exe 88 PID 440 wrote to memory of 3528 440 server.exe 90 PID 440 wrote to memory of 3528 440 server.exe 90 PID 440 wrote to memory of 3528 440 server.exe 90 PID 440 wrote to memory of 3928 440 server.exe 91 PID 440 wrote to memory of 3928 440 server.exe 91 PID 440 wrote to memory of 3928 440 server.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exe"C:\Users\Admin\AppData\Local\Temp\bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2104
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3528
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3928
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD54a738bcc7d3f87bfc4fb036aaeae2d30
SHA1320f2d0131365e2b3f35449d862ec398b7d678de
SHA256bcce94cbcb8b360dfc91528e041598c2c5833aecd8b4800f5c3a8ae806ca6df1
SHA5129c6cb71cdd51d45fb4f1e075b3edbe29267dcd65609059560db656eba331e0634f359c4cf8e43cf24812c70d981a60439c83d51f21c6df977684e38bfc2d4b4b
-
Filesize
5B
MD57eb860abfe2281298575b5216ef42bc6
SHA1d4dfd7ac22dcd07da34306c40b4e5367a969cda5
SHA25683d46461bf45f00cb4fc5df9679b2bd82dbf54eeb022ca1711eefb4b2e7b7689
SHA512427bfc41f0514ee10d400eea38f22f6fac6f9d5ecd84ad7adb1161ff9355e47c04ff411e172fafcd23c137ad1528ed2f2cb95d247613ae5550c089633f18994d