Analysis
-
max time kernel
22s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 23:57
Behavioral task
behavioral1
Sample
snoserV4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
snoserV4.exe
-
Size
93KB
-
MD5
9e828f0df93f5e2497778a8ef5bf800d
-
SHA1
ad325fb4cd00c05f86910915ba86bd20019c1ce0
-
SHA256
8c2d9ceea06bbfe78077656136679b70a250c12a905ce9fa9ba7ce7ec6630ef1
-
SHA512
c41b63467b8eaad58a8137a64e113708944724148751c83bd8eae56a7320101dc8a27f6d577e0bde625a381b946aa53f16d774c5da5a11d27bdbc570fa11a647
-
SSDEEP
1536:/5s28M8anOafNacpQXvjEwzGi1dDtDogS:/5dnOafNac+XUi1dpR
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3940 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation snoserV4.exe -
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Settings.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e98a02057d735ac3a6d778cf4c37408Settings.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e98a02057d735ac3a6d778cf4c37408Settings.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Settings.exe server.exe -
Executes dropped EXE 1 IoCs
pid Process 2100 server.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf server.exe File opened for modification C:\autorun.inf server.exe File created F:\autorun.inf server.exe File opened for modification F:\autorun.inf server.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe server.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Explower.exe server.exe File created C:\Program Files (x86)\Explower.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snoserV4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 3500 taskmgr.exe 3500 taskmgr.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 3500 taskmgr.exe 3500 taskmgr.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 3500 taskmgr.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe 2100 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2100 server.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2100 server.exe Token: SeDebugPrivilege 3500 taskmgr.exe Token: SeSystemProfilePrivilege 3500 taskmgr.exe Token: SeCreateGlobalPrivilege 3500 taskmgr.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe -
Suspicious use of SendNotifyMessage 29 IoCs
pid Process 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5020 wrote to memory of 2100 5020 snoserV4.exe 84 PID 5020 wrote to memory of 2100 5020 snoserV4.exe 84 PID 5020 wrote to memory of 2100 5020 snoserV4.exe 84 PID 2100 wrote to memory of 3940 2100 server.exe 85 PID 2100 wrote to memory of 3940 2100 server.exe 85 PID 2100 wrote to memory of 3940 2100 server.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\snoserV4.exe"C:\Users\Admin\AppData\Local\Temp\snoserV4.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3940
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3500
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD59e828f0df93f5e2497778a8ef5bf800d
SHA1ad325fb4cd00c05f86910915ba86bd20019c1ce0
SHA2568c2d9ceea06bbfe78077656136679b70a250c12a905ce9fa9ba7ce7ec6630ef1
SHA512c41b63467b8eaad58a8137a64e113708944724148751c83bd8eae56a7320101dc8a27f6d577e0bde625a381b946aa53f16d774c5da5a11d27bdbc570fa11a647
-
Filesize
5B
MD5c2844bc9e1bd64168a727b0680ae4d90
SHA17bb263540de557f5a4e09c6c78b7dbb314a0df9a
SHA2569c9701ab918368b615fc6a0dbeb5efa286a232d751982ae70b48ad6914bf01e5
SHA512360953bb20d91539022fcb1becf4638970c4452816797a8dca65e3ae4a542302e6e89f0828087caaa63a0750aa78605f8034da7c8663fa4fc677c8f3e53655ed