Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
02/12/2024, 21:28
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
8 signatures
150 seconds
General
-
Target
Server.exe
-
Size
93KB
-
MD5
9c9a9f7685e33035b35c8f3b33d00987
-
SHA1
c0c88194e5794dce4017236445dfd33240e73a52
-
SHA256
cf9d75264ce6d9cc9c7b3d3dd530381c9d9b6b3f91a79a7f7862c9ad031e2291
-
SHA512
4a2fc30969aee7c232de174d1df59b607b82cc8d87cfaf0a4d0dfbf44d8fa2266f743fa388e3858a839e14fbe917dfd3536b4818d6d0cabac56f726d3dab4456
-
SSDEEP
1536:9y9r7EkrjaFIs7E5OxFJn8LjEwzGi1dD4DhgS:9yhjau5OfVni1dGe
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 4368 netsh.exe 1448 netsh.exe 2292 netsh.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\861e37b75a05e551d8f5695718427e80Windows Update.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\861e37b75a05e551d8f5695718427e80Windows Update.exe Server.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe 1620 Server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1620 Server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe Token: 33 1620 Server.exe Token: SeIncBasePriorityPrivilege 1620 Server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1620 wrote to memory of 4368 1620 Server.exe 82 PID 1620 wrote to memory of 4368 1620 Server.exe 82 PID 1620 wrote to memory of 4368 1620 Server.exe 82 PID 1620 wrote to memory of 1448 1620 Server.exe 84 PID 1620 wrote to memory of 1448 1620 Server.exe 84 PID 1620 wrote to memory of 1448 1620 Server.exe 84 PID 1620 wrote to memory of 2292 1620 Server.exe 85 PID 1620 wrote to memory of 2292 1620 Server.exe 85 PID 1620 wrote to memory of 2292 1620 Server.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4368
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1448
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2292
-