Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
02-12-2024 21:30
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
8 signatures
150 seconds
General
-
Target
Server.exe
-
Size
93KB
-
MD5
defbb225dad13b3d1c3760fd13ef961c
-
SHA1
3f3cf80093f4cee8dc83ada199fec3a25223fc82
-
SHA256
c92d735b5bb92c2d66b35e02740992f307a3dabd0ecc6b6ae7630667c55f2c34
-
SHA512
346f39dc6528783defc05fe539188f85661e921a5cf3669eb5f1fa78060ee8d4daaa1da70dc3bd854db2fea3ecf6b169cec7874bee7a81cfc43f097c35e2bb06
-
SSDEEP
768:HY3odnD9O/pBcxYsbae6GIXb9pDX2t9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk37sGM:VdxOx6baIa9ROj00ljEwzGi1dDHDGgS
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 2424 netsh.exe 2736 netsh.exe 2816 netsh.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5e95493f3fe58d9745fe5e529229f235Windows Update.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5e95493f3fe58d9745fe5e529229f235Windows Update.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe 4992 Server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4992 Server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe Token: 33 4992 Server.exe Token: SeIncBasePriorityPrivilege 4992 Server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4992 wrote to memory of 2424 4992 Server.exe 82 PID 4992 wrote to memory of 2424 4992 Server.exe 82 PID 4992 wrote to memory of 2424 4992 Server.exe 82 PID 4992 wrote to memory of 2736 4992 Server.exe 84 PID 4992 wrote to memory of 2736 4992 Server.exe 84 PID 4992 wrote to memory of 2736 4992 Server.exe 84 PID 4992 wrote to memory of 2816 4992 Server.exe 86 PID 4992 wrote to memory of 2816 4992 Server.exe 86 PID 4992 wrote to memory of 2816 4992 Server.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2424
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2816
-