Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 16:59
Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Server.exe
-
Size
93KB
-
MD5
bb3fb4c6cf26e4c493e408d0edb5e829
-
SHA1
88da923e8d993a87b8d8970b54f774b47e2b1dc1
-
SHA256
c52b9ffe033d174b2f93b44280c637e8fed9ec36cbf0a391c72a4e421830c6eb
-
SHA512
4d911914d49355b0ebe006b686dd6075b3ba1aa3aeb6425846cd5203d94683f33cbe44cadf909cd68577e404d628e0bfca6fa33b31dc2f668b5673d6446128c7
-
SSDEEP
1536:MO9r7EkrjaFIs7E5OxFJn8LjEwzGi1dD/DKgS:MOhjau5OfVni1dXP
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 4104 netsh.exe 1160 netsh.exe 3264 netsh.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f660f38bbe0ae15ea88c354f03adbfdcWindows Update.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f660f38bbe0ae15ea88c354f03adbfdcWindows Update.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe 2272 Server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2272 Server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe Token: 33 2272 Server.exe Token: SeIncBasePriorityPrivilege 2272 Server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2272 wrote to memory of 1160 2272 Server.exe 83 PID 2272 wrote to memory of 1160 2272 Server.exe 83 PID 2272 wrote to memory of 1160 2272 Server.exe 83 PID 2272 wrote to memory of 4104 2272 Server.exe 85 PID 2272 wrote to memory of 4104 2272 Server.exe 85 PID 2272 wrote to memory of 4104 2272 Server.exe 85 PID 2272 wrote to memory of 3264 2272 Server.exe 86 PID 2272 wrote to memory of 3264 2272 Server.exe 86 PID 2272 wrote to memory of 3264 2272 Server.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1160
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4104
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5bb3fb4c6cf26e4c493e408d0edb5e829
SHA188da923e8d993a87b8d8970b54f774b47e2b1dc1
SHA256c52b9ffe033d174b2f93b44280c637e8fed9ec36cbf0a391c72a4e421830c6eb
SHA5124d911914d49355b0ebe006b686dd6075b3ba1aa3aeb6425846cd5203d94683f33cbe44cadf909cd68577e404d628e0bfca6fa33b31dc2f668b5673d6446128c7