Analysis
-
max time kernel
34s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2024 14:40
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
Server.exe
Resource
win11-20241007-en
General
-
Target
Server.exe
-
Size
93KB
-
MD5
aefe80e4e229c3e197d525a30bbf1c5c
-
SHA1
8f41c9ca904594e20265a160305ab46193f34239
-
SHA256
b96820dd387a8ee24604406c5c308edcac2bd5e165dab66e6ef12b1ef8ef02a3
-
SHA512
dede337bd34817db5f0e45c18907cc8001e6a212ddda8dbe3a2d07010507c8e4b60d26b409e6dc5f4bde7f7ca2b81d714f8c1ce1c4c352ff613dfffdb2980bdd
-
SSDEEP
768:fY3Gli6xgrKSMZAZL28d2WmtlX+jRoI++WqXxrjEtCdnl2pi1Rz4Rk3tsGdpMgS7:Plvxg1L2AZmDO+2jEwzGi1dD9DMgS
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 1732 netsh.exe 2816 netsh.exe 2448 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4196 Server.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4196 Server.exe Token: 33 4196 Server.exe Token: SeIncBasePriorityPrivilege 4196 Server.exe Token: 33 4196 Server.exe Token: SeIncBasePriorityPrivilege 4196 Server.exe Token: 33 4196 Server.exe Token: SeIncBasePriorityPrivilege 4196 Server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4196 wrote to memory of 1732 4196 Server.exe 83 PID 4196 wrote to memory of 1732 4196 Server.exe 83 PID 4196 wrote to memory of 1732 4196 Server.exe 83 PID 4196 wrote to memory of 2816 4196 Server.exe 86 PID 4196 wrote to memory of 2816 4196 Server.exe 86 PID 4196 wrote to memory of 2816 4196 Server.exe 86 PID 4196 wrote to memory of 2448 4196 Server.exe 87 PID 4196 wrote to memory of 2448 4196 Server.exe 87 PID 4196 wrote to memory of 2448 4196 Server.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1732
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2816
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2448
-