Analysis
-
max time kernel
299s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 11:52
General
-
Target
Server.exe
-
Size
37KB
-
MD5
b91a5c7f8f93275cc9c9f6ae6718fef8
-
SHA1
71f1a9b3121dfa908a65c65e7ffe32e96ce525be
-
SHA256
1498ad3416f80ca9236279eca1c4ee2bce4373706b4f513ff80da22972fd4143
-
SHA512
88c3e586afbf2136eccaed6a9056d52d3ceddea8631d9e71df3caeb1372d9c03beaaa2c103fb2c8c5c0ab1a7279ad3ae69b1054881d15d3a490699207f31b28a
-
SSDEEP
384:g5waCiMGB63fbw6ZfrZUy8fiCH1OgmBeRcrAF+rMRTyN/0L+EcoinblneHQM3ep2:1a0DwODZX8fiCEdeWrM+rMRa8NuRWt
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MovaviVideoEditor.exe"C:\Users\Admin\AppData\Local\Temp\MovaviVideoEditor.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\MovaviVideoEditor.exe" "MovaviVideoEditor.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5b91a5c7f8f93275cc9c9f6ae6718fef8
SHA171f1a9b3121dfa908a65c65e7ffe32e96ce525be
SHA2561498ad3416f80ca9236279eca1c4ee2bce4373706b4f513ff80da22972fd4143
SHA51288c3e586afbf2136eccaed6a9056d52d3ceddea8631d9e71df3caeb1372d9c03beaaa2c103fb2c8c5c0ab1a7279ad3ae69b1054881d15d3a490699207f31b28a
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB