Overview
overview
10Static
static
10Setup.zip
windows7-x64
8Setup.zip
windows10-2004-x64
10Setup/Setup.exe
windows7-x64
10Setup/Setup.exe
windows10-2004-x64
8Setup/TUTO...25.txt
windows7-x64
1Setup/TUTO...25.txt
windows10-2004-x64
1Setup/hidserv.dll
windows10-2004-x64
1Setup/hlink.dll
windows10-2004-x64
7Setup/hmkd.dll
windows10-2004-x64
1Setup/hnetcfg.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-01-2025 21:39
Behavioral task
behavioral1
Sample
Setup.zip
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Setup.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Setup/Setup.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
Setup/Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Setup/TUTORIAL - UPDATE - 6.1.2025.txt
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Setup/TUTORIAL - UPDATE - 6.1.2025.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Setup/hidserv.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Setup/hlink.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Setup/hmkd.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Setup/hnetcfg.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Setup.zip
-
Size
346KB
-
MD5
2bb6ee5e68c1042aaad2e0d33a279f93
-
SHA1
7f7bd9b09e1bcd3eba0bef4e42b0066ecf3cece0
-
SHA256
76e7d47eb1ab002d0536d9c2e073eb9286c9ce78aff2d9ac042e7c01916a2712
-
SHA512
618a930a8d3df5092278c15303326fa149aea5757e8d5ad8e054aaacaedb51d409f987a75fd489a19c426a2b2d5b36ec3f63c1f7bc1b1b70cdd06bd8e75c3b28
-
SSDEEP
6144:ZnVt5WDMqx82+hn5dXsPx9+HCwIsKDQeWVIbZhhoWmud+b:VrMDMqx82onv8Z98QpeGZXosc
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2572 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0cf848bcebf5d082d484e0ffe1e8f23e.exe WindowsServer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0cf848bcebf5d082d484e0ffe1e8f23e.exe WindowsServer.exe -
Executes dropped EXE 3 IoCs
pid Process 2568 Setup.exe 1748 WindowsServer.exe 376 Setup.exe -
Loads dropped DLL 1 IoCs
pid Process 2568 Setup.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\0cf848bcebf5d082d484e0ffe1e8f23e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServer.exe\" .." WindowsServer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\0cf848bcebf5d082d484e0ffe1e8f23e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServer.exe\" .." WindowsServer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsServer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2704 7zFM.exe 2704 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2704 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeRestorePrivilege 2704 7zFM.exe Token: 35 2704 7zFM.exe Token: SeSecurityPrivilege 2704 7zFM.exe Token: SeDebugPrivilege 1748 WindowsServer.exe Token: SeSecurityPrivilege 2704 7zFM.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe Token: 33 1748 WindowsServer.exe Token: SeIncBasePriorityPrivilege 1748 WindowsServer.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2704 7zFM.exe 2704 7zFM.exe 2704 7zFM.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2568 2704 7zFM.exe 30 PID 2704 wrote to memory of 2568 2704 7zFM.exe 30 PID 2704 wrote to memory of 2568 2704 7zFM.exe 30 PID 2704 wrote to memory of 2568 2704 7zFM.exe 30 PID 2704 wrote to memory of 2568 2704 7zFM.exe 30 PID 2704 wrote to memory of 2568 2704 7zFM.exe 30 PID 2704 wrote to memory of 2568 2704 7zFM.exe 30 PID 2568 wrote to memory of 1748 2568 Setup.exe 31 PID 2568 wrote to memory of 1748 2568 Setup.exe 31 PID 2568 wrote to memory of 1748 2568 Setup.exe 31 PID 2568 wrote to memory of 1748 2568 Setup.exe 31 PID 1748 wrote to memory of 2572 1748 WindowsServer.exe 32 PID 1748 wrote to memory of 2572 1748 WindowsServer.exe 32 PID 1748 wrote to memory of 2572 1748 WindowsServer.exe 32 PID 1748 wrote to memory of 2572 1748 WindowsServer.exe 32 PID 2704 wrote to memory of 376 2704 7zFM.exe 35 PID 2704 wrote to memory of 376 2704 7zFM.exe 35 PID 2704 wrote to memory of 376 2704 7zFM.exe 35 PID 2704 wrote to memory of 376 2704 7zFM.exe 35 PID 2704 wrote to memory of 376 2704 7zFM.exe 35 PID 2704 wrote to memory of 376 2704 7zFM.exe 35 PID 2704 wrote to memory of 376 2704 7zFM.exe 35
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Setup.zip"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\7zO09A8B437\Setup.exe"C:\Users\Admin\AppData\Local\Temp\7zO09A8B437\Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\WindowsServer.exe"C:\Users\Admin\AppData\Local\Temp\WindowsServer.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServer.exe" "WindowsServer.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2572
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO09AFCB47\Setup.exe"C:\Users\Admin\AppData\Local\Temp\7zO09AFCB47\Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:376
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5e3383ba53ecebb2ecb7063fcccff17dc
SHA1cd1384e86f194f95c8939418d30c80c56c412645
SHA25607eaa040d73e39f53851533c8c09d92cd3228d099236e3995b19b4c8a1c15ada
SHA512563f952147c529230824ae6feaababb3ccbe7eca324d71892d2d4f68ffc0eb6eaf1edce29662c63563cd1f7c6de6e4468b35e2b96a7eb43c93aa7367c2877d34