Analysis
-
max time kernel
898s -
max time network
899s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2025 22:19
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
6 signatures
900 seconds
General
-
Target
Server.exe
-
Size
93KB
-
MD5
cc560bdc2869ccf4ae0e939a1aa7f1b4
-
SHA1
f16b12272a26df1bb2dffe5ebbd8483b30d59ee5
-
SHA256
88438e680d7127491c1bed3f762ac9fc7839e08e710cb8f9da9d1cfbaf772f68
-
SHA512
d57d6e8e1d27d41c01f3a6c6bcdb8f522748527678539f816b94da3b5cba8a75a96b8d1b0677ef77925eb579d2c7d374f50b91df9887f734ff288a303ddbae12
-
SSDEEP
1536:PUwC+xhUa9urgOBPRNvM4jEwzGi1dDxD8gS:PUmUa9urgObdGi1dNV
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4768 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4776 Server.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe Token: SeIncBasePriorityPrivilege 4776 Server.exe Token: 33 4776 Server.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4776 wrote to memory of 4768 4776 Server.exe 85 PID 4776 wrote to memory of 4768 4776 Server.exe 85 PID 4776 wrote to memory of 4768 4776 Server.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4768
-