Analysis
-
max time kernel
895s -
max time network
762s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-ja -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250128-jalocale:ja-jpos:windows10-ltsc 2021-x64systemwindows -
submitted
30-01-2025 22:44
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10ltsc2021-20250128-ja
windows10-ltsc 2021-x64
6 signatures
900 seconds
General
-
Target
Server.exe
-
Size
93KB
-
MD5
cc560bdc2869ccf4ae0e939a1aa7f1b4
-
SHA1
f16b12272a26df1bb2dffe5ebbd8483b30d59ee5
-
SHA256
88438e680d7127491c1bed3f762ac9fc7839e08e710cb8f9da9d1cfbaf772f68
-
SHA512
d57d6e8e1d27d41c01f3a6c6bcdb8f522748527678539f816b94da3b5cba8a75a96b8d1b0677ef77925eb579d2c7d374f50b91df9887f734ff288a303ddbae12
-
SSDEEP
1536:PUwC+xhUa9urgOBPRNvM4jEwzGi1dDxD8gS:PUmUa9urgObdGi1dNV
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 6108 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3624 Server.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe Token: SeIncBasePriorityPrivilege 3624 Server.exe Token: 33 3624 Server.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3624 wrote to memory of 6108 3624 Server.exe 82 PID 3624 wrote to memory of 6108 3624 Server.exe 82 PID 3624 wrote to memory of 6108 3624 Server.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:6108
-