Analysis
-
max time kernel
899s -
max time network
840s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-02-2025 06:51
Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
900 seconds
General
-
Target
Server.exe
-
Size
93KB
-
MD5
357d842cf97d0f8f8c381c9f39d7e0d5
-
SHA1
490bf014def2fa4bba95484bd4516641c60349df
-
SHA256
d01ff0c02302be3b05a7bbf6251252e81ad3c26bb9ee24b0a43d7e5aa28c77dd
-
SHA512
abc1c638ade2982b7a825645a02d62dd5db283c39b134db2d41ebbb6f6236902f515b6b0b6e9c9228f640c7f7b42a39814e8a231f0e5284d550440c4a224fd35
-
SSDEEP
768:HY33UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3LsG0:OUxOx6baIa9RZj00ljEwzGi1dDXD2gS
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2304 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2104 Server.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe Token: SeIncBasePriorityPrivilege 2104 Server.exe Token: 33 2104 Server.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2304 2104 Server.exe 30 PID 2104 wrote to memory of 2304 2104 Server.exe 30 PID 2104 wrote to memory of 2304 2104 Server.exe 30 PID 2104 wrote to memory of 2304 2104 Server.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2304
-