Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2025, 08:06
Behavioral task
behavioral1
Sample
2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2.exe
-
Size
37KB
-
MD5
7a3c76859c6214a1e4684bef2f2c48b9
-
SHA1
92f83cac4574ca11c24fed6cda219e4b27068bba
-
SHA256
c3fd2a04a522f771dc85a5b16166f2ac2fe48389cbb58d42602ce32b90ff73fd
-
SHA512
b87b70cea0e498c310d64315e9fd3cdffa71f329cfc8bd125c7b488300de7a00b3e5a9712be0cc63f4b1c58d8d62547a5e295c41f8a822279c7a43b81e0eb2e2
-
SSDEEP
384:eeL8CT0i9NdTe/kCOyU7NuvLmDPM+7rAF+rMRTyN/0L+EcoinblneHQM3epzXcNZ:zLhT1CFU7NuKbMgrM+rMRa8NuOdt
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 432 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe 4244 2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4244 2.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe Token: 33 4244 2.exe Token: SeIncBasePriorityPrivilege 4244 2.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5968 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4244 wrote to memory of 432 4244 2.exe 97 PID 4244 wrote to memory of 432 4244 2.exe 97 PID 4244 wrote to memory of 432 4244 2.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\2.exe" "2.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:432
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4092
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt1⤵
- Suspicious use of FindShellTrayWindow
PID:5968