Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 10:38
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target Server.exe
- Size 93KB
- Sample261012-mppdzavves
- SHA256 70485ce33c53aa8d552707b55c43cdd6a02a3d63d84756063e2a5846b4aa4869
- MD5 f15de45c13db7eab4decff2866eaeb6c
- SHA1 01a4cf9a4d1fbea3bd9ca5c60f712c06806d0956
- SHA512 29199ebd88319c9fd78627eba6572f3610da1a1d16ba49a058dfe01f350b0c34a636b767433bd27cc7f494d05df0f79d7cb90d09f4472eb79807a37be4252d9e
- SSDEEP 768:gY3lVfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3VsGdpYgM:9V5WhIUKcuOJhPhBjEwzGi1dDlDYgS
- TLSH T19293E74977E56524E0BF56F79871F2004F74B48B1612E39D48F219AA0A33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 2204 netsh.exe 6072 netsh.exe 2144 netsh.exe - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe Server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe Server.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Explower.exe Server.exe File opened for modification C:\Program Files (x86)\Explower.exe Server.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Server.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Server.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe 2792 Server.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2792 Server.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2792 Server.exe Token: 33 2792 Server.exe Token: SeIncBasePriorityPrivilege 2792 Server.exe Token: 33 2792 Server.exe Token: SeIncBasePriorityPrivilege 2792 Server.exe Token: 33 2792 Server.exe Token: SeIncBasePriorityPrivilege 2792 Server.exe Token: 33 2792 Server.exe Token: SeIncBasePriorityPrivilege 2792 Server.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2204 2792 Server.exe 90 PID 2792 wrote to memory of 2144 2792 Server.exe 92 PID 2792 wrote to memory of 6072 2792 Server.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2204
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2144
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:6072
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1