Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2023 17:27
Behavioral task
behavioral1
Sample
ServeFDr.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ServeFDr.exe
Resource
win10v2004-20231127-en
General
-
Target
ServeFDr.exe
-
Size
93KB
-
MD5
9af8fc91af5e99e4373cbb5713dd40ec
-
SHA1
3ec0d34c5769ec819cb02a2d0bc8f7fde20505c9
-
SHA256
1e7708aaa98da8303b9826e82ed2d0777a5684ecda49071eb91c9d0db4e02172
-
SHA512
fb7bb746f660e024ed78c66ab9f5685e1d28b851dbf5227ddd09e686f13b8f3537c7678b8794e02362a99e83e462e8f9d9c7934aa3c83ef5db0c83c7fa1817ab
-
SSDEEP
1536:p+jJD/HBZbszKu9AZpy7r1jEwzGi1dDnDagS:p+CzK4AZwHCi1dXf
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 4 IoCs
Processes:
ServeFDr.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe ServeFDr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe ServeFDr.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e50c2e388f4a4092e8a1f2b2c9786ee0Windows Update.exe ServeFDr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e50c2e388f4a4092e8a1f2b2c9786ee0Windows Update.exe ServeFDr.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ServeFDr.exedescription ioc process File opened for modification F:\autorun.inf ServeFDr.exe File created C:\autorun.inf ServeFDr.exe File opened for modification C:\autorun.inf ServeFDr.exe File created F:\autorun.inf ServeFDr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ServeFDr.exepid process 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe 3336 ServeFDr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ServeFDr.exepid process 3336 ServeFDr.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
ServeFDr.exedescription pid process Token: SeDebugPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe Token: 33 3336 ServeFDr.exe Token: SeIncBasePriorityPrivilege 3336 ServeFDr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ServeFDr.exedescription pid process target process PID 3336 wrote to memory of 4544 3336 ServeFDr.exe netsh.exe PID 3336 wrote to memory of 4544 3336 ServeFDr.exe netsh.exe PID 3336 wrote to memory of 4544 3336 ServeFDr.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ServeFDr.exe"C:\Users\Admin\AppData\Local\Temp\ServeFDr.exe"1⤵
- Drops startup file
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\ServeFDr.exe" "ServeFDr.exe" ENABLE2⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\Umbrella.flv.exeFilesize
93KB
MD59af8fc91af5e99e4373cbb5713dd40ec
SHA13ec0d34c5769ec819cb02a2d0bc8f7fde20505c9
SHA2561e7708aaa98da8303b9826e82ed2d0777a5684ecda49071eb91c9d0db4e02172
SHA512fb7bb746f660e024ed78c66ab9f5685e1d28b851dbf5227ddd09e686f13b8f3537c7678b8794e02362a99e83e462e8f9d9c7934aa3c83ef5db0c83c7fa1817ab
-
memory/3336-0-0x00000000750C0000-0x0000000075671000-memory.dmpFilesize
5.7MB
-
memory/3336-1-0x00000000750C0000-0x0000000075671000-memory.dmpFilesize
5.7MB
-
memory/3336-2-0x0000000000A60000-0x0000000000A70000-memory.dmpFilesize
64KB
-
memory/3336-21-0x00000000750C0000-0x0000000075671000-memory.dmpFilesize
5.7MB
-
memory/3336-22-0x00000000750C0000-0x0000000075671000-memory.dmpFilesize
5.7MB
-
memory/3336-23-0x0000000000A60000-0x0000000000A70000-memory.dmpFilesize
64KB