Analysis
- max time kernel
150s - max time network
143s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
19/07/2024, 15:02
Behavioral task
behavioral1
Sample
Server3.exe
Resource
win7-20240705-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server3.exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
Server3.exe
Resource
win11-20240709-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target Server3.exe
- Size 93KB
- Sample240719-seqf6szhld
- SHA256 3b3abff977d8411289f5e1a9f73aea5c133055c194d4e29997e74b05fa3e0e29
- MD5 9715c7ab9ae58bedaf49006c87eafc70
- SHA1 f25f068460feb70e92193aa1a6352354d4f4dd31
- SHA512 cdde2adddc0a4d886de6e69ad0d5259902dbad140cd43f1e732b18a7aac772ecb763cc19bbde5bf22e63edf23723fd93fa4db9cf4d4f1d7add233c5ff0dbefd3
- SSDEEP 768:0Y3vCgyZnDQMMpAZrGSt6+tdxXYG+YcSoSVUIXxrjEtCdnl2pi1Rz4Rk3UsGdXE3:LC9ZD3rGWFtnVo4NjEwzGi1dDsxEgS
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4476 netsh.exe - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server3.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\103add70cf210fc418af47d219bacd6eWindows Update.exe Server3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\103add70cf210fc418af47d219bacd6eWindows Update.exe Server3.exe - Executes dropped EXE 3 IoCs
pid Process 1740 StUpdate.exe 2144 StUpdate.exe 4772 StUpdate.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf Server3.exe File opened for modification C:\autorun.inf Server3.exe File created F:\autorun.inf Server3.exe File opened for modification F:\autorun.inf Server3.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe Server3.exe File opened for modification C:\Windows\SysWOW64\Explower.exe Server3.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 224 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe 4888 Server3.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4888 Server3.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe Token: 33 4888 Server3.exe Token: SeIncBasePriorityPrivilege 4888 Server3.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4888 wrote to memory of 4476 4888 Server3.exe 73 PID 4888 wrote to memory of 4476 4888 Server3.exe 73 PID 4888 wrote to memory of 4476 4888 Server3.exe 73 PID 4888 wrote to memory of 224 4888 Server3.exe 75 PID 4888 wrote to memory of 224 4888 Server3.exe 75 PID 4888 wrote to memory of 224 4888 Server3.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server3.exe"C:\Users\Admin\AppData\Local\Temp\Server3.exe"1⤵
- Drops startup file
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server3.exe" "Server3.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4476
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
PID:1740
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
PID:2144
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
PID:4772
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Umbrella.flv.exe
- Size 93KB
- SHA256 3b3abff977d8411289f5e1a9f73aea5c133055c194d4e29997e74b05fa3e0e29
- MD5 9715c7ab9ae58bedaf49006c87eafc70
- SHA1 f25f068460feb70e92193aa1a6352354d4f4dd31
- SHA512 cdde2adddc0a4d886de6e69ad0d5259902dbad140cd43f1e732b18a7aac772ecb763cc19bbde5bf22e63edf23723fd93fa4db9cf4d4f1d7add233c5ff0dbefd3
- SSDEEP 768:0Y3vCgyZnDQMMpAZrGSt6+tdxXYG+YcSoSVUIXxrjEtCdnl2pi1Rz4Rk3UsGdXE3:LC9ZD3rGWFtnVo4NjEwzGi1dDsxEgS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\StUpdate.exe.log
- Size 408B
- SHA256 026518c621aa1e908fd3617fe1d684a6225393659345ad4f9c085fc4f6b3cf43
- MD5 6b062b48db9a8e149e10fefd80ab54ef
- SHA1 1e72855f88c33b6ddce512b079bbe2e4aa2b6b57
- SHA512 b36007e2b0b71247979cdac1b17520cc37065c001464b4c70d642c8a059510d28ed8b57b7e4df59a43d99d69c588c1bab7b3c95c6a75c0ab98317246b56f7832
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\app
- Size 5B
- SHA256 d53ce6bdbd0c3cb4596ac3103f15824570a9858da95f63cedf64cec11dc44e2d
- MD5 2099bb64fd1770d321df364f99b658d1
- SHA1 3124edeaa14c060becfa8b980ed77db15d56a9e3
- SHA512 3481f2a02f7b1255ad0f3cd8a716de9c7414753b6f8657f0bf99738ff6623f8717469bc10e737d6c0d1d13846e726d50baeb5e8ef73efcfce7be5c63327c4895
- MD5 SHA1 SHA512