Analysis
- max time kernel
150s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20240709-en - resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system - submitted
19/07/2024, 15:02
Behavioral task
behavioral1
Sample
Server3.exe
Resource
win7-20240705-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server3.exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
Server3.exe
Resource
win11-20240709-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target Server3.exe
- Size 93KB
- Sample240719-seqf6szhld
- SHA256 3b3abff977d8411289f5e1a9f73aea5c133055c194d4e29997e74b05fa3e0e29
- MD5 9715c7ab9ae58bedaf49006c87eafc70
- SHA1 f25f068460feb70e92193aa1a6352354d4f4dd31
- SHA512 cdde2adddc0a4d886de6e69ad0d5259902dbad140cd43f1e732b18a7aac772ecb763cc19bbde5bf22e63edf23723fd93fa4db9cf4d4f1d7add233c5ff0dbefd3
- SSDEEP 768:0Y3vCgyZnDQMMpAZrGSt6+tdxXYG+YcSoSVUIXxrjEtCdnl2pi1Rz4Rk3UsGdXE3:LC9ZD3rGWFtnVo4NjEwzGi1dDsxEgS
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3000 netsh.exe - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\103add70cf210fc418af47d219bacd6eWindows Update.exe Server3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\103add70cf210fc418af47d219bacd6eWindows Update.exe Server3.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server3.exe - Executes dropped EXE 3 IoCs
pid Process 2260 StUpdate.exe 1628 StUpdate.exe 544 StUpdate.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf Server3.exe File created F:\autorun.inf Server3.exe File opened for modification F:\autorun.inf Server3.exe File created C:\autorun.inf Server3.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe Server3.exe File opened for modification C:\Windows\SysWOW64\Explower.exe Server3.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4000 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe 1752 Server3.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1752 Server3.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe Token: 33 1752 Server3.exe Token: SeIncBasePriorityPrivilege 1752 Server3.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1752 wrote to memory of 3000 1752 Server3.exe 83 PID 1752 wrote to memory of 3000 1752 Server3.exe 83 PID 1752 wrote to memory of 3000 1752 Server3.exe 83 PID 1752 wrote to memory of 4000 1752 Server3.exe 85 PID 1752 wrote to memory of 4000 1752 Server3.exe 85 PID 1752 wrote to memory of 4000 1752 Server3.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server3.exe"C:\Users\Admin\AppData\Local\Temp\Server3.exe"1⤵
- Drops startup file
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server3.exe" "Server3.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3000
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:4000
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
PID:2260
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
PID:1628
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
PID:544
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Umbrella.flv.exe
- Size 93KB
- SHA256 3b3abff977d8411289f5e1a9f73aea5c133055c194d4e29997e74b05fa3e0e29
- MD5 9715c7ab9ae58bedaf49006c87eafc70
- SHA1 f25f068460feb70e92193aa1a6352354d4f4dd31
- SHA512 cdde2adddc0a4d886de6e69ad0d5259902dbad140cd43f1e732b18a7aac772ecb763cc19bbde5bf22e63edf23723fd93fa4db9cf4d4f1d7add233c5ff0dbefd3
- SSDEEP 768:0Y3vCgyZnDQMMpAZrGSt6+tdxXYG+YcSoSVUIXxrjEtCdnl2pi1Rz4Rk3UsGdXE3:LC9ZD3rGWFtnVo4NjEwzGi1dDsxEgS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\StUpdate.exe.log
- Size 408B
- SHA256 beb8b3a764b3e94cc547be84090345e833be03d95d680ad4d75734ccd6485757
- MD5 593f806d2255a76afcad5d4a8395781b
- SHA1 3990edff12ef61875bb4206b25a97a9440a8998c
- SHA512 97440ebd7f8aac1030fe83c7f32a40a986d0fa6faec2c8b8cfbce093a3f27e7626c0b6e768ce6c753ac4dddc4227057b3a6e1d5a652d1f4a9cf64fa8efbad017
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\app
- Size 5B
- SHA256 d53ce6bdbd0c3cb4596ac3103f15824570a9858da95f63cedf64cec11dc44e2d
- MD5 2099bb64fd1770d321df364f99b658d1
- SHA1 3124edeaa14c060becfa8b980ed77db15d56a9e3
- SHA512 3481f2a02f7b1255ad0f3cd8a716de9c7414753b6f8657f0bf99738ff6623f8717469bc10e737d6c0d1d13846e726d50baeb5e8ef73efcfce7be5c63327c4895
- MD5 SHA1 SHA512