c33fd04b22feb761253055d2674a112d6b527aa3f78e585d1f2d26df3e8512e7

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

93KB
MD5

fccac9bf6c83173de191751a3cc75688
SHA1

5a5f6db3aa85d921707822af7be0f749c00699f6
SHA256

c33fd04b22feb761253055d2674a112d6b527aa3f78e585d1f2d26df3e8512e7
SHA512

db453c4df92e6c274a6e558ed2a95ab4b22d17887dcebaf4760f9e7f2e0d6fc7e2cbe05f4e52690a54414bb466e39f85550535bede6e0979fe7e3499f19c487b
SSDEEP

1536:xkAY3SUFKnOr70txlZbgoGXejEwzGi1dDQDJgS:xkt7KnOr70txIXni1d+G

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 7 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1200	netsh.exe
2724	netsh.exe
2696	netsh.exe
2636	netsh.exe
3064	netsh.exe
2220	netsh.exe
324	netsh.exe

Deletes itself 1 IoCs

pid	Process
2952	svchost.exe

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c4aa78f645d876115299e9c20edace12Windows Update.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c4aa78f645d876115299e9c20edace12Windows Update.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c4aa78f645d876115299e9c20edace12Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Server.exe

Executes dropped EXE 4 IoCs

pid	Process
2952	svchost.exe
1732	server.exe
2092	svchost.exe
1788	server.exe

Loads dropped DLL 8 IoCs

pid	Process
3032	Server.exe
3032	Server.exe
2952	svchost.exe
2952	svchost.exe
1732	server.exe
1732	server.exe
2092	svchost.exe
2092	svchost.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	Server.exe
File created	C:\autorun.inf	Server.exe
File opened for modification	C:\autorun.inf	Server.exe
File created	F:\autorun.inf	Server.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Explower.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\Explower.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\Explower.exe	server.exe
File created	C:\Windows\SysWOW64\Explower.exe	Server.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Explower.exe	Server.exe
File opened for modification	C:\Program Files (x86)\Explower.exe	Server.exe
File opened for modification	C:\Program Files (x86)\Explower.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe
3032	Server.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3032	Server.exe
1732	server.exe
1788	server.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	Server.exe
Token: SeDebugPrivilege	1732	server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	Server.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1200	3032	Server.exe	31
PID 3032 wrote to memory of 1200	3032	Server.exe	31
PID 3032 wrote to memory of 1200	3032	Server.exe	31
PID 3032 wrote to memory of 1200	3032	Server.exe	31
PID 3032 wrote to memory of 2724	3032	Server.exe	33
PID 3032 wrote to memory of 2724	3032	Server.exe	33
PID 3032 wrote to memory of 2724	3032	Server.exe	33
PID 3032 wrote to memory of 2724	3032	Server.exe	33
PID 3032 wrote to memory of 2696	3032	Server.exe	34
PID 3032 wrote to memory of 2696	3032	Server.exe	34
PID 3032 wrote to memory of 2696	3032	Server.exe	34
PID 3032 wrote to memory of 2696	3032	Server.exe	34
PID 3032 wrote to memory of 2952	3032	Server.exe	37
PID 3032 wrote to memory of 2952	3032	Server.exe	37
PID 3032 wrote to memory of 2952	3032	Server.exe	37
PID 3032 wrote to memory of 2952	3032	Server.exe	37
PID 2952 wrote to memory of 1732	2952	svchost.exe	38
PID 2952 wrote to memory of 1732	2952	svchost.exe	38
PID 2952 wrote to memory of 1732	2952	svchost.exe	38
PID 2952 wrote to memory of 1732	2952	svchost.exe	38
PID 1732 wrote to memory of 2636	1732	server.exe	39
PID 1732 wrote to memory of 2636	1732	server.exe	39
PID 1732 wrote to memory of 2636	1732	server.exe	39
PID 1732 wrote to memory of 2636	1732	server.exe	39
PID 1732 wrote to memory of 3064	1732	server.exe	41
PID 1732 wrote to memory of 3064	1732	server.exe	41
PID 1732 wrote to memory of 3064	1732	server.exe	41
PID 1732 wrote to memory of 3064	1732	server.exe	41
PID 1732 wrote to memory of 2220	1732	server.exe	43
PID 1732 wrote to memory of 2220	1732	server.exe	43
PID 1732 wrote to memory of 2220	1732	server.exe	43
PID 1732 wrote to memory of 2220	1732	server.exe	43
PID 1732 wrote to memory of 2092	1732	server.exe	45
PID 1732 wrote to memory of 2092	1732	server.exe	45
PID 1732 wrote to memory of 2092	1732	server.exe	45
PID 1732 wrote to memory of 2092	1732	server.exe	45
PID 2092 wrote to memory of 1788	2092	svchost.exe	46
PID 2092 wrote to memory of 1788	2092	svchost.exe	46
PID 2092 wrote to memory of 1788	2092	svchost.exe	46
PID 2092 wrote to memory of 1788	2092	svchost.exe	46
PID 1788 wrote to memory of 324	1788	server.exe	47
PID 1788 wrote to memory of 324	1788	server.exe	47
PID 1788 wrote to memory of 324	1788	server.exe	47
PID 1788 wrote to memory of 324	1788	server.exe	47

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1200
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2724
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2636
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3064
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2220
  - - C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\server.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:1788
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Umbrella.flv.exe

Filesize
93KB

MD5
fccac9bf6c83173de191751a3cc75688

SHA1
5a5f6db3aa85d921707822af7be0f749c00699f6

SHA256
c33fd04b22feb761253055d2674a112d6b527aa3f78e585d1f2d26df3e8512e7

SHA512
db453c4df92e6c274a6e558ed2a95ab4b22d17887dcebaf4760f9e7f2e0d6fc7e2cbe05f4e52690a54414bb466e39f85550535bede6e0979fe7e3499f19c487b

Download Submit
C:\Users\Admin\AppData\Local\Temp\melt.txt

Filesize
44B

MD5
298802dff6aa26d4fb941c7ccf5c0849

SHA1
11e518ca3409f1863ebc2d3f1be9fb701bad52c0

SHA256
df99fdbdf7b92b29b1bf1ca4283b4de2e04643b9739d2d1089ab5808e8e5665d

SHA512
0301017dfef1b74855d6535f3fd542257689479cb933c2e8742b5b6b94e26107fa38e7fc21bdb83d45184750eced344856092330fb30a1ebbc24b2b9004c8946

Download Submit
C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
112317d572ce0538d2d1b20d7f32170e

SHA1
c7f3714c4806b907bcff7f79aa1d1c9373b77d1e

SHA256
fd9e9a8be71786826787d6eb9aa28371d09b0515ddf0c19b082fe7bac57a88a9

SHA512
265dbebc83c74dc97770e650580b0321144990d133403bab2bc1de4618cde63dfd4fedfa56b5e4e259b510585db0f7a59042c356356c56bea3ac861d4be5337f

Download Submit
memory/3032-0-0x0000000074021000-0x0000000074022000-memory.dmp

Filesize
4KB

Download
memory/3032-1-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/3032-2-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/3032-6-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/3032-45-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download