Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-10-2024 20:08
Behavioral task
behavioral1
Sample
2545b47e98ffb00e68912dbedcb8f5db.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2545b47e98ffb00e68912dbedcb8f5db.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
2545b47e98ffb00e68912dbedcb8f5db.exe
-
Size
93KB
-
MD5
2545b47e98ffb00e68912dbedcb8f5db
-
SHA1
0612d0f4417ebb63e52ad1da47db3209e848332a
-
SHA256
18240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4
-
SHA512
d480f7713618938a6239445c4e5ccdbdc1305fa3d45e958d7b4656cee09e792ad5892e18c0c590f2aa9c2e904f00a271fbbb8da5db3d14846a9819ba5cba7788
-
SSDEEP
1536:jwfR8lZc+/2HK1j+fzdljEwzGi1dDaDlgS:jwfKc+/2HK1ozdSi1dMy
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 2836 netsh.exe 2664 netsh.exe 2736 netsh.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32cf646479fb52a6cecce80a3bf8d7deWindows Update.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explore.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe -
Executes dropped EXE 3 IoCs
pid Process 2820 server.exe 2600 StUpdate.exe 924 StUpdate.exe -
Loads dropped DLL 8 IoCs
pid Process 2984 2545b47e98ffb00e68912dbedcb8f5db.exe 2984 2545b47e98ffb00e68912dbedcb8f5db.exe 2600 StUpdate.exe 2600 StUpdate.exe 2600 StUpdate.exe 924 StUpdate.exe 924 StUpdate.exe 924 StUpdate.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 2 5.tcp.eu.ngrok.io 27 5.tcp.eu.ngrok.io 57 5.tcp.eu.ngrok.io -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explore.exe server.exe File opened for modification C:\Windows\SysWOW64\Explore.exe server.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Explore.exe server.exe File created C:\Program Files (x86)\Explore.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2545b47e98ffb00e68912dbedcb8f5db.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2480 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe 2820 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2820 server.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe Token: 33 2820 server.exe Token: SeIncBasePriorityPrivilege 2820 server.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2820 2984 2545b47e98ffb00e68912dbedcb8f5db.exe 30 PID 2984 wrote to memory of 2820 2984 2545b47e98ffb00e68912dbedcb8f5db.exe 30 PID 2984 wrote to memory of 2820 2984 2545b47e98ffb00e68912dbedcb8f5db.exe 30 PID 2984 wrote to memory of 2820 2984 2545b47e98ffb00e68912dbedcb8f5db.exe 30 PID 2820 wrote to memory of 2836 2820 server.exe 31 PID 2820 wrote to memory of 2836 2820 server.exe 31 PID 2820 wrote to memory of 2836 2820 server.exe 31 PID 2820 wrote to memory of 2836 2820 server.exe 31 PID 2820 wrote to memory of 2664 2820 server.exe 33 PID 2820 wrote to memory of 2664 2820 server.exe 33 PID 2820 wrote to memory of 2664 2820 server.exe 33 PID 2820 wrote to memory of 2664 2820 server.exe 33 PID 2820 wrote to memory of 2736 2820 server.exe 35 PID 2820 wrote to memory of 2736 2820 server.exe 35 PID 2820 wrote to memory of 2736 2820 server.exe 35 PID 2820 wrote to memory of 2736 2820 server.exe 35 PID 2820 wrote to memory of 2480 2820 server.exe 37 PID 2820 wrote to memory of 2480 2820 server.exe 37 PID 2820 wrote to memory of 2480 2820 server.exe 37 PID 2820 wrote to memory of 2480 2820 server.exe 37 PID 2708 wrote to memory of 2600 2708 taskeng.exe 41 PID 2708 wrote to memory of 2600 2708 taskeng.exe 41 PID 2708 wrote to memory of 2600 2708 taskeng.exe 41 PID 2708 wrote to memory of 2600 2708 taskeng.exe 41 PID 2708 wrote to memory of 2600 2708 taskeng.exe 41 PID 2708 wrote to memory of 2600 2708 taskeng.exe 41 PID 2708 wrote to memory of 2600 2708 taskeng.exe 41 PID 2708 wrote to memory of 924 2708 taskeng.exe 42 PID 2708 wrote to memory of 924 2708 taskeng.exe 42 PID 2708 wrote to memory of 924 2708 taskeng.exe 42 PID 2708 wrote to memory of 924 2708 taskeng.exe 42 PID 2708 wrote to memory of 924 2708 taskeng.exe 42 PID 2708 wrote to memory of 924 2708 taskeng.exe 42 PID 2708 wrote to memory of 924 2708 taskeng.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\2545b47e98ffb00e68912dbedcb8f5db.exe"C:\Users\Admin\AppData\Local\Temp\2545b47e98ffb00e68912dbedcb8f5db.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2836
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2664
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2480
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A1EBEE7B-3366-4FDC-A03B-44C002904869} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:924
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD52545b47e98ffb00e68912dbedcb8f5db
SHA10612d0f4417ebb63e52ad1da47db3209e848332a
SHA25618240be396f8b7a2a28669dfb20f4fb311daf0b1fd4c1d81df26d7f8419444d4
SHA512d480f7713618938a6239445c4e5ccdbdc1305fa3d45e958d7b4656cee09e792ad5892e18c0c590f2aa9c2e904f00a271fbbb8da5db3d14846a9819ba5cba7788
-
Filesize
4B
MD54d853d9c7197ee7fa81c6535b1f7d655
SHA1eac3d866e991967b385f3dd22da25e410d8f7f49
SHA2565abdb6175f820f0ac3d8647fbb1f7a0bcc91757a782a8a145570944ca6a00c96
SHA512dc5a09d8586eb9f591f6e00187817c19f693e9328a1b2e5838c61c0b234e9608eecc45bbf7f4a90912e9a456d0ab469ed2503bafb4988b276cec8d5f0b18fda7