Analysis
-
max time kernel
207s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04-10-2024 14:21
General
-
Target
MailUpdate.exe
-
Size
93KB
-
MD5
9269b1758a4151f9b49c11967ac76628
-
SHA1
cdb7ede668e9f9b69950e29ca3e05b76daa1c0fc
-
SHA256
abfcae799cbe35f002f71a15bea7e666654effbaa3a736a472beb98addb09c2d
-
SHA512
0644e2fce92204f07172ecc7c36077784688c7c16cd97e121e8a0d3444c0c2507e765cb14b7421055731996de70de97785c518e60c3b4a2903bfc85496aefd32
-
SSDEEP
768:GY3m84BMPdPwchQW6aGro1CRaXPKG548gmKXxrjEtCdnl2pi1Rz4Rk3ssGdpZgS7:s8GMlP6aGrwCCX4ljEwzGi1dDEDZgS
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 51 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MailUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MailUpdate.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5047dda8d29bbbf2b6e1c3f4212189eba
SHA1eb10217bbf887b1ad9b984cb7a559b177e2c762a
SHA256afd43463eba279dc102afa66f3ef7173885c540c02776217638de34e03486125
SHA51284c38a784fa77686de5be91738fffd0371ca667eff0e117c87e8e2d676ef29b7defe21c7bfa83f00ef967d73d3983fb038bd07b93fde963ec5ae10a2f569a822
-
Filesize
93KB
MD59269b1758a4151f9b49c11967ac76628
SHA1cdb7ede668e9f9b69950e29ca3e05b76daa1c0fc
SHA256abfcae799cbe35f002f71a15bea7e666654effbaa3a736a472beb98addb09c2d
SHA5120644e2fce92204f07172ecc7c36077784688c7c16cd97e121e8a0d3444c0c2507e765cb14b7421055731996de70de97785c518e60c3b4a2903bfc85496aefd32
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB