Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-11-2024 18:43
General
-
Target
Umbrella.flv.exe
-
Size
93KB
-
MD5
9c8cfc8027b21ff03525c1880ed347c1
-
SHA1
3565ba9d14ab917ed66625a968bef184089e3c32
-
SHA256
76231f72576c98527990b748706fd506d2fed084d12ebdc7b4e7952d1859e236
-
SHA512
dbc67bc5c71bc69010db8fa4d94e574f6b804216236b77af35d0f493230d5049716ed28a25256790ecfec8b33c02ad7f6b57c664c35d1b7dec899495eb089aac
-
SSDEEP
768:mHY3Oxqctib5nkPQW63m/HsqmGzh+IxvXnKN2tfKkXxrjEtCdnl2pi1Rz4Rk3+ir:ox3iFqHsJE4I15tTjEwzGi1dDPDbgS
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Drops startup file 4 IoCs
-
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe"C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe"1⤵
- Drops startup file
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe" "Umbrella.flv.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD59c8cfc8027b21ff03525c1880ed347c1
SHA13565ba9d14ab917ed66625a968bef184089e3c32
SHA25676231f72576c98527990b748706fd506d2fed084d12ebdc7b4e7952d1859e236
SHA512dbc67bc5c71bc69010db8fa4d94e574f6b804216236b77af35d0f493230d5049716ed28a25256790ecfec8b33c02ad7f6b57c664c35d1b7dec899495eb089aac
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB