dee23e85d531e80655457b017752bb99378ba91819e5a85ccf9343a1094a1a4c

General

Target

Server.exe
Size

93KB
MD5

77569c49188ab04b3ed8fef0dfbef2cf
SHA1

413db869e07385a42e1f9a1209822fa41ec8cf8a
SHA256

dee23e85d531e80655457b017752bb99378ba91819e5a85ccf9343a1094a1a4c
SHA512

ea2b7c6e94f0559f9d1ac48f797e4fe40849e531088cb4a145247d6ad9da9488f2ce1acf0f7384ecf7df8fb5165470919de75e12cd2bf554d47cde14853ffe2a
SSDEEP

1536:RGbJD/HBZbszKu9AZpd7r1jEwzGi1dD3DEgS:RGqzK4AZ3HCi1dn9

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Modifies Windows Firewall 2 TTPs 6 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

2616 netsh.exe
2916 netsh.exe
2936 netsh.exe
1708 netsh.exe
2328 netsh.exe
1980 netsh.exe
Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2420 svchost.exe

pid	process
2616	netsh.exe
2916	netsh.exe
2936	netsh.exe
1708	netsh.exe
2328	netsh.exe
1980	netsh.exe

pid	process
2420	svchost.exe

Drops startup file 6 IoCs

Processes:

svchost.exeServer.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	svchost.exe

Executes dropped EXE 3 IoCs

Processes:

svchost.exeStUpdate.exeStUpdate.exe

pid process

2420 svchost.exe
1824 StUpdate.exe
896 StUpdate.exe
Loads dropped DLL 8 IoCs

Processes:

Server.exeStUpdate.exeStUpdate.exe

pid process

472 Server.exe
472 Server.exe
1824 StUpdate.exe
1824 StUpdate.exe
1824 StUpdate.exe
896 StUpdate.exe
896 StUpdate.exe
896 StUpdate.exe

pid	process
2420	svchost.exe
1824	StUpdate.exe
896	StUpdate.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

Server.exe

description	ioc	process
File opened for modification	C:\autorun.inf	Server.exe
File created	F:\autorun.inf	Server.exe
File opened for modification	F:\autorun.inf	Server.exe
File created	C:\autorun.inf	Server.exe

Drops file in System32 directory 3 IoCs

Processes:

Server.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Explower.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\Explower.exe	svchost.exe
File created	C:\Windows\SysWOW64\Explower.exe	Server.exe

Drops file in Program Files directory 3 IoCs

Processes:

svchost.exeServer.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Explower.exe	svchost.exe
File created	C:\Program Files (x86)\Explower.exe	Server.exe
File opened for modification	C:\Program Files (x86)\Explower.exe	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

netsh.exenetsh.exenetsh.exesvchost.exenetsh.exeStUpdate.exeServer.exenetsh.exenetsh.exeschtasks.exeStUpdate.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1932 schtasks.exe

pid	process
1932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Server.exe

pid	process
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe
472	Server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svchost.exe

pid process

2420 svchost.exe

pid	process
2420	svchost.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

Processes:

Server.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	472	Server.exe
Token: SeDebugPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe
Token: 33	2420	svchost.exe
Token: SeIncBasePriorityPrivilege	2420	svchost.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

Server.exesvchost.exetaskeng.exe

description	pid	process	target process
PID 472 wrote to memory of 2616	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2616	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2616	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2616	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2916	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2916	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2916	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2916	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2936	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2936	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2936	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2936	472	Server.exe	netsh.exe
PID 472 wrote to memory of 2420	472	Server.exe	svchost.exe
PID 472 wrote to memory of 2420	472	Server.exe	svchost.exe
PID 472 wrote to memory of 2420	472	Server.exe	svchost.exe
PID 472 wrote to memory of 2420	472	Server.exe	svchost.exe
PID 2420 wrote to memory of 1708	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 1708	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 1708	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 1708	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 2328	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 2328	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 2328	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 2328	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 1980	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 1980	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 1980	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 1980	2420	svchost.exe	netsh.exe
PID 2420 wrote to memory of 1932	2420	svchost.exe	schtasks.exe
PID 2420 wrote to memory of 1932	2420	svchost.exe	schtasks.exe
PID 2420 wrote to memory of 1932	2420	svchost.exe	schtasks.exe
PID 2420 wrote to memory of 1932	2420	svchost.exe	schtasks.exe
PID 1088 wrote to memory of 1824	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 1824	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 1824	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 1824	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 1824	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 1824	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 1824	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 896	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 896	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 896	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 896	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 896	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 896	1088	taskeng.exe	StUpdate.exe
PID 1088 wrote to memory of 896	1088	taskeng.exe	StUpdate.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2616
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2916
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2936
- C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
  2⤵
  - Deletes itself
  - Drops startup file
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1708
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2328
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1932

C:\Windows\system32\taskeng.exe
taskeng.exe {35376BD2-8519-4B3F-A5D2-933B3FFFA318} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
  C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1824
- C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
  C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\melt.txt

Filesize
44B

MD5
5389b11510f65424863e2e9724bd65e4

SHA1
071102005e3217b50283b71ee33858bb15606549

SHA256
fecb0cdb9664c0c83a84dff897fecff3773df1d4d5a6fc5c84e2187027315fa7

SHA512
ba78a6c2619bd7a4d4428a5b0b739e109dfa9ddb8925a005067f8b7091744bd9e16e007d32f62ae42768f3f45fb8aefe496f5a3ef617862127b53a88f86514ff

Download Submit
C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
69cf10399d0d1350c3698099796624cb

SHA1
d0b58b76ff065f51172971853a7da414286d9ea7

SHA256
a7bff94c7cdef50b67a3bab142ebcec4d360491e339581c41f433fec6d002f48

SHA512
5e1c9745b2b529c026e51fbff7fd4e1e0bd208c705b7da830459758d28c01b32b9bc93caa7ad60228d3e785784023d8a739fda0dab62d3c76770ea84c257f1f7

Download Submit
F:\Umbrella.flv.exe

Filesize
93KB

MD5
77569c49188ab04b3ed8fef0dfbef2cf

SHA1
413db869e07385a42e1f9a1209822fa41ec8cf8a

SHA256
dee23e85d531e80655457b017752bb99378ba91819e5a85ccf9343a1094a1a4c

SHA512
ea2b7c6e94f0559f9d1ac48f797e4fe40849e531088cb4a145247d6ad9da9488f2ce1acf0f7384ecf7df8fb5165470919de75e12cd2bf554d47cde14853ffe2a

Download Submit
memory/472-0-0x0000000074C71000-0x0000000074C72000-memory.dmp

Filesize
4KB

Download
memory/472-1-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/472-2-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/472-48-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads