68f0121f2062aede8ae8bd52bba3c4c6c8aa19bdf32958b4e305cf716a92cc3d

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

856.exe
Size

93KB
MD5

68edafe0a1705d5c7dd1cb14fa1ca8ce
SHA1

7e9d854c90acd7452645506874c4e6f10bfdda31
SHA256

68f0121f2062aede8ae8bd52bba3c4c6c8aa19bdf32958b4e305cf716a92cc3d
SHA512

89a965f783ea7f54b55a542168ff759e851eae77cdfa9e23ba76145614b798f0815f2feb8670c16f26943e83bba2ade0649d6dc83af8d87c51c42f96d015573d
SSDEEP

768:JY37KBD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3WsG3:kKzOx6baIa9RIj00ljEwzGi1dDSD7gS

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 6 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2772	netsh.exe
1984	netsh.exe
2240	netsh.exe
2332	netsh.exe
3004	netsh.exe
2924	netsh.exe

Deletes itself 1 IoCs

pid	Process
2908	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
2908	svchost.exe
2696	StUpdate.exe
3032	StUpdate.exe

Loads dropped DLL 8 IoCs

pid	Process
2076	856.exe
2076	856.exe
2696	StUpdate.exe
2696	StUpdate.exe
2696	StUpdate.exe
3032	StUpdate.exe
3032	StUpdate.exe
3032	StUpdate.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	856.exe
File opened for modification	C:\autorun.inf	856.exe
File created	F:\autorun.inf	856.exe
File opened for modification	F:\autorun.inf	856.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe
2076	856.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	svchost.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	856.exe
Token: SeDebugPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe
Token: 33	2908	svchost.exe
Token: SeIncBasePriorityPrivilege	2908	svchost.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2332	2076	856.exe	30
PID 2076 wrote to memory of 2332	2076	856.exe	30
PID 2076 wrote to memory of 2332	2076	856.exe	30
PID 2076 wrote to memory of 2332	2076	856.exe	30
PID 2076 wrote to memory of 3004	2076	856.exe	32
PID 2076 wrote to memory of 3004	2076	856.exe	32
PID 2076 wrote to memory of 3004	2076	856.exe	32
PID 2076 wrote to memory of 3004	2076	856.exe	32
PID 2076 wrote to memory of 2924	2076	856.exe	33
PID 2076 wrote to memory of 2924	2076	856.exe	33
PID 2076 wrote to memory of 2924	2076	856.exe	33
PID 2076 wrote to memory of 2924	2076	856.exe	33
PID 2076 wrote to memory of 2908	2076	856.exe	35
PID 2076 wrote to memory of 2908	2076	856.exe	35
PID 2076 wrote to memory of 2908	2076	856.exe	35
PID 2076 wrote to memory of 2908	2076	856.exe	35
PID 2908 wrote to memory of 2772	2908	svchost.exe	37
PID 2908 wrote to memory of 2772	2908	svchost.exe	37
PID 2908 wrote to memory of 2772	2908	svchost.exe	37
PID 2908 wrote to memory of 2772	2908	svchost.exe	37
PID 2908 wrote to memory of 1984	2908	svchost.exe	39
PID 2908 wrote to memory of 1984	2908	svchost.exe	39
PID 2908 wrote to memory of 1984	2908	svchost.exe	39
PID 2908 wrote to memory of 1984	2908	svchost.exe	39
PID 2908 wrote to memory of 2240	2908	svchost.exe	40
PID 2908 wrote to memory of 2240	2908	svchost.exe	40
PID 2908 wrote to memory of 2240	2908	svchost.exe	40
PID 2908 wrote to memory of 2240	2908	svchost.exe	40
PID 2908 wrote to memory of 1452	2908	svchost.exe	42
PID 2908 wrote to memory of 1452	2908	svchost.exe	42
PID 2908 wrote to memory of 1452	2908	svchost.exe	42
PID 2908 wrote to memory of 1452	2908	svchost.exe	42
PID 2956 wrote to memory of 2696	2956	taskeng.exe	47
PID 2956 wrote to memory of 2696	2956	taskeng.exe	47
PID 2956 wrote to memory of 2696	2956	taskeng.exe	47
PID 2956 wrote to memory of 2696	2956	taskeng.exe	47
PID 2956 wrote to memory of 2696	2956	taskeng.exe	47
PID 2956 wrote to memory of 2696	2956	taskeng.exe	47
PID 2956 wrote to memory of 2696	2956	taskeng.exe	47
PID 2956 wrote to memory of 3032	2956	taskeng.exe	48
PID 2956 wrote to memory of 3032	2956	taskeng.exe	48
PID 2956 wrote to memory of 3032	2956	taskeng.exe	48
PID 2956 wrote to memory of 3032	2956	taskeng.exe	48
PID 2956 wrote to memory of 3032	2956	taskeng.exe	48
PID 2956 wrote to memory of 3032	2956	taskeng.exe	48
PID 2956 wrote to memory of 3032	2956	taskeng.exe	48

C:\Users\Admin\AppData\Local\Temp\856.exe
"C:\Users\Admin\AppData\Local\Temp\856.exe"
1⤵
- Loads dropped DLL
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\856.exe" "856.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2332
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\856.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3004
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\856.exe" "856.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2924
- C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2772
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1984
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1452

C:\Windows\system32\taskeng.exe
taskeng.exe {AA58B8F4-15FB-459B-AB02-936FADFB0EE6} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
  C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
  C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\melt.txt

Filesize
41B

MD5
0580ef82887ddb617447665767b975f5

SHA1
59c488ecd971acd211cf0d52c4145fd40400084e

SHA256
c2bf58aabc76d5eba56eb181eab151fe31848c74a223efaf2e340b3f95899b64

SHA512
dbb81a1059d02fd7907b36d28cef121ec65c02f824347ec2190be728d260ff71faf9d18dd12d09456d17d8374f81f212c92dbc97001cb53be7c2094f2fb85eee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe

Filesize
93KB

MD5
68edafe0a1705d5c7dd1cb14fa1ca8ce

SHA1
7e9d854c90acd7452645506874c4e6f10bfdda31

SHA256
68f0121f2062aede8ae8bd52bba3c4c6c8aa19bdf32958b4e305cf716a92cc3d

SHA512
89a965f783ea7f54b55a542168ff759e851eae77cdfa9e23ba76145614b798f0815f2feb8670c16f26943e83bba2ade0649d6dc83af8d87c51c42f96d015573d

Download Submit
C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
02b81b0cbe1faaa1fa62d5fc876ab443

SHA1
d473cfe21fb1f188689415b0bdd239688f8fddd9

SHA256
e7e9e2c247bc872bacce77661c78f001a17d70ee3130a9016a5818da9da00cdb

SHA512
592ab5b200d4c560951cb70288dc1b7a562f0cbfaee01ce03076b6934d537b88575c2e1e0fedcc05db95e6c224ca739923e7d74f9165e683f3fbad7bbf641784

Download Submit
memory/2076-0-0x0000000074991000-0x0000000074992000-memory.dmp

Filesize
4KB

Download
memory/2076-1-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2076-2-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2076-23-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2908-25-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2908-24-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2908-31-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2908-30-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2908-32-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download