Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
22-09-2021 13:23
Static task
static1
Behavioral task
behavioral1
Sample
5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe
Resource
win7-en-20210920
General
-
Target
5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe
-
Size
520KB
-
MD5
987a5d029c5c923724872bc013ba8eca
-
SHA1
97c2b943c9cd1625c273652f831860a72427bb5b
-
SHA256
5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea
-
SHA512
bdccf49488488b67025a2c8a4d48c4ca9180ac93c5e3b3564d0e25cf0fc895c5296d08cee8febf825de5af37c44032fe7bfd094ec0994628acad19a0f129619d
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
winupd.exewinupd.exewinupd.exepid process 956 winupd.exe 768 winupd.exe 964 winupd.exe -
Processes:
resource yara_rule behavioral1/memory/964-73-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/964-83-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exepid process 1772 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 1772 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\winupd.exe -notray" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exewinupd.exedescription pid process target process PID 1340 set thread context of 1772 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe PID 956 set thread context of 768 956 winupd.exe winupd.exe PID 956 set thread context of 964 956 winupd.exe winupd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 596 ipconfig.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
winupd.exedescription pid process Token: SeIncreaseQuotaPrivilege 964 winupd.exe Token: SeSecurityPrivilege 964 winupd.exe Token: SeTakeOwnershipPrivilege 964 winupd.exe Token: SeLoadDriverPrivilege 964 winupd.exe Token: SeSystemProfilePrivilege 964 winupd.exe Token: SeSystemtimePrivilege 964 winupd.exe Token: SeProfSingleProcessPrivilege 964 winupd.exe Token: SeIncBasePriorityPrivilege 964 winupd.exe Token: SeCreatePagefilePrivilege 964 winupd.exe Token: SeBackupPrivilege 964 winupd.exe Token: SeRestorePrivilege 964 winupd.exe Token: SeShutdownPrivilege 964 winupd.exe Token: SeDebugPrivilege 964 winupd.exe Token: SeSystemEnvironmentPrivilege 964 winupd.exe Token: SeChangeNotifyPrivilege 964 winupd.exe Token: SeRemoteShutdownPrivilege 964 winupd.exe Token: SeUndockPrivilege 964 winupd.exe Token: SeManageVolumePrivilege 964 winupd.exe Token: SeImpersonatePrivilege 964 winupd.exe Token: SeCreateGlobalPrivilege 964 winupd.exe Token: 33 964 winupd.exe Token: 34 964 winupd.exe Token: 35 964 winupd.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exewinupd.exewinupd.exewinupd.exepid process 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 1772 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 956 winupd.exe 768 winupd.exe 964 winupd.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exewinupd.exewinupd.exeipconfig.execmd.exedescription pid process target process PID 1340 wrote to memory of 1772 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe PID 1340 wrote to memory of 1772 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe PID 1340 wrote to memory of 1772 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe PID 1340 wrote to memory of 1772 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe PID 1340 wrote to memory of 1772 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe PID 1340 wrote to memory of 1772 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe PID 1340 wrote to memory of 1772 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe PID 1340 wrote to memory of 1772 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe PID 1340 wrote to memory of 1772 1340 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe PID 1772 wrote to memory of 956 1772 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe winupd.exe PID 1772 wrote to memory of 956 1772 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe winupd.exe PID 1772 wrote to memory of 956 1772 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe winupd.exe PID 1772 wrote to memory of 956 1772 5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe winupd.exe PID 956 wrote to memory of 768 956 winupd.exe winupd.exe PID 956 wrote to memory of 768 956 winupd.exe winupd.exe PID 956 wrote to memory of 768 956 winupd.exe winupd.exe PID 956 wrote to memory of 768 956 winupd.exe winupd.exe PID 956 wrote to memory of 768 956 winupd.exe winupd.exe PID 956 wrote to memory of 768 956 winupd.exe winupd.exe PID 956 wrote to memory of 768 956 winupd.exe winupd.exe PID 956 wrote to memory of 768 956 winupd.exe winupd.exe PID 956 wrote to memory of 768 956 winupd.exe winupd.exe PID 956 wrote to memory of 964 956 winupd.exe winupd.exe PID 956 wrote to memory of 964 956 winupd.exe winupd.exe PID 956 wrote to memory of 964 956 winupd.exe winupd.exe PID 956 wrote to memory of 964 956 winupd.exe winupd.exe PID 956 wrote to memory of 964 956 winupd.exe winupd.exe PID 956 wrote to memory of 964 956 winupd.exe winupd.exe PID 956 wrote to memory of 964 956 winupd.exe winupd.exe PID 956 wrote to memory of 964 956 winupd.exe winupd.exe PID 768 wrote to memory of 596 768 winupd.exe ipconfig.exe PID 768 wrote to memory of 596 768 winupd.exe ipconfig.exe PID 768 wrote to memory of 596 768 winupd.exe ipconfig.exe PID 768 wrote to memory of 596 768 winupd.exe ipconfig.exe PID 768 wrote to memory of 596 768 winupd.exe ipconfig.exe PID 768 wrote to memory of 596 768 winupd.exe ipconfig.exe PID 596 wrote to memory of 640 596 ipconfig.exe cmd.exe PID 596 wrote to memory of 640 596 ipconfig.exe cmd.exe PID 596 wrote to memory of 640 596 ipconfig.exe cmd.exe PID 596 wrote to memory of 640 596 ipconfig.exe cmd.exe PID 640 wrote to memory of 1820 640 cmd.exe reg.exe PID 640 wrote to memory of 1820 640 cmd.exe reg.exe PID 640 wrote to memory of 1820 640 cmd.exe reg.exe PID 640 wrote to memory of 1820 640 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe"C:\Users\Admin\AppData\Local\Temp\5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe"C:\Users\Admin\AppData\Local\Temp\5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeC:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"5⤵
- Gathers network information
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CLYUDXNR.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray" /f7⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CLYUDXNR.batMD5
cac890d00365d07b9ca89def17cc3a36
SHA16fa99679ede791c16b5d3e6d243a98e8bbdb7eab
SHA2564f98ddee89760080a5c8a93666d2f5c97be52b741265ef4d1ce9aaebf05f12da
SHA512124dc0b18e13425bde43bcbbe2a99005928e398bffcb458d498aac9e754bc5b92b703270667800876c60b0801343f2de8c6b9a1eebafd80bb4f6d5dc295dd9f1
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
21604cb0a09b739713f607caa8c2abd4
SHA193cac5d8297652ad369bc7152cb9b0c782e3ceb3
SHA25618e1ca3ae0d25972580fa8e23d32fe0348fbcb7de007dfe03f8af8f40276e9a3
SHA5129d82d1b2ea6b1663a433b35f13a4b75644dae705ce3bace4a278dd415a9a512f5a8b6f665f6e926cc1bbbe35f82c996c5940a0f96ee4ed5aa72b1483cb5ca019
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
21604cb0a09b739713f607caa8c2abd4
SHA193cac5d8297652ad369bc7152cb9b0c782e3ceb3
SHA25618e1ca3ae0d25972580fa8e23d32fe0348fbcb7de007dfe03f8af8f40276e9a3
SHA5129d82d1b2ea6b1663a433b35f13a4b75644dae705ce3bace4a278dd415a9a512f5a8b6f665f6e926cc1bbbe35f82c996c5940a0f96ee4ed5aa72b1483cb5ca019
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
21604cb0a09b739713f607caa8c2abd4
SHA193cac5d8297652ad369bc7152cb9b0c782e3ceb3
SHA25618e1ca3ae0d25972580fa8e23d32fe0348fbcb7de007dfe03f8af8f40276e9a3
SHA5129d82d1b2ea6b1663a433b35f13a4b75644dae705ce3bace4a278dd415a9a512f5a8b6f665f6e926cc1bbbe35f82c996c5940a0f96ee4ed5aa72b1483cb5ca019
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
21604cb0a09b739713f607caa8c2abd4
SHA193cac5d8297652ad369bc7152cb9b0c782e3ceb3
SHA25618e1ca3ae0d25972580fa8e23d32fe0348fbcb7de007dfe03f8af8f40276e9a3
SHA5129d82d1b2ea6b1663a433b35f13a4b75644dae705ce3bace4a278dd415a9a512f5a8b6f665f6e926cc1bbbe35f82c996c5940a0f96ee4ed5aa72b1483cb5ca019
-
\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
21604cb0a09b739713f607caa8c2abd4
SHA193cac5d8297652ad369bc7152cb9b0c782e3ceb3
SHA25618e1ca3ae0d25972580fa8e23d32fe0348fbcb7de007dfe03f8af8f40276e9a3
SHA5129d82d1b2ea6b1663a433b35f13a4b75644dae705ce3bace4a278dd415a9a512f5a8b6f665f6e926cc1bbbe35f82c996c5940a0f96ee4ed5aa72b1483cb5ca019
-
\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
21604cb0a09b739713f607caa8c2abd4
SHA193cac5d8297652ad369bc7152cb9b0c782e3ceb3
SHA25618e1ca3ae0d25972580fa8e23d32fe0348fbcb7de007dfe03f8af8f40276e9a3
SHA5129d82d1b2ea6b1663a433b35f13a4b75644dae705ce3bace4a278dd415a9a512f5a8b6f665f6e926cc1bbbe35f82c996c5940a0f96ee4ed5aa72b1483cb5ca019
-
memory/596-80-0x0000000000000000-mapping.dmp
-
memory/640-85-0x0000000000000000-mapping.dmp
-
memory/768-71-0x000000000040140C-mapping.dmp
-
memory/956-62-0x0000000000000000-mapping.dmp
-
memory/964-74-0x00000000004B5670-mapping.dmp
-
memory/964-73-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/964-83-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/964-84-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1340-68-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1340-67-0x00000000005A0000-0x00000000005A2000-memory.dmpFilesize
8KB
-
memory/1340-66-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/1772-59-0x0000000075331000-0x0000000075333000-memory.dmpFilesize
8KB
-
memory/1772-55-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1772-56-0x000000000040140C-mapping.dmp
-
memory/1820-86-0x0000000000000000-mapping.dmp