Analysis
-
max time kernel
150s -
max time network
35s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
23-09-2021 08:16
Static task
static1
Behavioral task
behavioral1
Sample
a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe
Resource
win7-en-20210920
General
-
Target
a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe
-
Size
520KB
-
MD5
452b72638cf014d97a9b5a219e4685f9
-
SHA1
df7b8e92163dfe5bcfd1f1f8ea832d5c655d457c
-
SHA256
a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf
-
SHA512
a30e2cb3bbe1138bf148dcca0187c366f60b064115820b5848f2f177aafbfd97cc3ed2d301ff3dd53001e46337b97595f7df6a014aa3c3ebc69628f22d03623f
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
winupd.exewinupd.exewinupd.exepid process 1772 winupd.exe 980 winupd.exe 1648 winupd.exe -
Processes:
resource yara_rule behavioral1/memory/1648-73-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1648-85-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exepid process 1632 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe 1632 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\winupd.exe -notray" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exewinupd.exedescription pid process target process PID 1620 set thread context of 1632 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe PID 1772 set thread context of 980 1772 winupd.exe winupd.exe PID 1772 set thread context of 1648 1772 winupd.exe winupd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 984 ipconfig.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
winupd.exedescription pid process Token: SeIncreaseQuotaPrivilege 1648 winupd.exe Token: SeSecurityPrivilege 1648 winupd.exe Token: SeTakeOwnershipPrivilege 1648 winupd.exe Token: SeLoadDriverPrivilege 1648 winupd.exe Token: SeSystemProfilePrivilege 1648 winupd.exe Token: SeSystemtimePrivilege 1648 winupd.exe Token: SeProfSingleProcessPrivilege 1648 winupd.exe Token: SeIncBasePriorityPrivilege 1648 winupd.exe Token: SeCreatePagefilePrivilege 1648 winupd.exe Token: SeBackupPrivilege 1648 winupd.exe Token: SeRestorePrivilege 1648 winupd.exe Token: SeShutdownPrivilege 1648 winupd.exe Token: SeDebugPrivilege 1648 winupd.exe Token: SeSystemEnvironmentPrivilege 1648 winupd.exe Token: SeChangeNotifyPrivilege 1648 winupd.exe Token: SeRemoteShutdownPrivilege 1648 winupd.exe Token: SeUndockPrivilege 1648 winupd.exe Token: SeManageVolumePrivilege 1648 winupd.exe Token: SeImpersonatePrivilege 1648 winupd.exe Token: SeCreateGlobalPrivilege 1648 winupd.exe Token: 33 1648 winupd.exe Token: 34 1648 winupd.exe Token: 35 1648 winupd.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exea7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exewinupd.exewinupd.exewinupd.exepid process 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe 1632 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe 1772 winupd.exe 980 winupd.exe 1648 winupd.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exea7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exewinupd.exewinupd.exeipconfig.execmd.exedescription pid process target process PID 1620 wrote to memory of 1632 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe PID 1620 wrote to memory of 1632 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe PID 1620 wrote to memory of 1632 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe PID 1620 wrote to memory of 1632 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe PID 1620 wrote to memory of 1632 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe PID 1620 wrote to memory of 1632 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe PID 1620 wrote to memory of 1632 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe PID 1620 wrote to memory of 1632 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe PID 1620 wrote to memory of 1632 1620 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe PID 1632 wrote to memory of 1772 1632 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe winupd.exe PID 1632 wrote to memory of 1772 1632 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe winupd.exe PID 1632 wrote to memory of 1772 1632 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe winupd.exe PID 1632 wrote to memory of 1772 1632 a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe winupd.exe PID 1772 wrote to memory of 980 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 980 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 980 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 980 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 980 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 980 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 980 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 980 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 980 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 1648 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 1648 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 1648 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 1648 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 1648 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 1648 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 1648 1772 winupd.exe winupd.exe PID 1772 wrote to memory of 1648 1772 winupd.exe winupd.exe PID 980 wrote to memory of 984 980 winupd.exe ipconfig.exe PID 980 wrote to memory of 984 980 winupd.exe ipconfig.exe PID 980 wrote to memory of 984 980 winupd.exe ipconfig.exe PID 980 wrote to memory of 984 980 winupd.exe ipconfig.exe PID 980 wrote to memory of 984 980 winupd.exe ipconfig.exe PID 980 wrote to memory of 984 980 winupd.exe ipconfig.exe PID 984 wrote to memory of 516 984 ipconfig.exe cmd.exe PID 984 wrote to memory of 516 984 ipconfig.exe cmd.exe PID 984 wrote to memory of 516 984 ipconfig.exe cmd.exe PID 984 wrote to memory of 516 984 ipconfig.exe cmd.exe PID 516 wrote to memory of 1224 516 cmd.exe reg.exe PID 516 wrote to memory of 1224 516 cmd.exe reg.exe PID 516 wrote to memory of 1224 516 cmd.exe reg.exe PID 516 wrote to memory of 1224 516 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe"C:\Users\Admin\AppData\Local\Temp\a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe"C:\Users\Admin\AppData\Local\Temp\a7c4aae68e13b16ed7d916ba7cde189381e597934b05a26d113a97c8ae8afdbf.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeC:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"5⤵
- Gathers network information
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\HVRUXWYK.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray" /f7⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HVRUXWYK.batMD5
cac890d00365d07b9ca89def17cc3a36
SHA16fa99679ede791c16b5d3e6d243a98e8bbdb7eab
SHA2564f98ddee89760080a5c8a93666d2f5c97be52b741265ef4d1ce9aaebf05f12da
SHA512124dc0b18e13425bde43bcbbe2a99005928e398bffcb458d498aac9e754bc5b92b703270667800876c60b0801343f2de8c6b9a1eebafd80bb4f6d5dc295dd9f1
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
da95da82f5320b8ea9e8f22f2393cd5c
SHA17d542043d83cdefd02e77334213fb6c1cbd26946
SHA256a1d3d0dabc414bb238db7a5c60f2eeec42787745f2ed2da23c11808183c60cff
SHA512fb9c073c9648209307f378d11bc1a3248d741d410dd1d012f720e730b5c79a3284d8aa930fb77e2c4ebc2d878a8e67a8072165c7b47ac075bf8713b3b451e607
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
da95da82f5320b8ea9e8f22f2393cd5c
SHA17d542043d83cdefd02e77334213fb6c1cbd26946
SHA256a1d3d0dabc414bb238db7a5c60f2eeec42787745f2ed2da23c11808183c60cff
SHA512fb9c073c9648209307f378d11bc1a3248d741d410dd1d012f720e730b5c79a3284d8aa930fb77e2c4ebc2d878a8e67a8072165c7b47ac075bf8713b3b451e607
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
da95da82f5320b8ea9e8f22f2393cd5c
SHA17d542043d83cdefd02e77334213fb6c1cbd26946
SHA256a1d3d0dabc414bb238db7a5c60f2eeec42787745f2ed2da23c11808183c60cff
SHA512fb9c073c9648209307f378d11bc1a3248d741d410dd1d012f720e730b5c79a3284d8aa930fb77e2c4ebc2d878a8e67a8072165c7b47ac075bf8713b3b451e607
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
da95da82f5320b8ea9e8f22f2393cd5c
SHA17d542043d83cdefd02e77334213fb6c1cbd26946
SHA256a1d3d0dabc414bb238db7a5c60f2eeec42787745f2ed2da23c11808183c60cff
SHA512fb9c073c9648209307f378d11bc1a3248d741d410dd1d012f720e730b5c79a3284d8aa930fb77e2c4ebc2d878a8e67a8072165c7b47ac075bf8713b3b451e607
-
\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
da95da82f5320b8ea9e8f22f2393cd5c
SHA17d542043d83cdefd02e77334213fb6c1cbd26946
SHA256a1d3d0dabc414bb238db7a5c60f2eeec42787745f2ed2da23c11808183c60cff
SHA512fb9c073c9648209307f378d11bc1a3248d741d410dd1d012f720e730b5c79a3284d8aa930fb77e2c4ebc2d878a8e67a8072165c7b47ac075bf8713b3b451e607
-
\Users\Admin\AppData\Roaming\Microsoft\winupd.exeMD5
da95da82f5320b8ea9e8f22f2393cd5c
SHA17d542043d83cdefd02e77334213fb6c1cbd26946
SHA256a1d3d0dabc414bb238db7a5c60f2eeec42787745f2ed2da23c11808183c60cff
SHA512fb9c073c9648209307f378d11bc1a3248d741d410dd1d012f720e730b5c79a3284d8aa930fb77e2c4ebc2d878a8e67a8072165c7b47ac075bf8713b3b451e607
-
memory/516-83-0x0000000000000000-mapping.dmp
-
memory/980-71-0x000000000040140C-mapping.dmp
-
memory/984-80-0x0000000000000000-mapping.dmp
-
memory/1224-84-0x0000000000000000-mapping.dmp
-
memory/1620-67-0x0000000000370000-0x0000000000372000-memory.dmpFilesize
8KB
-
memory/1620-68-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/1620-66-0x00000000002D0000-0x00000000002D2000-memory.dmpFilesize
8KB
-
memory/1632-59-0x0000000076B61000-0x0000000076B63000-memory.dmpFilesize
8KB
-
memory/1632-55-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1632-56-0x000000000040140C-mapping.dmp
-
memory/1648-75-0x00000000004B5670-mapping.dmp
-
memory/1648-73-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1648-86-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1648-85-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1772-62-0x0000000000000000-mapping.dmp