Analysis
-
max time kernel
149s -
max time network
86s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:58
Static task
static1
Behavioral task
behavioral1
Sample
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe
Resource
win10v2004-20220414-en
General
-
Target
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe
-
Size
389KB
-
MD5
01960910f4cc1692918f0643ac14dc3b
-
SHA1
f87f85850f233d55b6ce411591d62efeeb4d2d74
-
SHA256
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3
-
SHA512
aad4bf6c0e4bc245d5c3e1c07d930d54b976e2caebbfa392eceb0768424564dc925d953f32b169c927501edaad53adf25537a75e8002d1bb00b445fe4caf7c07
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
DefenderUpdateAnalyse.exeDefenderUpdateAnalyse.exepid process 1852 DefenderUpdateAnalyse.exe 1768 DefenderUpdateAnalyse.exe -
Drops startup file 2 IoCs
Processes:
DefenderUpdateAnalyse.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe -
Loads dropped DLL 2 IoCs
Processes:
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exeDefenderUpdateAnalyse.exepid process 2000 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 1852 DefenderUpdateAnalyse.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1092-57-0x0000000000300000-0x000000000030C000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
DefenderUpdateAnalyse.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\DefenderUpdateAnalyse.exe = "\"C:\\ProgramData\\DefenderUpdateAnalyse.exe\" .." DefenderUpdateAnalyse.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DefenderUpdateAnalyse.exe = "\"C:\\ProgramData\\DefenderUpdateAnalyse.exe\" .." DefenderUpdateAnalyse.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exeDefenderUpdateAnalyse.exedescription pid process target process PID 1092 set thread context of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 1852 set thread context of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exeDefenderUpdateAnalyse.exeDefenderUpdateAnalyse.exedescription pid process Token: SeDebugPrivilege 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe Token: 33 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe Token: SeIncBasePriorityPrivilege 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe Token: SeDebugPrivilege 1852 DefenderUpdateAnalyse.exe Token: 33 1852 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 1852 DefenderUpdateAnalyse.exe Token: SeDebugPrivilege 1768 DefenderUpdateAnalyse.exe Token: 33 1768 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 1768 DefenderUpdateAnalyse.exe Token: 33 1768 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 1768 DefenderUpdateAnalyse.exe Token: 33 1768 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 1768 DefenderUpdateAnalyse.exe Token: 33 1768 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 1768 DefenderUpdateAnalyse.exe Token: 33 1768 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 1768 DefenderUpdateAnalyse.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exeDefenderUpdateAnalyse.exedescription pid process target process PID 1092 wrote to memory of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 1092 wrote to memory of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 1092 wrote to memory of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 1092 wrote to memory of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 1092 wrote to memory of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 1092 wrote to memory of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 1092 wrote to memory of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 1092 wrote to memory of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 1092 wrote to memory of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 1092 wrote to memory of 2000 1092 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 2000 wrote to memory of 1852 2000 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe DefenderUpdateAnalyse.exe PID 2000 wrote to memory of 1852 2000 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe DefenderUpdateAnalyse.exe PID 2000 wrote to memory of 1852 2000 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe DefenderUpdateAnalyse.exe PID 2000 wrote to memory of 1852 2000 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe DefenderUpdateAnalyse.exe PID 2000 wrote to memory of 1852 2000 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe DefenderUpdateAnalyse.exe PID 2000 wrote to memory of 1852 2000 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe DefenderUpdateAnalyse.exe PID 2000 wrote to memory of 1852 2000 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 1852 wrote to memory of 1768 1852 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe"C:\Users\Admin\AppData\Local\Temp\2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exeC:\Users\Admin\AppData\Local\Temp\2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\DefenderUpdateAnalyse.exe"C:\ProgramData\DefenderUpdateAnalyse.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\DefenderUpdateAnalyse.exeC:\ProgramData\DefenderUpdateAnalyse.exe4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\DefenderUpdateAnalyse.exeFilesize
389KB
MD501960910f4cc1692918f0643ac14dc3b
SHA1f87f85850f233d55b6ce411591d62efeeb4d2d74
SHA2562a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3
SHA512aad4bf6c0e4bc245d5c3e1c07d930d54b976e2caebbfa392eceb0768424564dc925d953f32b169c927501edaad53adf25537a75e8002d1bb00b445fe4caf7c07
-
C:\ProgramData\DefenderUpdateAnalyse.exeFilesize
389KB
MD501960910f4cc1692918f0643ac14dc3b
SHA1f87f85850f233d55b6ce411591d62efeeb4d2d74
SHA2562a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3
SHA512aad4bf6c0e4bc245d5c3e1c07d930d54b976e2caebbfa392eceb0768424564dc925d953f32b169c927501edaad53adf25537a75e8002d1bb00b445fe4caf7c07
-
C:\ProgramData\DefenderUpdateAnalyse.exeFilesize
389KB
MD501960910f4cc1692918f0643ac14dc3b
SHA1f87f85850f233d55b6ce411591d62efeeb4d2d74
SHA2562a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3
SHA512aad4bf6c0e4bc245d5c3e1c07d930d54b976e2caebbfa392eceb0768424564dc925d953f32b169c927501edaad53adf25537a75e8002d1bb00b445fe4caf7c07
-
\ProgramData\DefenderUpdateAnalyse.exeFilesize
389KB
MD501960910f4cc1692918f0643ac14dc3b
SHA1f87f85850f233d55b6ce411591d62efeeb4d2d74
SHA2562a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3
SHA512aad4bf6c0e4bc245d5c3e1c07d930d54b976e2caebbfa392eceb0768424564dc925d953f32b169c927501edaad53adf25537a75e8002d1bb00b445fe4caf7c07
-
\ProgramData\DefenderUpdateAnalyse.exeFilesize
389KB
MD501960910f4cc1692918f0643ac14dc3b
SHA1f87f85850f233d55b6ce411591d62efeeb4d2d74
SHA2562a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3
SHA512aad4bf6c0e4bc245d5c3e1c07d930d54b976e2caebbfa392eceb0768424564dc925d953f32b169c927501edaad53adf25537a75e8002d1bb00b445fe4caf7c07
-
memory/1092-54-0x0000000000F80000-0x0000000000FEC000-memory.dmpFilesize
432KB
-
memory/1092-55-0x0000000000230000-0x0000000000266000-memory.dmpFilesize
216KB
-
memory/1092-56-0x0000000000A30000-0x0000000000A58000-memory.dmpFilesize
160KB
-
memory/1092-57-0x0000000000300000-0x000000000030C000-memory.dmpFilesize
48KB
-
memory/1768-362-0x000000000042A5DE-mapping.dmp
-
memory/1852-353-0x0000000000230000-0x000000000029C000-memory.dmpFilesize
432KB
-
memory/1852-350-0x0000000000000000-mapping.dmp
-
memory/2000-89-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-103-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-73-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-75-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-77-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-79-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-81-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-83-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-85-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-87-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-69-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-91-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-93-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-95-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-97-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-99-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-101-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-71-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-105-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-107-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-109-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-111-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-113-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-115-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-117-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-119-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-121-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-67-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-64-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-65-0x000000000042A5DE-mapping.dmp
-
memory/2000-63-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-62-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-61-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-59-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2000-58-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB