Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 18:58
Static task
static1
Behavioral task
behavioral1
Sample
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe
Resource
win10v2004-20220414-en
General
-
Target
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe
-
Size
389KB
-
MD5
01960910f4cc1692918f0643ac14dc3b
-
SHA1
f87f85850f233d55b6ce411591d62efeeb4d2d74
-
SHA256
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3
-
SHA512
aad4bf6c0e4bc245d5c3e1c07d930d54b976e2caebbfa392eceb0768424564dc925d953f32b169c927501edaad53adf25537a75e8002d1bb00b445fe4caf7c07
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
DefenderUpdateAnalyse.exeDefenderUpdateAnalyse.exepid process 3544 DefenderUpdateAnalyse.exe 5112 DefenderUpdateAnalyse.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe -
Drops startup file 2 IoCs
Processes:
DefenderUpdateAnalyse.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
DefenderUpdateAnalyse.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DefenderUpdateAnalyse.exe = "\"C:\\ProgramData\\DefenderUpdateAnalyse.exe\" .." DefenderUpdateAnalyse.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DefenderUpdateAnalyse.exe = "\"C:\\ProgramData\\DefenderUpdateAnalyse.exe\" .." DefenderUpdateAnalyse.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exeDefenderUpdateAnalyse.exedescription pid process target process PID 2888 set thread context of 3468 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 3544 set thread context of 5112 3544 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exeDefenderUpdateAnalyse.exeDefenderUpdateAnalyse.exedescription pid process Token: SeDebugPrivilege 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe Token: 33 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe Token: SeIncBasePriorityPrivilege 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe Token: SeDebugPrivilege 3544 DefenderUpdateAnalyse.exe Token: 33 3544 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 3544 DefenderUpdateAnalyse.exe Token: SeDebugPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe Token: 33 5112 DefenderUpdateAnalyse.exe Token: SeIncBasePriorityPrivilege 5112 DefenderUpdateAnalyse.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exeDefenderUpdateAnalyse.exedescription pid process target process PID 2888 wrote to memory of 3468 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 2888 wrote to memory of 3468 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 2888 wrote to memory of 3468 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 2888 wrote to memory of 3468 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 2888 wrote to memory of 3468 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 2888 wrote to memory of 3468 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 2888 wrote to memory of 3468 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 2888 wrote to memory of 3468 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 2888 wrote to memory of 3468 2888 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe PID 3468 wrote to memory of 3544 3468 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe DefenderUpdateAnalyse.exe PID 3468 wrote to memory of 3544 3468 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe DefenderUpdateAnalyse.exe PID 3468 wrote to memory of 3544 3468 2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe DefenderUpdateAnalyse.exe PID 3544 wrote to memory of 5112 3544 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 3544 wrote to memory of 5112 3544 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 3544 wrote to memory of 5112 3544 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 3544 wrote to memory of 5112 3544 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 3544 wrote to memory of 5112 3544 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 3544 wrote to memory of 5112 3544 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 3544 wrote to memory of 5112 3544 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 3544 wrote to memory of 5112 3544 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe PID 3544 wrote to memory of 5112 3544 DefenderUpdateAnalyse.exe DefenderUpdateAnalyse.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe"C:\Users\Admin\AppData\Local\Temp\2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exeC:\Users\Admin\AppData\Local\Temp\2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\DefenderUpdateAnalyse.exe"C:\ProgramData\DefenderUpdateAnalyse.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\DefenderUpdateAnalyse.exeC:\ProgramData\DefenderUpdateAnalyse.exe4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\DefenderUpdateAnalyse.exeFilesize
389KB
MD501960910f4cc1692918f0643ac14dc3b
SHA1f87f85850f233d55b6ce411591d62efeeb4d2d74
SHA2562a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3
SHA512aad4bf6c0e4bc245d5c3e1c07d930d54b976e2caebbfa392eceb0768424564dc925d953f32b169c927501edaad53adf25537a75e8002d1bb00b445fe4caf7c07
-
C:\ProgramData\DefenderUpdateAnalyse.exeFilesize
389KB
MD501960910f4cc1692918f0643ac14dc3b
SHA1f87f85850f233d55b6ce411591d62efeeb4d2d74
SHA2562a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3
SHA512aad4bf6c0e4bc245d5c3e1c07d930d54b976e2caebbfa392eceb0768424564dc925d953f32b169c927501edaad53adf25537a75e8002d1bb00b445fe4caf7c07
-
C:\ProgramData\DefenderUpdateAnalyse.exeFilesize
389KB
MD501960910f4cc1692918f0643ac14dc3b
SHA1f87f85850f233d55b6ce411591d62efeeb4d2d74
SHA2562a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3
SHA512aad4bf6c0e4bc245d5c3e1c07d930d54b976e2caebbfa392eceb0768424564dc925d953f32b169c927501edaad53adf25537a75e8002d1bb00b445fe4caf7c07
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2a91aea6878d4101207c5590e652a0ea2aed8739742b778ae7fc8e9e9d6700c3.exe.logFilesize
706B
MD52ef5ef69dadb8865b3d5b58c956077b8
SHA1af2d869bac00685c745652bbd8b3fe82829a8998
SHA256363502eb2a4e53ba02d2d85412b901fcf8e06de221736bdffa949799ef3d21e3
SHA51266d4db5dd17d88e1d54ea0df3a7211a503dc4355de701259cefccc9f2e4e3ced9534b700099ffbb089a5a3acb082011c80b61801aa14aff76b379ce8f90d4fd3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DefenderUpdateAnalyse.exe.logFilesize
706B
MD52ef5ef69dadb8865b3d5b58c956077b8
SHA1af2d869bac00685c745652bbd8b3fe82829a8998
SHA256363502eb2a4e53ba02d2d85412b901fcf8e06de221736bdffa949799ef3d21e3
SHA51266d4db5dd17d88e1d54ea0df3a7211a503dc4355de701259cefccc9f2e4e3ced9534b700099ffbb089a5a3acb082011c80b61801aa14aff76b379ce8f90d4fd3
-
memory/2888-130-0x0000000000C40000-0x0000000000CAC000-memory.dmpFilesize
432KB
-
memory/2888-131-0x0000000008140000-0x00000000086E4000-memory.dmpFilesize
5.6MB
-
memory/2888-132-0x0000000007C60000-0x0000000007CF2000-memory.dmpFilesize
584KB
-
memory/2888-133-0x00000000087C0000-0x000000000885C000-memory.dmpFilesize
624KB
-
memory/3468-168-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-176-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-146-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-148-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-150-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-152-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-154-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-156-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-158-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-160-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-162-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-164-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-166-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-142-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-170-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-172-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-174-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-144-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-178-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-180-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-182-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-184-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-186-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-188-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-190-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-192-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-194-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-196-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-198-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-140-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-134-0x0000000000000000-mapping.dmp
-
memory/3468-138-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3468-135-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3544-415-0x0000000000000000-mapping.dmp
-
memory/5112-418-0x0000000000000000-mapping.dmp
-
memory/5112-700-0x0000000005A00000-0x0000000005A0A000-memory.dmpFilesize
40KB