41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

General

Target

41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
Size

72KB
MD5

1cd970dfd5d94caace6c686a0b0cb13c
SHA1

d5ded78e026eb7733f19a34ea50e0349b5a130bb
SHA256

41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3
SHA512

85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce
SSDEEP

1536:Z+KnjJ0ty9cHMQ9Lqc6nKQMt5tdnzLeP4YnOjb:YKnueKLZvdzLeNO/

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe

Executes dropped EXE 2 IoCs

pid	Process
4936	winupd32.exe
3128	winupd32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	winupd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	winupd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updates = "\\winupd32.exe"	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Updates = "\\winupd32.exe"	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winupd32.exe	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
File opened for modification	C:\Windows\SysWOW64\winupd32.exe	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
File created	C:\Windows\SysWOW64\winupd32.exe	winupd32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2816	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
2816	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
4936	winupd32.exe
4936	winupd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
Token: SeDebugPrivilege	4936	winupd32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4936	2816	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe	76
PID 2816 wrote to memory of 4936	2816	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe	76
PID 2816 wrote to memory of 4936	2816	41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe	76
PID 4936 wrote to memory of 3128	4936	winupd32.exe	77
PID 4936 wrote to memory of 3128	4936	winupd32.exe	77
PID 4936 wrote to memory of 3128	4936	winupd32.exe	77

C:\Users\Admin\AppData\Local\Temp\41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe
"C:\Users\Admin\AppData\Local\Temp\41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\winupd32.exe
  C:\Windows\system32\winupd32.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\SysWOW64\winupd32.exe
    C:\Windows\system32\winupd32.exe
    3⤵
    - Executes dropped EXE
    PID:3128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\SysWOW64\winupd32.exe

Filesize
72KB

MD5
1cd970dfd5d94caace6c686a0b0cb13c

SHA1
d5ded78e026eb7733f19a34ea50e0349b5a130bb

SHA256
41e53c5bd9d9f7d8f599aed32492b9899513425582340dea8973bd9d867e51a3

SHA512
85ebecb1ace6ae8702d6e8f9f7ced245d46be249a4912e2e9e470281e7fffacd10fc39df672eb6c9d8f01f53c56d46e570da428c146c3625236544431bd7a4ce

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
90a48da259c2a59382cf6cdf90e3f7e1

SHA1
55f040d1cb42fdd45d7f354b5d76305e6d1d53df

SHA256
eed931b4a5f4149da294e096770b20669f49e71793e35e5f2831e863ffb79026

SHA512
d2c1ab3189f2eeca22a0e466f80169380bf15cd03ac4f921313c4dcdae37dd13431296d0898659ae9509a7ff479926d71ab9cdffcc2044fad53dca62a30213df

Download Submit
memory/2816-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3128-140-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4936-139-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing