a532ef74cfbe55a5d4cba2e9407ea4951328797d94e30c4160664d3536cb13d2

Analysis

max time kernel
50s
max time network
111s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

StopUpdates10 Win10Զ¹رչ_v3.1.101 Я/uninstall.bat
Size

51B
MD5

b12d06605b99570ff0d5ea528be40ca2
SHA1

2cfd0af17ba51badf963f3a9a754b43005dd131a
SHA256

82ea7cb76b8c01cd7da7273927f3c77032b8878dfa1bf46c797345deaafdcd1c
SHA512

3f54980b42aedaea989834ae2f54387839830f2e3353f6369b961f1f7af2dfedd3a387f3caeceddca771d881bca0b2b434115d1a13ad75e82b3633c7e1c46dea

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

StopUpdates10.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "2"	StopUpdates10.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "3"	StopUpdates10.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2040 sc.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

Processes:

SU10Guard.exeStopUpdates10.exe

pid process

1148 SU10Guard.exe
844 StopUpdates10.exe

pid	process
2040	sc.exe

pid	process
1148	SU10Guard.exe
844	StopUpdates10.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

StopUpdates10.exe

description	pid	process
Token: SeRestorePrivilege	844	StopUpdates10.exe
Token: SeTakeOwnershipPrivilege	844	StopUpdates10.exe
Token: SeRestorePrivilege	844	StopUpdates10.exe
Token: SeTakeOwnershipPrivilege	844	StopUpdates10.exe
Token: SeRestorePrivilege	844	StopUpdates10.exe
Token: SeTakeOwnershipPrivilege	844	StopUpdates10.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

StopUpdates10.exe

pid process

844 StopUpdates10.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

StopUpdates10.exe

pid process

844 StopUpdates10.exe

pid	process
844	StopUpdates10.exe

pid	process
844	StopUpdates10.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exeSU10Guard.exe

description	pid	process	target process
PID 1724 wrote to memory of 1148	1724	cmd.exe	SU10Guard.exe
PID 1724 wrote to memory of 1148	1724	cmd.exe	SU10Guard.exe
PID 1724 wrote to memory of 1148	1724	cmd.exe	SU10Guard.exe
PID 1724 wrote to memory of 1148	1724	cmd.exe	SU10Guard.exe
PID 1724 wrote to memory of 1148	1724	cmd.exe	SU10Guard.exe
PID 1724 wrote to memory of 1148	1724	cmd.exe	SU10Guard.exe
PID 1724 wrote to memory of 1148	1724	cmd.exe	SU10Guard.exe
PID 1148 wrote to memory of 2040	1148	SU10Guard.exe	sc.exe
PID 1148 wrote to memory of 2040	1148	SU10Guard.exe	sc.exe
PID 1148 wrote to memory of 2040	1148	SU10Guard.exe	sc.exe
PID 1148 wrote to memory of 2040	1148	SU10Guard.exe	sc.exe
PID 1148 wrote to memory of 2040	1148	SU10Guard.exe	sc.exe
PID 1148 wrote to memory of 2040	1148	SU10Guard.exe	sc.exe
PID 1148 wrote to memory of 2040	1148	SU10Guard.exe	sc.exe
PID 1724 wrote to memory of 844	1724	cmd.exe	StopUpdates10.exe
PID 1724 wrote to memory of 844	1724	cmd.exe	StopUpdates10.exe
PID 1724 wrote to memory of 844	1724	cmd.exe	StopUpdates10.exe
PID 1724 wrote to memory of 844	1724	cmd.exe	StopUpdates10.exe
PID 1724 wrote to memory of 844	1724	cmd.exe	StopUpdates10.exe
PID 1724 wrote to memory of 844	1724	cmd.exe	StopUpdates10.exe
PID 1724 wrote to memory of 844	1724	cmd.exe	StopUpdates10.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\StopUpdates10 Win10Զ¹رչ_v3.1.101 Я\uninstall.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\StopUpdates10 Win10Զ¹رչ_v3.1.101 Я\SU10Guard.exe
SU10Guard.exe -u
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\sc.exe
sc.exe stop SU10Guard
3⤵
- Launches sc.exe
PID:2040

C:\Users\Admin\AppData\Local\Temp\StopUpdates10 Win10Զ¹رչ_v3.1.101 Я\StopUpdates10.exe
StopUpdates10.exe /unins
2⤵
- Modifies security service
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-58-0x0000000000000000-mapping.dmp

Download
memory/1148-54-0x0000000000000000-mapping.dmp

Download
memory/1148-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download