a532ef74cfbe55a5d4cba2e9407ea4951328797d94e30c4160664d3536cb13d2

Analysis

max time kernel
93s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

StopUpdates10 Win10Զ¹رչ_v3.1.101 Я/uninstall.bat
Size

51B
MD5

b12d06605b99570ff0d5ea528be40ca2
SHA1

2cfd0af17ba51badf963f3a9a754b43005dd131a
SHA256

82ea7cb76b8c01cd7da7273927f3c77032b8878dfa1bf46c797345deaafdcd1c
SHA512

3f54980b42aedaea989834ae2f54387839830f2e3353f6369b961f1f7af2dfedd3a387f3caeceddca771d881bca0b2b434115d1a13ad75e82b3633c7e1c46dea

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

StopUpdates10.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "2"	StopUpdates10.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "3"	StopUpdates10.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1044 sc.exe

pid	process
1044	sc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

StopUpdates10.exe

description	pid	process
Token: SeRestorePrivilege	4364	StopUpdates10.exe
Token: SeTakeOwnershipPrivilege	4364	StopUpdates10.exe
Token: SeRestorePrivilege	4364	StopUpdates10.exe
Token: SeTakeOwnershipPrivilege	4364	StopUpdates10.exe
Token: SeRestorePrivilege	4364	StopUpdates10.exe
Token: SeTakeOwnershipPrivilege	4364	StopUpdates10.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

StopUpdates10.exe

pid process

4364 StopUpdates10.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

StopUpdates10.exe

pid process

4364 StopUpdates10.exe

pid	process
4364	StopUpdates10.exe

pid	process
4364	StopUpdates10.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cmd.exeSU10Guard.exe

description	pid	process	target process
PID 4904 wrote to memory of 2740	4904	cmd.exe	SU10Guard.exe
PID 4904 wrote to memory of 2740	4904	cmd.exe	SU10Guard.exe
PID 4904 wrote to memory of 2740	4904	cmd.exe	SU10Guard.exe
PID 2740 wrote to memory of 1044	2740	SU10Guard.exe	sc.exe
PID 2740 wrote to memory of 1044	2740	SU10Guard.exe	sc.exe
PID 2740 wrote to memory of 1044	2740	SU10Guard.exe	sc.exe
PID 4904 wrote to memory of 4364	4904	cmd.exe	StopUpdates10.exe
PID 4904 wrote to memory of 4364	4904	cmd.exe	StopUpdates10.exe
PID 4904 wrote to memory of 4364	4904	cmd.exe	StopUpdates10.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\StopUpdates10 Win10Զ¹رչ_v3.1.101 Я\uninstall.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Local\Temp\StopUpdates10 Win10Զ¹رչ_v3.1.101 Я\SU10Guard.exe
SU10Guard.exe -u
2⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\sc.exe
sc.exe stop SU10Guard
3⤵
- Launches sc.exe
PID:1044

C:\Users\Admin\AppData\Local\Temp\StopUpdates10 Win10Զ¹رչ_v3.1.101 Я\StopUpdates10.exe
StopUpdates10.exe /unins
2⤵
- Modifies security service
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-133-0x0000000000000000-mapping.dmp

Download
memory/2740-132-0x0000000000000000-mapping.dmp

Download
memory/4364-134-0x0000000000000000-mapping.dmp

Download