Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe
Resource
win10v2004-20220901-en
General
-
Target
964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe
-
Size
28KB
-
MD5
227aad41392f8a4ad3cc053e888e6000
-
SHA1
44ecd9775a7f5ccd13cdf62d4d490a9ff426ecb3
-
SHA256
964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3
-
SHA512
ef94dadc1b36c4d4733f447f96e766585d7284ab9004d17e285a44bb5ee65f0e3f3d69f9742b7905e3684608c1eb91a87801449c81f5c89b14dd8e4c8089281e
-
SSDEEP
384:vQ/9ZdgRjmA/9yxnzVmlocUoIRjNooOAW3ESrnysL7RwglotIfIOsqvY:vQkjmYyx4URjN9S75vRwglotyIOswY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows update loader = "C:\\Windows\\xpupdate.exe" 964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xpupdate.exe 964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe File opened for modification C:\Windows\xpupdate.exe 964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe