964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe
Size

28KB
MD5

227aad41392f8a4ad3cc053e888e6000
SHA1

44ecd9775a7f5ccd13cdf62d4d490a9ff426ecb3
SHA256

964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3
SHA512

ef94dadc1b36c4d4733f447f96e766585d7284ab9004d17e285a44bb5ee65f0e3f3d69f9742b7905e3684608c1eb91a87801449c81f5c89b14dd8e4c8089281e
SSDEEP

384:vQ/9ZdgRjmA/9yxnzVmlocUoIRjNooOAW3ESrnysL7RwglotIfIOsqvY:vQkjmYyx4URjN9S75vRwglotyIOswY

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows update loader = "C:\\Windows\\xpupdate.exe"	964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\xpupdate.exe	964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe
File opened for modification	C:\Windows\xpupdate.exe	964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe

C:\Users\Admin\AppData\Local\Temp\964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe
"C:\Users\Admin\AppData\Local\Temp\964a3ed0e45903a2eb81757ac86d33718017b0b9bde77befe3621318510287a3.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-132-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/384-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download