206e04e76f1cc2b2c7eac810aecb4df3dd697878fc37321aad2a01a7bd7534d5

Analysis

max time kernel
153s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

291ab9c8444a5594f2853de38c4df005.exe
Size

3.5MB
MD5

291ab9c8444a5594f2853de38c4df005
SHA1

a85b8c1463bcdfe9a68eb7d1fee05b871408f828
SHA256

206e04e76f1cc2b2c7eac810aecb4df3dd697878fc37321aad2a01a7bd7534d5
SHA512

2331a2b59c9d0b054a919eb4854b1159e222441654b72f7bd11feab3cc808caff71873cdce4eb20658bd1e9470556c33236af25a859b709a6be360d2426d08b0
SSDEEP

98304:rKNofG2P0c5EGntPqiWPBw0EAa7o4CMsIa:rKeG2cD9iWZl4CMsI

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4856	GoogleUpdate.exe
3968	GoogleUpdate.exe

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2424	netsh.exe
444	netsh.exe
2772	netsh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2916 set thread context of 3968	2916	291ab9c8444a5594f2853de38c4df005.exe	87

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\GoogleUpdate.exe	291ab9c8444a5594f2853de38c4df005.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4512	SCHTASKS.exe
4336	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2752	powershell.exe
2752	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2752	2916	291ab9c8444a5594f2853de38c4df005.exe	80
PID 2916 wrote to memory of 2752	2916	291ab9c8444a5594f2853de38c4df005.exe	80
PID 2916 wrote to memory of 2752	2916	291ab9c8444a5594f2853de38c4df005.exe	80
PID 2916 wrote to memory of 4512	2916	291ab9c8444a5594f2853de38c4df005.exe	81
PID 2916 wrote to memory of 4512	2916	291ab9c8444a5594f2853de38c4df005.exe	81
PID 2916 wrote to memory of 4512	2916	291ab9c8444a5594f2853de38c4df005.exe	81
PID 2916 wrote to memory of 4336	2916	291ab9c8444a5594f2853de38c4df005.exe	84
PID 2916 wrote to memory of 4336	2916	291ab9c8444a5594f2853de38c4df005.exe	84
PID 2916 wrote to memory of 4336	2916	291ab9c8444a5594f2853de38c4df005.exe	84
PID 2916 wrote to memory of 4856	2916	291ab9c8444a5594f2853de38c4df005.exe	86
PID 2916 wrote to memory of 4856	2916	291ab9c8444a5594f2853de38c4df005.exe	86
PID 2916 wrote to memory of 4856	2916	291ab9c8444a5594f2853de38c4df005.exe	86
PID 2916 wrote to memory of 3968	2916	291ab9c8444a5594f2853de38c4df005.exe	87
PID 2916 wrote to memory of 3968	2916	291ab9c8444a5594f2853de38c4df005.exe	87
PID 2916 wrote to memory of 3968	2916	291ab9c8444a5594f2853de38c4df005.exe	87
PID 2916 wrote to memory of 3968	2916	291ab9c8444a5594f2853de38c4df005.exe	87
PID 2916 wrote to memory of 3968	2916	291ab9c8444a5594f2853de38c4df005.exe	87
PID 2916 wrote to memory of 3968	2916	291ab9c8444a5594f2853de38c4df005.exe	87
PID 2916 wrote to memory of 3968	2916	291ab9c8444a5594f2853de38c4df005.exe	87
PID 2916 wrote to memory of 3968	2916	291ab9c8444a5594f2853de38c4df005.exe	87
PID 2916 wrote to memory of 3968	2916	291ab9c8444a5594f2853de38c4df005.exe	87
PID 3968 wrote to memory of 2424	3968	GoogleUpdate.exe	88
PID 3968 wrote to memory of 2424	3968	GoogleUpdate.exe	88
PID 3968 wrote to memory of 2424	3968	GoogleUpdate.exe	88
PID 3968 wrote to memory of 444	3968	GoogleUpdate.exe	89
PID 3968 wrote to memory of 444	3968	GoogleUpdate.exe	89
PID 3968 wrote to memory of 444	3968	GoogleUpdate.exe	89
PID 3968 wrote to memory of 2772	3968	GoogleUpdate.exe	91
PID 3968 wrote to memory of 2772	3968	GoogleUpdate.exe	91
PID 3968 wrote to memory of 2772	3968	GoogleUpdate.exe	91

C:\Users\Admin\AppData\Local\Temp\291ab9c8444a5594f2853de38c4df005.exe
"C:\Users\Admin\AppData\Local\Temp\291ab9c8444a5594f2853de38c4df005.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Temp\291ab9c8444a5594f2853de38c4df005.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4512
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Temp\291ab9c8444a5594f2853de38c4df005.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4336
- C:\Windows\GoogleUpdate.exe
  C:\Windows\GoogleUpdate.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\GoogleUpdate.exe
  C:\Windows\GoogleUpdate.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
    3⤵
    - Modifies Windows Firewall
    PID:2424
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:444
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:2772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\GoogleUpdate.exe

Filesize
150KB

MD5
9a66a3de2589f7108426af37ab7f6b41

SHA1
12950d906ff703f3a1e0bd973fca2b433e5ab207

SHA256
a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65

SHA512
a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6

Download Submit
C:\Windows\GoogleUpdate.exe

Filesize
150KB

MD5
9a66a3de2589f7108426af37ab7f6b41

SHA1
12950d906ff703f3a1e0bd973fca2b433e5ab207

SHA256
a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65

SHA512
a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6

Download Submit
C:\Windows\GoogleUpdate.exe

Filesize
150KB

MD5
9a66a3de2589f7108426af37ab7f6b41

SHA1
12950d906ff703f3a1e0bd973fca2b433e5ab207

SHA256
a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65

SHA512
a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6

Download Submit
memory/2752-166-0x0000000006930000-0x0000000006962000-memory.dmp

Filesize
200KB

Download
memory/2752-172-0x0000000007900000-0x0000000007996000-memory.dmp

Filesize
600KB

Download
memory/2752-139-0x00000000055E0000-0x0000000005C08000-memory.dmp

Filesize
6.2MB

Download
memory/2752-175-0x00000000078F0000-0x00000000078F8000-memory.dmp

Filesize
32KB

Download
memory/2752-141-0x0000000005390000-0x00000000053B2000-memory.dmp

Filesize
136KB

Download
memory/2752-142-0x0000000005430000-0x0000000005496000-memory.dmp

Filesize
408KB

Download
memory/2752-143-0x00000000054A0000-0x0000000005506000-memory.dmp

Filesize
408KB

Download
memory/2752-174-0x00000000079A0000-0x00000000079BA000-memory.dmp

Filesize
104KB

Download
memory/2752-173-0x00000000078B0000-0x00000000078BE000-memory.dmp

Filesize
56KB

Download
memory/2752-163-0x00000000062F0000-0x000000000630E000-memory.dmp

Filesize
120KB

Download
memory/2752-171-0x00000000076F0000-0x00000000076FA000-memory.dmp

Filesize
40KB

Download
memory/2752-170-0x0000000007670000-0x000000000768A000-memory.dmp

Filesize
104KB

Download
memory/2752-169-0x0000000007CC0000-0x000000000833A000-memory.dmp

Filesize
6.5MB

Download
memory/2752-168-0x0000000006910000-0x000000000692E000-memory.dmp

Filesize
120KB

Download
memory/2752-167-0x000000006EF30000-0x000000006EF7C000-memory.dmp

Filesize
304KB

Download
memory/2752-138-0x0000000004DE0000-0x0000000004E16000-memory.dmp

Filesize
216KB

Download
memory/2916-132-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2916-135-0x000000000CEA0000-0x000000000CFAA000-memory.dmp

Filesize
1.0MB

Download
memory/2916-157-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/2916-158-0x000000000CEA0000-0x000000000CFAA000-memory.dmp

Filesize
1.0MB

Download
memory/3968-156-0x0000000000E00000-0x0000000000E35000-memory.dmp

Filesize
212KB

Download
memory/3968-165-0x0000000000E00000-0x0000000000E35000-memory.dmp

Filesize
212KB

Download
memory/3968-162-0x0000000000E00000-0x0000000000E35000-memory.dmp

Filesize
212KB

Download
memory/3968-155-0x0000000000AD0000-0x0000000000B26000-memory.dmp

Filesize
344KB

Download
memory/3968-151-0x0000000000AD0000-0x0000000000B26000-memory.dmp

Filesize
344KB

Download
memory/3968-145-0x0000000000AD0000-0x0000000000B26000-memory.dmp

Filesize
344KB

Download