783f3ad49ba8de049caa788015471439cb750f3e8c6141a21cdb56ff16499d3a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

783f3ad49ba8de049caa788015471439cb750f3e8c6141a21cdb56ff16499d3a.exe
Size

300KB
MD5

c8e3183efb6a5fdbad0f88c6c03d6a8b
SHA1

5ce08914dd77668be2a91aaad9be51459c598294
SHA256

783f3ad49ba8de049caa788015471439cb750f3e8c6141a21cdb56ff16499d3a
SHA512

b46127ec4b0b0637e330549d10afe5896846acd321698a4efd9cf2a8bd62cce365ead1c30abf279ed1bcc4807aad5c60c3ee355fd8144f014baea5646710aa8c
SSDEEP

6144:DrCuRAtfgvIZDe6w/JwHdZHdV/pfdJXFnpAQTNWIOJh8:DrZAlfZyuHdJdV/BXFnpzBWr8

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4576	utad.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	utad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Utad = "C:\\Users\\Admin\\AppData\\Roaming\\Wuakxo\\utad.exe"	utad.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4984 set thread context of 5004	4984	783f3ad49ba8de049caa788015471439cb750f3e8c6141a21cdb56ff16499d3a.exe	81

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe
4576	utad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4576	4984	783f3ad49ba8de049caa788015471439cb750f3e8c6141a21cdb56ff16499d3a.exe	80
PID 4984 wrote to memory of 4576	4984	783f3ad49ba8de049caa788015471439cb750f3e8c6141a21cdb56ff16499d3a.exe	80
PID 4984 wrote to memory of 4576	4984	783f3ad49ba8de049caa788015471439cb750f3e8c6141a21cdb56ff16499d3a.exe	80
PID 4576 wrote to memory of 2452	4576	utad.exe	49
PID 4576 wrote to memory of 2452	4576	utad.exe	49
PID 4576 wrote to memory of 2452	4576	utad.exe	49
PID 4576 wrote to memory of 2452	4576	utad.exe	49
PID 4576 wrote to memory of 2452	4576	utad.exe	49
PID 4576 wrote to memory of 2468	4576	utad.exe	48
PID 4576 wrote to memory of 2468	4576	utad.exe	48
PID 4576 wrote to memory of 2468	4576	utad.exe	48
PID 4576 wrote to memory of 2468	4576	utad.exe	48
PID 4576 wrote to memory of 2468	4576	utad.exe	48
PID 4576 wrote to memory of 2768	4576	utad.exe	41
PID 4576 wrote to memory of 2768	4576	utad.exe	41
PID 4576 wrote to memory of 2768	4576	utad.exe	41
PID 4576 wrote to memory of 2768	4576	utad.exe	41
PID 4576 wrote to memory of 2768	4576	utad.exe	41
PID 4576 wrote to memory of 2720	4576	utad.exe	39
PID 4576 wrote to memory of 2720	4576	utad.exe	39
PID 4576 wrote to memory of 2720	4576	utad.exe	39
PID 4576 wrote to memory of 2720	4576	utad.exe	39
PID 4576 wrote to memory of 2720	4576	utad.exe	39
PID 4576 wrote to memory of 3012	4576	utad.exe	38
PID 4576 wrote to memory of 3012	4576	utad.exe	38
PID 4576 wrote to memory of 3012	4576	utad.exe	38
PID 4576 wrote to memory of 3012	4576	utad.exe	38
PID 4576 wrote to memory of 3012	4576	utad.exe	38
PID 4576 wrote to memory of 3252	4576	utad.exe	37
PID 4576 wrote to memory of 3252	4576	utad.exe	37
PID 4576 wrote to memory of 3252	4576	utad.exe	37
PID 4576 wrote to memory of 3252	4576	utad.exe	37
PID 4576 wrote to memory of 3252	4576	utad.exe	37
PID 4576 wrote to memory of 3344	4576	utad.exe	36
PID 4576 wrote to memory of 3344	4576	utad.exe	36
PID 4576 wrote to memory of 3344	4576	utad.exe	36
PID 4576 wrote to memory of 3344	4576	utad.exe	36
PID 4576 wrote to memory of 3344	4576	utad.exe	36
PID 4576 wrote to memory of 3412	4576	utad.exe	15
PID 4576 wrote to memory of 3412	4576	utad.exe	15
PID 4576 wrote to memory of 3412	4576	utad.exe	15
PID 4576 wrote to memory of 3412	4576	utad.exe	15
PID 4576 wrote to memory of 3412	4576	utad.exe	15
PID 4576 wrote to memory of 3496	4576	utad.exe	35
PID 4576 wrote to memory of 3496	4576	utad.exe	35
PID 4576 wrote to memory of 3496	4576	utad.exe	35
PID 4576 wrote to memory of 3496	4576	utad.exe	35
PID 4576 wrote to memory of 3496	4576	utad.exe	35
PID 4576 wrote to memory of 3696	4576	utad.exe	34
PID 4576 wrote to memory of 3696	4576	utad.exe	34
PID 4576 wrote to memory of 3696	4576	utad.exe	34
PID 4576 wrote to memory of 3696	4576	utad.exe	34
PID 4576 wrote to memory of 3696	4576	utad.exe	34
PID 4576 wrote to memory of 4560	4576	utad.exe	31
PID 4576 wrote to memory of 4560	4576	utad.exe	31
PID 4576 wrote to memory of 4560	4576	utad.exe	31
PID 4576 wrote to memory of 4560	4576	utad.exe	31
PID 4576 wrote to memory of 4560	4576	utad.exe	31
PID 4576 wrote to memory of 4984	4576	utad.exe	79
PID 4576 wrote to memory of 4984	4576	utad.exe	79
PID 4576 wrote to memory of 4984	4576	utad.exe	79
PID 4576 wrote to memory of 4984	4576	utad.exe	79
PID 4576 wrote to memory of 4984	4576	utad.exe	79
PID 4984 wrote to memory of 5004	4984	783f3ad49ba8de049caa788015471439cb750f3e8c6141a21cdb56ff16499d3a.exe	81

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3412

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3696

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3496

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3344

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2720
- C:\Users\Admin\AppData\Local\Temp\783f3ad49ba8de049caa788015471439cb750f3e8c6141a21cdb56ff16499d3a.exe
  "C:\Users\Admin\AppData\Local\Temp\783f3ad49ba8de049caa788015471439cb750f3e8c6141a21cdb56ff16499d3a.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Roaming\Wuakxo\utad.exe
    "C:\Users\Admin\AppData\Roaming\Wuakxo\utad.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4576
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\ARS5310.bat"
    3⤵
    PID:5004

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2468

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ARS5310.bat

Filesize
303B

MD5
2649d2e47a41565c576575ec28713959

SHA1
a57489fe4a5a91aa200b2e8a777384a19a66da8d

SHA256
1bcc7f2215165bdcbcf4826c499bc7f7f05cbbf6c32c4de40776250722d12b73

SHA512
b3e9e613af38da1da39f0fb330bcca41f0caf4df8c7923923b0a1190c27c0bbfde15f3d88f79d75b6eccc97eb9b3af71b20c8a80d09ad7dab1d36a8952cceffe

Download Submit
C:\Users\Admin\AppData\Roaming\Wuakxo\utad.exe

Filesize
300KB

MD5
8be8249413cc6078914b7983b9e22ca4

SHA1
c418be78f6e7d949c7f39252541b9deaf27268e1

SHA256
8aba9f44dad1cca26afb6e5d90e5cf35e2c361f71827c1aa1a7c433f6cad8eb2

SHA512
0fe0e1c9a2f1d9de939ac76b77e06a5938702458034798953d6f0b20ef71b9b7b0b9f75e8e52644bc0bffae2b23829f4920c03aee4ad737733597a716627f3f3

Download Submit
C:\Users\Admin\AppData\Roaming\Wuakxo\utad.exe

Filesize
300KB

MD5
8be8249413cc6078914b7983b9e22ca4

SHA1
c418be78f6e7d949c7f39252541b9deaf27268e1

SHA256
8aba9f44dad1cca26afb6e5d90e5cf35e2c361f71827c1aa1a7c433f6cad8eb2

SHA512
0fe0e1c9a2f1d9de939ac76b77e06a5938702458034798953d6f0b20ef71b9b7b0b9f75e8e52644bc0bffae2b23829f4920c03aee4ad737733597a716627f3f3

Download Submit
memory/4576-137-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4984-144-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4984-148-0x0000000000AA0000-0x0000000000AE9000-memory.dmp

Filesize
292KB

Download
memory/4984-140-0x0000000000AA0000-0x0000000000AE9000-memory.dmp

Filesize
292KB

Download
memory/4984-142-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4984-141-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4984-143-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4984-145-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4984-132-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4984-133-0x0000000000401000-0x0000000000442000-memory.dmp

Filesize
260KB

Download
memory/4984-139-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5004-149-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5004-147-0x0000000001160000-0x00000000011A9000-memory.dmp

Filesize
292KB

Download
memory/5004-150-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5004-151-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5004-152-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5004-153-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5004-154-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5004-155-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5004-156-0x0000000001160000-0x00000000011A9000-memory.dmp

Filesize
292KB

Download
memory/5004-158-0x0000000001160000-0x00000000011A9000-memory.dmp

Filesize
292KB

Download