Analysis
-
max time kernel
152s -
max time network
71s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 06:00
Static task
static1
Behavioral task
behavioral1
Sample
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe
Resource
win10v2004-20220901-en
General
-
Target
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe
-
Size
788KB
-
MD5
80ef70dc4d72c8e9b52410ee7338c9ae
-
SHA1
8679b445bfee7382a7ea7ec70331077ecea9d94b
-
SHA256
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
-
SHA512
03488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
SSDEEP
12288:s0vdICiZcqd87ONMZ+UWAAFSPiOob2pLLCMjOoUS+uMqiK0NE8/b:xCcIJXUpPiOA2xLCMjuHueKAb
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe -
Executes dropped EXE 2 IoCs
Processes:
winupdate.exewinupdate.exepid process 848 winupdate.exe 788 winupdate.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1696 cmd.exe -
Loads dropped DLL 8 IoCs
Processes:
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exewinupdate.exewinupdate.exepid process 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe 848 winupdate.exe 848 winupdate.exe 848 winupdate.exe 848 winupdate.exe 788 winupdate.exe 788 winupdate.exe 788 winupdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exewinupdate.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" winupdate.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exewinupdate.exedescription pid process target process PID 1780 set thread context of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 848 set thread context of 788 848 winupdate.exe winupdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exewinupdate.exedescription pid process Token: SeIncreaseQuotaPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeSecurityPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeTakeOwnershipPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeLoadDriverPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeSystemProfilePrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeSystemtimePrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeProfSingleProcessPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeIncBasePriorityPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeCreatePagefilePrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeBackupPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeRestorePrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeShutdownPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeDebugPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeSystemEnvironmentPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeChangeNotifyPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeRemoteShutdownPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeUndockPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeManageVolumePrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeImpersonatePrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeCreateGlobalPrivilege 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: 33 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: 34 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: 35 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe Token: SeIncreaseQuotaPrivilege 788 winupdate.exe Token: SeSecurityPrivilege 788 winupdate.exe Token: SeTakeOwnershipPrivilege 788 winupdate.exe Token: SeLoadDriverPrivilege 788 winupdate.exe Token: SeSystemProfilePrivilege 788 winupdate.exe Token: SeSystemtimePrivilege 788 winupdate.exe Token: SeProfSingleProcessPrivilege 788 winupdate.exe Token: SeIncBasePriorityPrivilege 788 winupdate.exe Token: SeCreatePagefilePrivilege 788 winupdate.exe Token: SeBackupPrivilege 788 winupdate.exe Token: SeRestorePrivilege 788 winupdate.exe Token: SeShutdownPrivilege 788 winupdate.exe Token: SeDebugPrivilege 788 winupdate.exe Token: SeSystemEnvironmentPrivilege 788 winupdate.exe Token: SeChangeNotifyPrivilege 788 winupdate.exe Token: SeRemoteShutdownPrivilege 788 winupdate.exe Token: SeUndockPrivilege 788 winupdate.exe Token: SeManageVolumePrivilege 788 winupdate.exe Token: SeImpersonatePrivilege 788 winupdate.exe Token: SeCreateGlobalPrivilege 788 winupdate.exe Token: 33 788 winupdate.exe Token: 34 788 winupdate.exe Token: 35 788 winupdate.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exewinupdate.exewinupdate.exepid process 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe 848 winupdate.exe 788 winupdate.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exebfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.execmd.exewinupdate.exedescription pid process target process PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1780 wrote to memory of 1236 1780 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe PID 1236 wrote to memory of 848 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe winupdate.exe PID 1236 wrote to memory of 848 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe winupdate.exe PID 1236 wrote to memory of 848 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe winupdate.exe PID 1236 wrote to memory of 848 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe winupdate.exe PID 1236 wrote to memory of 848 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe winupdate.exe PID 1236 wrote to memory of 848 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe winupdate.exe PID 1236 wrote to memory of 848 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe winupdate.exe PID 1236 wrote to memory of 1696 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe cmd.exe PID 1236 wrote to memory of 1696 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe cmd.exe PID 1236 wrote to memory of 1696 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe cmd.exe PID 1236 wrote to memory of 1696 1236 bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe cmd.exe PID 1696 wrote to memory of 324 1696 cmd.exe PING.EXE PID 1696 wrote to memory of 324 1696 cmd.exe PING.EXE PID 1696 wrote to memory of 324 1696 cmd.exe PING.EXE PID 1696 wrote to memory of 324 1696 cmd.exe PING.EXE PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe PID 848 wrote to memory of 788 848 winupdate.exe winupdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe"C:\Users\Admin\AppData\Local\Temp\bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exeC:\Users\Admin\AppData\Local\Temp\bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windupdt\winupdate.exeC:\Windupdt\winupdate.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 54⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
C:\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
C:\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
\Windupdt\winupdate.exeFilesize
788KB
MD580ef70dc4d72c8e9b52410ee7338c9ae
SHA18679b445bfee7382a7ea7ec70331077ecea9d94b
SHA256bfef082320559626427dc5f25be803c912e154e01705d163595877695210fcae
SHA51203488e16a34d6439c5dcde8726a2359ee9a997295c1bf3dff3a8734238272688a2bf749e03cf72d09d15139e81fbf418673a00fb24b2b4b09514f4e6eece0977
-
memory/324-88-0x0000000000000000-mapping.dmp
-
memory/788-116-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/788-115-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/788-114-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/788-109-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/788-105-0x000000000048E828-mapping.dmp
-
memory/848-77-0x0000000000000000-mapping.dmp
-
memory/1236-66-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-70-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-68-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-73-0x0000000075991000-0x0000000075993000-memory.dmpFilesize
8KB
-
memory/1236-65-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-74-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-56-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-81-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-63-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-71-0x000000000048E828-mapping.dmp
-
memory/1236-61-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-59-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-57-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-72-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1236-75-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1696-80-0x0000000000000000-mapping.dmp