Analysis
-
max time kernel
88s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
01-04-2023 04:29
General
-
Target
Windows10Upgrade9252.exe
-
Size
3.2MB
-
MD5
c0b25def4312fbddbcc4f01c6c0f5ba6
-
SHA1
8d16a183d61233e7d6b6af7b3cafc6645ac2acb1
-
SHA256
c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79
-
SHA512
8c67619747bb108dae5661688ec8fa4c62bc6ac38ee6ff14a4691aab04d7ddd870fee4262cb30624a6bd85ac1f7595af05311496b0336f979e7e5f797791bc0e
-
SSDEEP
98304:GgjXlctych4cCzJ8k2omX8sUf0ht5f/LyXtcH/:JjKtych9CzJqXM32jyX
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 26 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27B
MD5ca22263c7a6f965df18f5c601f5db7ce
SHA1e4b1a401ed497523a583ae8613646b03778a33a6
SHA256299fa3043627954c524b6171c26fcc3513790310aa2561e6f012eff15254381c
SHA5123cd39b438f7cb34b38f32240b1ba6a5010f49e12123db770460cf74217bc6946e2032355376c203b68863ee85596d21aa7b2d77c94da48a54def111d147311f8
-
Filesize
197KB
MD55b62ad6ae42f32806062ad1bcb3e2de5
SHA18d4a543eac9643931fcb620cd588e2cc1067920a
SHA25696f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3
SHA512af5bdbc5019b56eb9a32b6d264388e309e36013d43dbe09c61224ba6fabf1ff905371bc5b6ddaa0d5bfedae99cc5a7051f13fbf26cc756793799e568094eabcf
-
Filesize
3.5MB
MD5ab38a78503d8ad3ce7d69f937d71a99c
SHA100b6a6f09dd45e356ef9e2cacd554c728313fa99
SHA256f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782
SHA512fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f
-
Filesize
3.5MB
MD5ab38a78503d8ad3ce7d69f937d71a99c
SHA100b6a6f09dd45e356ef9e2cacd554c728313fa99
SHA256f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782
SHA512fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f
-
Filesize
3.5MB
MD5ab38a78503d8ad3ce7d69f937d71a99c
SHA100b6a6f09dd45e356ef9e2cacd554c728313fa99
SHA256f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782
SHA512fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f
-
Filesize
363KB
MD5cbb270591c9a1bfb1b10559ab672f705
SHA1fed0d59d60709b5b05b9d31030ea7a5422767a7e
SHA256770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f
SHA51267c4154d47981f22965966aa823dc0e05872b2f6d8fc7d80b4130f1cdb8bf9f326a20980e29c085e2940fc1f7b033b85d2eb192f5bda2da136364a842ea20f6a
-
Filesize
363KB
MD5cbb270591c9a1bfb1b10559ab672f705
SHA1fed0d59d60709b5b05b9d31030ea7a5422767a7e
SHA256770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f
SHA51267c4154d47981f22965966aa823dc0e05872b2f6d8fc7d80b4130f1cdb8bf9f326a20980e29c085e2940fc1f7b033b85d2eb192f5bda2da136364a842ea20f6a
-
Filesize
197KB
MD55b62ad6ae42f32806062ad1bcb3e2de5
SHA18d4a543eac9643931fcb620cd588e2cc1067920a
SHA25696f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3
SHA512af5bdbc5019b56eb9a32b6d264388e309e36013d43dbe09c61224ba6fabf1ff905371bc5b6ddaa0d5bfedae99cc5a7051f13fbf26cc756793799e568094eabcf
-
Filesize
82B
MD5b81d1e97c529ac3d7f5a699afce27080
SHA10a981264db289afd71695b4d6849672187e8120f
SHA25635c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225
SHA512e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607
-
Filesize
5KB
MD57f5fcac447cc2150ac90020f8dc8c98b
SHA15710398d65fba59bd91d603fc340bf2a101df40a
SHA256453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850
SHA512b9fb315fdcf93d028423f49438b1eff40216b377d8c3bc866a20914c17e00bef58a18228bebb8b33c8a64fcaaa34bee84064bb24a525b4c9ac2f26e384edb1ff
-
Filesize
60KB
MD5b2a06af2867a2bb3d4b198a22f7936b3
SHA198a28e15abdd2d6989d667cc578bf6ab954c29f5
SHA25640f468006ab37ef4fcc54c5ff25005644f15d696f1269f67b450c9e3ce5e8d23
SHA512eefc295a7cd517c93bbeadee51ab778f371be8b21a92b0c06339da2e624abd19c34907e0a8965e6bfe81863752c56cc509fcf015a3ee986d208a5fc7cac8bfc5
-
Filesize
16KB
MD51a276cb116bdece96adf8e32c4af4fee
SHA16bc30738fcd0c04370436f4d3340d460d25b788f
SHA2569d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618
SHA5125b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6
-
Filesize
2KB
MD5afeed45df4d74d93c260a86e71e09102
SHA12cc520e3d23f6b371c288645649a482a5db7ccd9
SHA256f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f
SHA512778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d
-
Filesize
420B
MD50968430a52f9f877d83ef2b46b107631
SHA1c1436477b4ee1ee0b0c81c9036eb228e4038b376
SHA256b210f3b072c60c2feb959e56c529e24cec77c1fcf933dcadad1f491f974f5e96
SHA5127a8a15524aecdb48753cc201c215df19bc79950373adc6dd4a8f641e3add53eba31d1309bf671e3b9e696616a3badce65839b211591a2eeebb9306390d81cfcf
-
Filesize
1KB
MD55a7499645619886bfe949250e1807415
SHA1152295cf08fcf1e21e26f05969cbb02bd22a8af6
SHA256db27bad6e59128d58031706c83210ae780a9261e01af6fde6323bd30f7a97b12
SHA512201fc4fa1aa035cf09872d6f335d94c97433b79af343d532d0dd5c6ab6ba60b5a3a3b60f466e2c7107c19e04ffcdfa8a016842b4f29ea3ee6dd3d60304d8d8dc
-
Filesize
363KB
MD5cbb270591c9a1bfb1b10559ab672f705
SHA1fed0d59d60709b5b05b9d31030ea7a5422767a7e
SHA256770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f
SHA51267c4154d47981f22965966aa823dc0e05872b2f6d8fc7d80b4130f1cdb8bf9f326a20980e29c085e2940fc1f7b033b85d2eb192f5bda2da136364a842ea20f6a
-
Filesize
39KB
MD55ad8ceea06e280b9b42e1b8df4b8b407
SHA1693ea7ac3f9fed186e0165e7667d2c41376c5d61
SHA25603a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb
SHA5121694fa3b9102771eef8a42b367d076c691b002de81eb4334ac6bd7befde747b168e7ed8f94f1c8f8877280f51c44adb69947fc1d899943d25b679a1be71dec84
-
Filesize
14B
MD5b0148e6864dd056a75e1ac4ffa744c93
SHA1dc27113b9da8673eddc65796696a0a0968f32ca8
SHA256fbab2f3d224dc1aec3f23c7f969f87844b2e7e2bb267e257c391dabb02f6b4cd
SHA512ae84e4702868c3b614a81517c39acb3c0922e680c39d176835c68eb3d5c2d3ed99b9732f2a5e13187ff78cb840eabbb2f38ba2f294db4163ebd5e0009cba996a
-
Filesize
4KB
