Analysis
-
max time kernel
41s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03-06-2023 11:24
Static task
static1
Behavioral task
behavioral1
Sample
XboxUpdate.exe
Resource
win7-20230220-en
General
-
Target
XboxUpdate.exe
-
Size
2.4MB
-
MD5
9539d670b998aa46651b51d69123b909
-
SHA1
77c4912a7b67260c486fda2f93a3b98ecb5e7d65
-
SHA256
52712a99b6b73458711a3af355c6b63a45457a9590964c835e08f6da84a09669
-
SHA512
9352b2c5c3b7f19a9c80bd574bd376d1db67cfcb8284abbab81b43efa881591a59cb25de0ff843d54bb958a05dccd783d342316a504bf8528f5e7b2cc02ee1aa
-
SSDEEP
12288:j0t4Sb/JDZcAVeF8EGoBzFXe2iFi3R6I9VTnHdyFe2OAdnRC9oC5pZxsumiT:jG4GVZcXfiw8Wn9yFPxdnRC9oCr3
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
tmp1C19.tmp.exeXboxUpdate.exetmp842E.tmp.exepid process 1156 tmp1C19.tmp.exe 848 XboxUpdate.exe 1732 tmp842E.tmp.exe -
Loads dropped DLL 6 IoCs
Processes:
WerFault.exeWerFault.exepid process 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1840 1156 WerFault.exe tmp1C19.tmp.exe 1764 1732 WerFault.exe tmp842E.tmp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
XboxUpdate.exepid process 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe 316 XboxUpdate.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
XboxUpdate.exepowershell.exeXboxUpdate.exedescription pid process Token: SeDebugPrivilege 316 XboxUpdate.exe Token: SeDebugPrivilege 916 powershell.exe Token: SeDebugPrivilege 848 XboxUpdate.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
XboxUpdate.exetmp1C19.tmp.exetaskeng.exeXboxUpdate.exetmp842E.tmp.exedescription pid process target process PID 316 wrote to memory of 1156 316 XboxUpdate.exe tmp1C19.tmp.exe PID 316 wrote to memory of 1156 316 XboxUpdate.exe tmp1C19.tmp.exe PID 316 wrote to memory of 1156 316 XboxUpdate.exe tmp1C19.tmp.exe PID 316 wrote to memory of 1156 316 XboxUpdate.exe tmp1C19.tmp.exe PID 1156 wrote to memory of 1840 1156 tmp1C19.tmp.exe WerFault.exe PID 1156 wrote to memory of 1840 1156 tmp1C19.tmp.exe WerFault.exe PID 1156 wrote to memory of 1840 1156 tmp1C19.tmp.exe WerFault.exe PID 1156 wrote to memory of 1840 1156 tmp1C19.tmp.exe WerFault.exe PID 316 wrote to memory of 916 316 XboxUpdate.exe powershell.exe PID 316 wrote to memory of 916 316 XboxUpdate.exe powershell.exe PID 316 wrote to memory of 916 316 XboxUpdate.exe powershell.exe PID 1084 wrote to memory of 848 1084 taskeng.exe XboxUpdate.exe PID 1084 wrote to memory of 848 1084 taskeng.exe XboxUpdate.exe PID 1084 wrote to memory of 848 1084 taskeng.exe XboxUpdate.exe PID 848 wrote to memory of 1732 848 XboxUpdate.exe tmp842E.tmp.exe PID 848 wrote to memory of 1732 848 XboxUpdate.exe tmp842E.tmp.exe PID 848 wrote to memory of 1732 848 XboxUpdate.exe tmp842E.tmp.exe PID 848 wrote to memory of 1732 848 XboxUpdate.exe tmp842E.tmp.exe PID 1732 wrote to memory of 1764 1732 tmp842E.tmp.exe WerFault.exe PID 1732 wrote to memory of 1764 1732 tmp842E.tmp.exe WerFault.exe PID 1732 wrote to memory of 1764 1732 tmp842E.tmp.exe WerFault.exe PID 1732 wrote to memory of 1764 1732 tmp842E.tmp.exe WerFault.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XboxUpdate.exe"C:\Users\Admin\AppData\Local\Temp\XboxUpdate.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp1C19.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1C19.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 963⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {E21E3EC5-0A33-4F50-BD35-0442E8B0E259} S-1-5-21-2647223082-2067913677-935928954-1000:BPOQNXYB\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XboxUpdate.exeC:\Users\Admin\AppData\Roaming\XboxUpdate.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp842E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp842E.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 964⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1C19.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmp1C19.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmp842E.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Roaming\XboxUpdate.exeFilesize
2.4MB
MD59539d670b998aa46651b51d69123b909
SHA177c4912a7b67260c486fda2f93a3b98ecb5e7d65
SHA25652712a99b6b73458711a3af355c6b63a45457a9590964c835e08f6da84a09669
SHA5129352b2c5c3b7f19a9c80bd574bd376d1db67cfcb8284abbab81b43efa881591a59cb25de0ff843d54bb958a05dccd783d342316a504bf8528f5e7b2cc02ee1aa
-
C:\Users\Admin\AppData\Roaming\XboxUpdate.exeFilesize
2.4MB
MD59539d670b998aa46651b51d69123b909
SHA177c4912a7b67260c486fda2f93a3b98ecb5e7d65
SHA25652712a99b6b73458711a3af355c6b63a45457a9590964c835e08f6da84a09669
SHA5129352b2c5c3b7f19a9c80bd574bd376d1db67cfcb8284abbab81b43efa881591a59cb25de0ff843d54bb958a05dccd783d342316a504bf8528f5e7b2cc02ee1aa
-
\Users\Admin\AppData\Local\Temp\tmp1C19.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp1C19.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp1C19.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp842E.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp842E.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp842E.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
memory/316-95-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-107-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-66-0x00000000020D0000-0x0000000002150000-memory.dmpFilesize
512KB
-
memory/316-69-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-67-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-71-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-73-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-79-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-77-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-75-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-85-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-83-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-81-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-87-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-89-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-91-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-97-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-64-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-93-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-99-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-101-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-103-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-105-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-62-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-109-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-111-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-113-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-115-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-121-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-119-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-117-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-1188-0x000000001ADE0000-0x000000001AE2E000-memory.dmpFilesize
312KB
-
memory/316-1189-0x00000000020D0000-0x0000000002150000-memory.dmpFilesize
512KB
-
memory/316-1190-0x000000001B020000-0x000000001B06C000-memory.dmpFilesize
304KB
-
memory/316-1191-0x000000001B080000-0x000000001B0D4000-memory.dmpFilesize
336KB
-
memory/316-54-0x0000000000A30000-0x0000000000CA0000-memory.dmpFilesize
2.4MB
-
memory/316-55-0x000000001A860000-0x000000001A8E6000-memory.dmpFilesize
536KB
-
memory/316-1200-0x00000000020D6000-0x000000000210D000-memory.dmpFilesize
220KB
-
memory/316-56-0x000000001B430000-0x000000001B4D6000-memory.dmpFilesize
664KB
-
memory/316-57-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-58-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/316-60-0x000000001B430000-0x000000001B4D2000-memory.dmpFilesize
648KB
-
memory/848-1206-0x0000000001360000-0x00000000015D0000-memory.dmpFilesize
2.4MB
-
memory/916-1202-0x0000000002940000-0x00000000029C0000-memory.dmpFilesize
512KB
-
memory/916-1201-0x0000000002940000-0x00000000029C0000-memory.dmpFilesize
512KB
-
memory/916-1199-0x0000000002940000-0x00000000029C0000-memory.dmpFilesize
512KB
-
memory/916-1198-0x00000000022F0000-0x00000000022F8000-memory.dmpFilesize
32KB
-
memory/916-1197-0x000000001B170000-0x000000001B452000-memory.dmpFilesize
2.9MB