db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25/08/2023, 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe
Size

5.9MB
MD5

01e05dafcd29db2791b53e1c51464baf
SHA1

ee07d4d568f5354a3bfb85c1ddb8ee16edd4f420
SHA256

db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb
SHA512

ba0d6d81e79902bf6d37aac0b3aa8722134c26ce454d2f3fa622759c3af3526f486056f76ea4bcb46ab4ecd74a283cc61f2020130fe93546118b5818f979abcc
SSDEEP

98304:j2d9SyjMmxu5fZIdtLiZT7y1jsL6EZXp8IOddaRuc5Gh5vH3CYht5fDC3jKAs7gN:jK9SyjoKz1jeNtUcUf/yiDC3jxsORws

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2228	Windows10UpgraderApp.exe

Loads dropped DLL 6 IoCs

pid	Process
2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe
2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe
2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe
2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe
2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe
2228	Windows10UpgraderApp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\International\CpMRU	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	Windows10UpgraderApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	Windows10UpgraderApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Windows10UpgraderApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Windows10UpgraderApp.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	Windows10UpgraderApp.exe
2228	Windows10UpgraderApp.exe
2228	Windows10UpgraderApp.exe
2228	Windows10UpgraderApp.exe
2228	Windows10UpgraderApp.exe
2228	Windows10UpgraderApp.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2228	2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe	28
PID 2896 wrote to memory of 2228	2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe	28
PID 2896 wrote to memory of 2228	2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe	28
PID 2896 wrote to memory of 2228	2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe	28
PID 2896 wrote to memory of 2228	2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe	28
PID 2896 wrote to memory of 2228	2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe	28
PID 2896 wrote to memory of 2228	2896	db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe	28

C:\Users\Admin\AppData\Local\Temp\db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe
"C:\Users\Admin\AppData\Local\Temp\db2070423366f617d529640c7fafe3b803af300024c82bb6e3778e016e3731eb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows10Upgrade\Windows10UpgraderApp.exe
  "C:\Windows10Upgrade\Windows10UpgraderApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB0C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU92BE.tmp\2052\DWINTL20.DLL

Filesize
109KB

MD5
6ecb02e195cf345d72ff5eb73d250ec3

SHA1
2c5a797c406fa29bd19cecf6ea94abb8a11a1f10

SHA256
41a35d57a1ae29ae41a5150208363f7346d302ede90b3d0039e38a3d402c83b3

SHA512
f69372428d5a472d857317b72b90526fd40d7b53fe9070f34d3a5d870e8ffcbd69646ae2a38288a9672d397f6c393e0ddf906fdb596b8a46f8a82b0f68b3b15d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU92BE.tmp\resources\i386\BiosBlocks.xml

Filesize
89KB

MD5
016caf04ffc6c87ddac9e1c43b161ef4

SHA1
e8bcbe431c5b9c0ff5da08c55f103166072cb8ce

SHA256
46d77b5101ca947d1ddd4d1dd727bfec6db65cb2d84ccb8817426aa5bf949bc4

SHA512
38085d057a0f988da5a2b33b31675339e9ee7e335bfe0cacca0b1f0209231de0deae931e38c28df15e698e7871d57ec11c74dfa9680c705dd91d245027584b52

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU92BE.tmp\resources\i386\nxquery.inf

Filesize
1KB

MD5
ae8053b0e0ed71b40da08ec58a9fd95a

SHA1
9ca4b71eae874fb37554d7c8898722160b2eb183

SHA256
563dc06f3f4a15860c2107181f6660aeff256b587748b6ce9df72c3ae1118d04

SHA512
5042ba84216bb312dbb91f9cc1be4e376105fa1a608a4b99cd7495afb7088243dcc701944da48751416a290c37ff71a153cbd2561fb2bff04bb5361e5c335dc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU92BE.tmp\resources\ux\EULA\EULA_en-us.htm

Filesize
57KB

MD5
7c109a8b0471d8e9e30cc79e6cb5924e

SHA1
f29901be4eadee321d2054a95b95cc6bb0d8d05f

SHA256
4d57b34f6a5b7f54222a4660985dfbd0085aec044d304c33d3f45bd51a5a4b38

SHA512
55fe987593b5536b0aad4f0d2e762464a76e1102e42b5cc1c86e0324158dd15f93125bff756243d4c511395bf1f5762c81c35940d59cea0dff84215560044e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU92BE.tmp\resources\ux\EULA\EULA_es-mx.htm

Filesize
68KB

MD5
0c51b01fbe3482e4b45971f0d3aeb50b

SHA1
4b747adbce3c297eaec01ad9978fd274bacba9ba

SHA256
2e1db75000aac4df4765a74d3f763e3b1e2ccfb7f2ff04894899de735fda459e

SHA512
ed8ee1dbf1bc6a801fdcd32ad61ec9b558b192cd519d2b10550c600dcf9a8107ce5f908ccf3f175314d33cc065fa9046fe212504c6252e2d6b526458b370a7fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU92BE.tmp\resources\ux\EULA\EULA_fr-fr.htm

Filesize
67KB

MD5
d01ab717aeda0f9ce5d71797e08dfb47

SHA1
535196ade3ada94262020612fea2442701e6c78a

SHA256
0fdcb589ffe9926017123e53f5d453aac8df8d222901d25efa30b7d027c944bd

SHA512
957b26b79bfd28094060365ae42b46e6937d063c4bff34c2781938ba6b434f5af7182accbb00860b167b236ac4bf0e3ebcc4cebad5aa7fa8a431239319ef622e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU92BE.tmp\resources\ux\EULA\EULA_zh-tw.htm

Filesize
143KB

MD5
5a48a6e0569768bf3e27ea2afb7c5c93

SHA1
3cd66bc29ff79b79fddc41afc1be92efc7203ab7

SHA256
0e8d3db5a662ed19d4dafce5bca4ef399a637c705e226718e3804f9664a1deb9

SHA512
f0a622baad0e30c66ac3422c49aa7074654cb6c246ecd7d69d5a8c198bd55e9bccd4cc2f89a9adf5b5f485892dbad2cbb97d15dc4a110b37b5fdb09a00fd505d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU92BE.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css

Filesize
40KB

MD5
415d4bb726c52bd91be8f3afd81e50cc

SHA1
9732e1e6aeb13a6f180b21bb5bd8a4acf7d96dbd

SHA256
c6dd0940a263382fb735f1cdc8550234f9c081625bfe2e5363cb8bb65cc06440

SHA512
c7a8b805027906d8b67d50773a7e362f2e87d3af61b23fab33aec929e21f42610a35f857ede9a17772c5f2b42c1382f8daf7240b76f3996aa65988a87c367847

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXU92BE.tmp\resources\ux\default_tens.htm

Filesize
57KB

MD5
63a4229ad01dbd6226ed35ec402f33ec

SHA1
6c905a00856737fb53ccac3febe5716668b65960

SHA256
0cc9b5da1f665df4758b81878f0fe32c69d5566665958cd6b0a6e11ab68ee879

SHA512
01d1cdfbb9f537062944a4edcd43a9286c161f9cc9ba75505e7617f58317590f4fbd2717f0589db73c83e04301baf8df8a149aa4ba359c71dca764c52dea0312

Download Submit
C:\Windows10Upgrade\Downloader.dll

Filesize
200KB

MD5
15546827068240b2d496b78b631c2736

SHA1
62131480789dd1f4121d0667d0b40c9c54e8bf2b

SHA256
c7fbfb2a1cb5fa223cbbeecc50353ea48146bd7a909366bdde7cf01d553c884e

SHA512
eb9a1ac5dff85c8e293e211d98f8963b76967de65d03a8b3fc67767665bcdc18156de6b5d211fb414d89adcd1cbc4915a22269077ed12c65adee54665ba99348

Download Submit
C:\Windows10Upgrade\Windows10UpgraderApp.exe

Filesize
1.9MB

MD5
4b24d6dd32482d252dd61f856c719531

SHA1
091977a8c83447b01bf9a0ca90e2e4f6e5de37a1

SHA256
daabb3aef3ba7bb5ef598f7c755ca417844622954a3d7128a3dbd0a5a40474f8

SHA512
3253dd913b5b6e2efd3c979158974425af9c8084d16fed003a31b12cd92d5eab4049fcc2e71ded728645fa9ee807195ced113d3a6633dce10ab2db9078d0a09d

Download Submit
C:\Windows10Upgrade\Windows10UpgraderApp.exe

Filesize
1.9MB

MD5
4b24d6dd32482d252dd61f856c719531

SHA1
091977a8c83447b01bf9a0ca90e2e4f6e5de37a1

SHA256
daabb3aef3ba7bb5ef598f7c755ca417844622954a3d7128a3dbd0a5a40474f8

SHA512
3253dd913b5b6e2efd3c979158974425af9c8084d16fed003a31b12cd92d5eab4049fcc2e71ded728645fa9ee807195ced113d3a6633dce10ab2db9078d0a09d

Download Submit
C:\Windows10Upgrade\Windows10UpgraderApp.exe

Filesize
1.9MB

MD5
4b24d6dd32482d252dd61f856c719531

SHA1
091977a8c83447b01bf9a0ca90e2e4f6e5de37a1

SHA256
daabb3aef3ba7bb5ef598f7c755ca417844622954a3d7128a3dbd0a5a40474f8

SHA512
3253dd913b5b6e2efd3c979158974425af9c8084d16fed003a31b12cd92d5eab4049fcc2e71ded728645fa9ee807195ced113d3a6633dce10ab2db9078d0a09d

Download Submit
C:\Windows10Upgrade\resources\ux\EULA.css

Filesize
82B

MD5
b81d1e97c529ac3d7f5a699afce27080

SHA1
0a981264db289afd71695b4d6849672187e8120f

SHA256
35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225

SHA512
e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607

Download Submit
C:\Windows10Upgrade\resources\ux\EULA\EULA_en-us.htm

Filesize
57KB

MD5
7c109a8b0471d8e9e30cc79e6cb5924e

SHA1
f29901be4eadee321d2054a95b95cc6bb0d8d05f

SHA256
4d57b34f6a5b7f54222a4660985dfbd0085aec044d304c33d3f45bd51a5a4b38

SHA512
55fe987593b5536b0aad4f0d2e762464a76e1102e42b5cc1c86e0324158dd15f93125bff756243d4c511395bf1f5762c81c35940d59cea0dff84215560044e0d

Download Submit
C:\Windows10Upgrade\resources\ux\bullet.png

Filesize
221B

MD5
baaa93b2584336c8e2fd561ccaab5391

SHA1
0523f0a835781e2f499f166d405bcdaf48c89a3a

SHA256
d548b0a3da3f8aa61aa880b2af3ba7997304253d763de1b8b1e3906b9adb5363

SHA512
7ca20ee57a778ed02a1771a9b622aa7b0859cee55036ec323e00e0ab1f6be4defad45bd48aab62f54645fa13c3d49b30fd68c0318e3d83465b42e20d05f6c391

Download Submit
C:\Windows10Upgrade\resources\ux\default.css

Filesize
5KB

MD5
75dc1deb03880b98eea8c7aaa0290c48

SHA1
37e8ff2edb6a606c8455f2cef8d34e87c4ce22e0

SHA256
e5d182eb14246c3551bec763bfea90aaacb1338c3a41316502d4204eead79900

SHA512
09e2554785bf6494f64f6e0fe01ef048d8ed7ff9a6d88e9c490fb6815f934bb677880e8176b9131e037133840f96f157be7d226907fdc37142e7eee3f0f61125

Download Submit
C:\Windows10Upgrade\resources\ux\default.htm

Filesize
60KB

MD5
16c900c83a44eac2706a011d1244d88d

SHA1
2ac28524821d32780a618899adb1b1dc925dbad5

SHA256
22caf9de499840e34585efe0de7348aebfa2f38035f6941921434051d7b865d1

SHA512
e299f3915300be06b1027223294ed3019f6c90190f3d8967439b189acd5aaeb1a52e439572a8837854fb3a95f52d1ba2fbc1383501badda52fd33198cc7fcf5e

Download Submit
C:\Windows10Upgrade\resources\ux\loading.gif

Filesize
16KB

MD5
1a276cb116bdece96adf8e32c4af4fee

SHA1
6bc30738fcd0c04370436f4d3340d460d25b788f

SHA256
9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618

SHA512
5b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6

Download Submit
C:\Windows10Upgrade\resources\ux\logo.png

Filesize
2KB

MD5
afeed45df4d74d93c260a86e71e09102

SHA1
2cc520e3d23f6b371c288645649a482a5db7ccd9

SHA256
f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f

SHA512
778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d

Download Submit
C:\Windows10Upgrade\resources\ux\marketing.png

Filesize
493B

MD5
1c53c2d567ba6050d9a23d86cfba84cc

SHA1
3bc38656cadf574c377ec39733ebce9e8de75138

SHA256
81f5372b0875476184f7c4d04eb4c805706e41bd979a9acd1f1d55105e17e530

SHA512
3ed2dd645af7d3bd0026a253ac2c5a0503b04f88629012dd479d8068a8e6c07a916350f8ce54c0e21faf97b27a9e607eafe86edd28976b168914e3379bf272df

Download Submit
\Windows10Upgrade\Windows10UpgraderApp.exe

Filesize
1.9MB

MD5
4b24d6dd32482d252dd61f856c719531

SHA1
091977a8c83447b01bf9a0ca90e2e4f6e5de37a1

SHA256
daabb3aef3ba7bb5ef598f7c755ca417844622954a3d7128a3dbd0a5a40474f8

SHA512
3253dd913b5b6e2efd3c979158974425af9c8084d16fed003a31b12cd92d5eab4049fcc2e71ded728645fa9ee807195ced113d3a6633dce10ab2db9078d0a09d

Download Submit
\Windows10Upgrade\Windows10UpgraderApp.exe

Filesize
1.9MB

MD5
4b24d6dd32482d252dd61f856c719531

SHA1
091977a8c83447b01bf9a0ca90e2e4f6e5de37a1

SHA256
daabb3aef3ba7bb5ef598f7c755ca417844622954a3d7128a3dbd0a5a40474f8

SHA512
3253dd913b5b6e2efd3c979158974425af9c8084d16fed003a31b12cd92d5eab4049fcc2e71ded728645fa9ee807195ced113d3a6633dce10ab2db9078d0a09d

Download Submit
\Windows10Upgrade\Windows10UpgraderApp.exe

Filesize
1.9MB

MD5
4b24d6dd32482d252dd61f856c719531

SHA1
091977a8c83447b01bf9a0ca90e2e4f6e5de37a1

SHA256
daabb3aef3ba7bb5ef598f7c755ca417844622954a3d7128a3dbd0a5a40474f8

SHA512
3253dd913b5b6e2efd3c979158974425af9c8084d16fed003a31b12cd92d5eab4049fcc2e71ded728645fa9ee807195ced113d3a6633dce10ab2db9078d0a09d

Download Submit
\Windows10Upgrade\Windows10UpgraderApp.exe

Filesize
1.9MB

MD5
4b24d6dd32482d252dd61f856c719531

SHA1
091977a8c83447b01bf9a0ca90e2e4f6e5de37a1

SHA256
daabb3aef3ba7bb5ef598f7c755ca417844622954a3d7128a3dbd0a5a40474f8

SHA512
3253dd913b5b6e2efd3c979158974425af9c8084d16fed003a31b12cd92d5eab4049fcc2e71ded728645fa9ee807195ced113d3a6633dce10ab2db9078d0a09d

Download Submit
\Windows10Upgrade\Windows10UpgraderApp.exe

Filesize
1.9MB

MD5
4b24d6dd32482d252dd61f856c719531

SHA1
091977a8c83447b01bf9a0ca90e2e4f6e5de37a1

SHA256
daabb3aef3ba7bb5ef598f7c755ca417844622954a3d7128a3dbd0a5a40474f8

SHA512
3253dd913b5b6e2efd3c979158974425af9c8084d16fed003a31b12cd92d5eab4049fcc2e71ded728645fa9ee807195ced113d3a6633dce10ab2db9078d0a09d

Download Submit
\Windows10Upgrade\downloader.dll

Filesize
200KB

MD5
15546827068240b2d496b78b631c2736

SHA1
62131480789dd1f4121d0667d0b40c9c54e8bf2b

SHA256
c7fbfb2a1cb5fa223cbbeecc50353ea48146bd7a909366bdde7cf01d553c884e

SHA512
eb9a1ac5dff85c8e293e211d98f8963b76967de65d03a8b3fc67767665bcdc18156de6b5d211fb414d89adcd1cbc4915a22269077ed12c65adee54665ba99348

Download Submit