7e8c5870b932c264e3117464db964e489ff9cdbd09cf0c21781f40569c9d45a0

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WindowsXP-KB2570791-x86-RUS.exe
Size

509KB
MD5

5d5064604383c14c72cc372dee4b44f1
SHA1

195be95af096dd120526cd675109ef30f96cd748
SHA256

7e8c5870b932c264e3117464db964e489ff9cdbd09cf0c21781f40569c9d45a0
SHA512

168ae184ce7ec52324d644ac888cae434c6c1de95318157d675b5e804a082d702408a0812a8da5ee2326e89438d3b025f7805fa5757db8bd81eb88560e77f765
SSDEEP

12288:wSpAs48tCYSFoHcvtbWDflT6D0B/w6nKZA:wSKFkhEoiwbh6DJiKm

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2780	update.exe

Loads dropped DLL 7 IoCs

pid	Process
1668	WindowsXP-KB2570791-x86-RUS.exe
1668	WindowsXP-KB2570791-x86-RUS.exe
2780	update.exe
2780	update.exe
2780	update.exe
2780	update.exe
2780	update.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\TZLog.log	update.exe
File created	C:\Windows\SysWOW64\TZLog.log	update.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\setupapi.log	update.exe
File opened for modification	\??\c:\windows\KB2570791.log	update.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	2780	update.exe
Token: SeRestorePrivilege	2780	update.exe
Token: SeShutdownPrivilege	2780	update.exe
Token: SeSecurityPrivilege	2780	update.exe
Token: SeTakeOwnershipPrivilege	2780	update.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2780	1668	WindowsXP-KB2570791-x86-RUS.exe	28
PID 1668 wrote to memory of 2780	1668	WindowsXP-KB2570791-x86-RUS.exe	28
PID 1668 wrote to memory of 2780	1668	WindowsXP-KB2570791-x86-RUS.exe	28
PID 1668 wrote to memory of 2780	1668	WindowsXP-KB2570791-x86-RUS.exe	28
PID 1668 wrote to memory of 2780	1668	WindowsXP-KB2570791-x86-RUS.exe	28
PID 1668 wrote to memory of 2780	1668	WindowsXP-KB2570791-x86-RUS.exe	28
PID 1668 wrote to memory of 2780	1668	WindowsXP-KB2570791-x86-RUS.exe	28

C:\Users\Admin\AppData\Local\Temp\WindowsXP-KB2570791-x86-RUS.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsXP-KB2570791-x86-RUS.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668
- \??\c:\204c8e8c705a5c1d0a\update\update.exe
  c:\204c8e8c705a5c1d0a\update\update.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\204c8e8c705a5c1d0a\update\update.exe

Filesize
742KB

MD5
6448298a916179bfc323b84d77b0366f

SHA1
8c7746310d0804e5ef794e2d0cf38d2c01d71c11

SHA256
3de1977461c147188814f8980492098c689f63a6149ce605a06f360e81cd9ecf

SHA512
49296169eda2399f42acc22039bce451d090970606e3f37409451cc52afdb613bea34916905568479bc469cc9af33ad6359bf8ed1fd13b192bd9fdcabc972e2e

Download Submit
\204c8e8c705a5c1d0a\_sfx_.dll

Filesize
25KB

MD5
ee207e35aea4d5df41d90221e1b66efa

SHA1
757469cf9ad2f21f267bbe730560114fdf8a89a5

SHA256
cf64c95e9a2d02967efc22b00efb3736156b913a95231eb63c1df45d43475e64

SHA512
43e9f75725daa4f3428b2d9cee2c2cc8b2f2e991b8e58d72d2f429fbdfb614c86d172f03d3f9da98756bd4e245643d9a57c6efa422d6c60ad364a2322245542d

Download Submit
\204c8e8c705a5c1d0a\update\tzchange.dll

Filesize
16KB

MD5
ccc914b9eefac20798531ee018c38414

SHA1
4b6ea0b8354a26a334adee1d5355311dd37951df

SHA256
b1392ee0e830e6e27567a7857b68547d2e6bcf4a1dc8bae7218a7acbc64df59a

SHA512
73e8040a89d596f0e3591a49bf684ba5c4d8eece3b164d311ee424f69e9689e6aae95f01cf92472150a8715ca9378b9038ac362b177fd20e4645d9fdd0a28787

Download Submit
\204c8e8c705a5c1d0a\update\update.exe

Filesize
742KB

MD5
6448298a916179bfc323b84d77b0366f

SHA1
8c7746310d0804e5ef794e2d0cf38d2c01d71c11

SHA256
3de1977461c147188814f8980492098c689f63a6149ce605a06f360e81cd9ecf

SHA512
49296169eda2399f42acc22039bce451d090970606e3f37409451cc52afdb613bea34916905568479bc469cc9af33ad6359bf8ed1fd13b192bd9fdcabc972e2e

Download Submit
\204c8e8c705a5c1d0a\update\update.exe

Filesize
742KB

MD5
6448298a916179bfc323b84d77b0366f

SHA1
8c7746310d0804e5ef794e2d0cf38d2c01d71c11

SHA256
3de1977461c147188814f8980492098c689f63a6149ce605a06f360e81cd9ecf

SHA512
49296169eda2399f42acc22039bce451d090970606e3f37409451cc52afdb613bea34916905568479bc469cc9af33ad6359bf8ed1fd13b192bd9fdcabc972e2e

Download Submit
\204c8e8c705a5c1d0a\update\update.exe

Filesize
742KB

MD5
6448298a916179bfc323b84d77b0366f

SHA1
8c7746310d0804e5ef794e2d0cf38d2c01d71c11

SHA256
3de1977461c147188814f8980492098c689f63a6149ce605a06f360e81cd9ecf

SHA512
49296169eda2399f42acc22039bce451d090970606e3f37409451cc52afdb613bea34916905568479bc469cc9af33ad6359bf8ed1fd13b192bd9fdcabc972e2e

Download Submit
\204c8e8c705a5c1d0a\update\update.exe

Filesize
742KB

MD5
6448298a916179bfc323b84d77b0366f

SHA1
8c7746310d0804e5ef794e2d0cf38d2c01d71c11

SHA256
3de1977461c147188814f8980492098c689f63a6149ce605a06f360e81cd9ecf

SHA512
49296169eda2399f42acc22039bce451d090970606e3f37409451cc52afdb613bea34916905568479bc469cc9af33ad6359bf8ed1fd13b192bd9fdcabc972e2e

Download Submit
\204c8e8c705a5c1d0a\update\updspapi.dll

Filesize
381KB

MD5
22447db73cff57878a9e620b0ad9d0f0

SHA1
5d989ef4a00ba8be23855ce9d32ad073a31f2966

SHA256
a4a7fbd376fce123882ec2e2e415e5b1bd49d600da3903049bf1c0e1dc9be28d

SHA512
a085de17be308c26271c8ba5a999924a12de5f6bd0c01957ed51413cbe5207bcd80ca1f917885ed1bfc2965e3c35ef773a22ec45a8f404f91725ec64d53702ce

Download Submit
\??\c:\204c8e8c705a5c1d0a\update\tzchange.dll

Filesize
16KB

MD5
ccc914b9eefac20798531ee018c38414

SHA1
4b6ea0b8354a26a334adee1d5355311dd37951df

SHA256
b1392ee0e830e6e27567a7857b68547d2e6bcf4a1dc8bae7218a7acbc64df59a

SHA512
73e8040a89d596f0e3591a49bf684ba5c4d8eece3b164d311ee424f69e9689e6aae95f01cf92472150a8715ca9378b9038ac362b177fd20e4645d9fdd0a28787

Download Submit
memory/2780-43-0x0000000000170000-0x00000000001D0000-memory.dmp

Filesize
384KB

Download