Overview

overview

7

Static

static

1

Windows10U...52.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    158s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2023, 15:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Windows10Upgrade9252.exe
  • Size 3.2MB
  • Sample231016-sg741abb75
  • SHA256 c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4440
    • C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
      "C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1336
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 1928
        3⤵
        • Program crash
        PID:2724
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1336 -ip 1336
    1⤵
      PID:2548

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Configuration.ini
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini
          • Size 27B
          • SHA256 299fa3043627954c524b6171c26fcc3513790310aa2561e6f012eff15254381c
          • MD5 SHA1 SHA512
          Submit Download

          Downloader.dll
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\Downloader.dll
          • Size 197KB
          • SHA256 96f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Windows10UpgraderApp.exe
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
          • Size 3.5MB
          • SHA256 f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Windows10UpgraderApp.exe
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
          • Size 3.5MB
          • SHA256 f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Windows10UpgraderApp.exe
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe
          • Size 3.5MB
          • SHA256 f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          downloader.dll
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll
          • Size 197KB
          • SHA256 96f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          EULA.css
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\EULA.css
          • Size 82B
          • SHA256 35c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225
          • MD5 SHA1 SHA512
          Submit Download

          default.css
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css
          • Size 5KB
          • SHA256 453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          default.htm
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm
          • Size 60KB
          • SHA256 40f468006ab37ef4fcc54c5ff25005644f15d696f1269f67b450c9e3ce5e8d23
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          loading.gif
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif
          • Size 16KB
          • SHA256 9d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          logo.png
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png
          • Size 2KB
          • SHA256 f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f
          • MD5 SHA1 SHA512
          Submit Download

          marketing.png
          • Path C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png
          • Size 420B
          • SHA256 b210f3b072c60c2feb959e56c529e24cec77c1fcf933dcadad1f491f974f5e96
          • MD5 SHA1 SHA512
          Submit Download

          appraiserxp.dll
          • Path C:\Users\Admin\AppData\Local\Temp\WXUFA8C.tmp\appraiserxp.dll
          • Size 363KB
          • SHA256 770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          oobe-desktop.css
          • Path C:\Users\Admin\AppData\Local\Temp\WXUFA8C.tmp\resources\ux\Microsoft.WinJS\css\oobe-desktop.css
          • Size 39KB
          • SHA256 03a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download