2d7e5db3c3ef36c128840f90f742f4aa4764582eb73422bb08ac1c009f7eea07

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27-11-2023 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d7e5db3c3ef36c128840f90f742f4aa4764582eb73422bb08ac1c009f7eea07.exe
Size

1.4MB
MD5

4ee3e0f5ebe942ae0b52d7870522fce4
SHA1

6a3faf5d7e047df6078bb02de917ab43d8bd1f5b
SHA256

2d7e5db3c3ef36c128840f90f742f4aa4764582eb73422bb08ac1c009f7eea07
SHA512

b018c4825b6866b511df77632878b66340d4971bd904103ba895ce6f25ad21c48c9749c1535c0cf5ba1861cd2e9798770e842f8cf2f31c2d2ca0602fc79afe0b
SSDEEP

24576:8LZmQR3caJZLZmvNzc0TDZodoSRsfHMbvmQm0:4ZmQyaJ1ZmFcqi+SRAG+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3000	Update.dat

Loads dropped DLL 2 IoCs

pid	Process
1584	2d7e5db3c3ef36c128840f90f742f4aa4764582eb73422bb08ac1c009f7eea07.exe
3000	Update.dat

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	Update.dat
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CENTRALPROCESSOR\0\~MHZ	Update.dat

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	Update.dat
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 33004300370038003700350030003800390033003200360042003100430034000000	Update.dat

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	Update.dat
Token: SeTcbPrivilege	3000	Update.dat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3000	1584	2d7e5db3c3ef36c128840f90f742f4aa4764582eb73422bb08ac1c009f7eea07.exe	28
PID 1584 wrote to memory of 3000	1584	2d7e5db3c3ef36c128840f90f742f4aa4764582eb73422bb08ac1c009f7eea07.exe	28
PID 1584 wrote to memory of 3000	1584	2d7e5db3c3ef36c128840f90f742f4aa4764582eb73422bb08ac1c009f7eea07.exe	28

C:\Users\Admin\AppData\Local\Temp\2d7e5db3c3ef36c128840f90f742f4aa4764582eb73422bb08ac1c009f7eea07.exe
"C:\Users\Admin\AppData\Local\Temp\2d7e5db3c3ef36c128840f90f742f4aa4764582eb73422bb08ac1c009f7eea07.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\Update.dat
  C:\Users\Admin\AppData\Local\Temp\\Update.dat
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Update.dat

Filesize
1.4MB

MD5
9c82a9b1bd5c42b62b9aa2657b042819

SHA1
fea4e441eccc4f8a1fb1e4480c5bc34f2d200bb6

SHA256
c0a081e6d5e0279be4503f26f0b01bcedeebf1dfb95fcbe4fb935f881d111da0

SHA512
c41f504b8d515835c1d5a3fe1c9028e4c2d203f0cd342fbe8928bc17c2ee8684880d0310eb88ba6828d667739ae4f06d92bdc198f16ae1a9b737e768074e53e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\wwlib.dll

Filesize
13KB

MD5
e53fa6f3b0790825151836fd5fdce3cc

SHA1
a6c9b6391ada3e9bb4cfcbfc4e22b770122448a7

SHA256
70a88e196d6830725409ab86ac05199b66d72380b369a2cfecb0ccb1bd4a5b78

SHA512
49fa492bbfde40ccaf875001c4455def14617d9a40b36d9da53f4293df9b66633bb88d6fba66c59852fc055871d8c837df0d269cd2b135a9282b35c209aaadc8

Download Submit
\Users\Admin\AppData\Local\Temp\Update.dat

Filesize
1.4MB

MD5
9c82a9b1bd5c42b62b9aa2657b042819

SHA1
fea4e441eccc4f8a1fb1e4480c5bc34f2d200bb6

SHA256
c0a081e6d5e0279be4503f26f0b01bcedeebf1dfb95fcbe4fb935f881d111da0

SHA512
c41f504b8d515835c1d5a3fe1c9028e4c2d203f0cd342fbe8928bc17c2ee8684880d0310eb88ba6828d667739ae4f06d92bdc198f16ae1a9b737e768074e53e8

Download Submit
\Users\Admin\AppData\Local\Temp\wwlib.dll

Filesize
13KB

MD5
e53fa6f3b0790825151836fd5fdce3cc

SHA1
a6c9b6391ada3e9bb4cfcbfc4e22b770122448a7

SHA256
70a88e196d6830725409ab86ac05199b66d72380b369a2cfecb0ccb1bd4a5b78

SHA512
49fa492bbfde40ccaf875001c4455def14617d9a40b36d9da53f4293df9b66633bb88d6fba66c59852fc055871d8c837df0d269cd2b135a9282b35c209aaadc8

Download Submit
memory/3000-7-0x0000000000410000-0x0000000000424000-memory.dmp

Filesize
80KB

Download
memory/3000-8-0x0000000000460000-0x000000000048F000-memory.dmp

Filesize
188KB

Download
memory/3000-9-0x0000000000460000-0x000000000048F000-memory.dmp

Filesize
188KB

Download
memory/3000-19-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/3000-20-0x0000000000460000-0x000000000048F000-memory.dmp

Filesize
188KB

Download
memory/3000-22-0x0000000000460000-0x000000000048F000-memory.dmp

Filesize
188KB

Download
memory/3000-21-0x0000000000460000-0x000000000048F000-memory.dmp

Filesize
188KB

Download
memory/3000-23-0x0000000000460000-0x000000000048F000-memory.dmp

Filesize
188KB

Download