7ddac8d4b49bd592b4df787192049ff6b749e35a93c493349c25f4afb8509182

General

Target

093d73419d1dca88325574efa066187f.exe
Size

80KB
MD5

093d73419d1dca88325574efa066187f
SHA1

8df49558e24c7b8de07ddfeea97bc1718f07cb88
SHA256

7ddac8d4b49bd592b4df787192049ff6b749e35a93c493349c25f4afb8509182
SHA512

bfb1a619d684d100a2fe2ae33b2ccd23222849efcda3a4a17093e8e431cfc1edb6d0eda8834ce1e47dbbebe205884b863c2187905733f2fd7da6197df64049c1
SSDEEP

1536:yTMqmlsFMMW240jC3o91Q2XUkGe5Ok4WLhqf1sxu4J8uzbKp:EylxMm+1Q2XBGep4W21aB8uvK

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2864	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1320	winxpupdates.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\ndows XP Updates And Paches = "C:\\Windows\\winxpupdates.exe"	winxpupdates.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ndows XP Updates And Paches = "C:\\Windows\\winxpupdates.exe"	093d73419d1dca88325574efa066187f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\ndows XP Updates And Paches = "C:\\Windows\\winxpupdates.exe"	093d73419d1dca88325574efa066187f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ndows XP Updates And Paches = "C:\\Windows\\winxpupdates.exe"	winxpupdates.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\winxpupdates.exe	093d73419d1dca88325574efa066187f.exe
File opened for modification	C:\Windows\winxpupdates.exe	093d73419d1dca88325574efa066187f.exe
File created	C:\Windows\winxpupdates.dll	winxpupdates.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "no"	winxpupdates.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FormSuggest PW Ask = "no"	winxpupdates.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FormSuggest Passwords = "no"	winxpupdates.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1320	winxpupdates.exe
Token: SeBackupPrivilege	1320	winxpupdates.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1320	1064	093d73419d1dca88325574efa066187f.exe	28
PID 1064 wrote to memory of 1320	1064	093d73419d1dca88325574efa066187f.exe	28
PID 1064 wrote to memory of 1320	1064	093d73419d1dca88325574efa066187f.exe	28
PID 1064 wrote to memory of 1320	1064	093d73419d1dca88325574efa066187f.exe	28
PID 1064 wrote to memory of 1320	1064	093d73419d1dca88325574efa066187f.exe	28
PID 1064 wrote to memory of 1320	1064	093d73419d1dca88325574efa066187f.exe	28
PID 1064 wrote to memory of 1320	1064	093d73419d1dca88325574efa066187f.exe	28
PID 1064 wrote to memory of 2864	1064	093d73419d1dca88325574efa066187f.exe	29
PID 1064 wrote to memory of 2864	1064	093d73419d1dca88325574efa066187f.exe	29
PID 1064 wrote to memory of 2864	1064	093d73419d1dca88325574efa066187f.exe	29
PID 1064 wrote to memory of 2864	1064	093d73419d1dca88325574efa066187f.exe	29
PID 1320 wrote to memory of 2868	1320	winxpupdates.exe	31
PID 1320 wrote to memory of 2868	1320	winxpupdates.exe	31
PID 1320 wrote to memory of 2868	1320	winxpupdates.exe	31
PID 1320 wrote to memory of 2868	1320	winxpupdates.exe	31
PID 1320 wrote to memory of 2868	1320	winxpupdates.exe	31

C:\Users\Admin\AppData\Local\Temp\093d73419d1dca88325574efa066187f.exe
"C:\Users\Admin\AppData\Local\Temp\093d73419d1dca88325574efa066187f.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\winxpupdates.exe
  "C:\Windows\winxpupdates.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\093d73419d1dca88325574efa066187f.bat
  2⤵
  - Deletes itself
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\093d73419d1dca88325574efa066187f.bat

Filesize
348B

MD5
f4f3a1b900af3f4ebd669e7f6e2db37c

SHA1
f9a7f11ad38a827345b32d151097970c44be7cf2

SHA256
ad8af192da2f4899cbcfe6254536bb92b8ed1396397e95e817b6e6819dad19b4

SHA512
e8e94caa0c0b9215db82b38a6155e6b1490437f28cd8cd915f560c07126fa313efe803eeed9f110de8c4f81482776df015fd50ffa2ca3bbea545d7453be44fbc

Download Submit
C:\Windows\winxpupdates.exe

Filesize
80KB

MD5
093d73419d1dca88325574efa066187f

SHA1
8df49558e24c7b8de07ddfeea97bc1718f07cb88

SHA256
7ddac8d4b49bd592b4df787192049ff6b749e35a93c493349c25f4afb8509182

SHA512
bfb1a619d684d100a2fe2ae33b2ccd23222849efcda3a4a17093e8e431cfc1edb6d0eda8834ce1e47dbbebe205884b863c2187905733f2fd7da6197df64049c1

Download Submit
memory/1064-13-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1320-16-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads