Analysis
-
max time kernel
11s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 03:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
739e065498d059c844eefc77fc7b24f9.exe
Resource
win7-20231215-en
windows7-x64
18 signatures
150 seconds
General
-
Target
739e065498d059c844eefc77fc7b24f9.exe
-
Size
302KB
-
MD5
739e065498d059c844eefc77fc7b24f9
-
SHA1
211897080482917df88878aa243afdda50d21866
-
SHA256
e7f623cc90369141f45b02da8a9356696fab3e633d4ed695100450d738659372
-
SHA512
2ce2a9935b59702761e8def79c77afd1b4d84ad98106e0691c2830400f95967a44ff67c20fdcc06bd6d811b6e0ad9c57b7317a1348399778dffa815145a5e835
-
SSDEEP
6144:KXjuCLdRD3rzCJaCnmYi7wSMsAeFJF03YCTdVJkpbl:1CxRD3reJ726sAeFT03FTdgJ
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" 739e065498d059c844eefc77fc7b24f9.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" winupdate.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winupdate.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2732 attrib.exe 2900 attrib.exe -
Executes dropped EXE 2 IoCs
pid Process 2628 winupdate.exe 2712 winupdate.exe -
Loads dropped DLL 8 IoCs
pid Process 2072 739e065498d059c844eefc77fc7b24f9.exe 2628 winupdate.exe 2628 winupdate.exe 2628 winupdate.exe 2628 winupdate.exe 2712 winupdate.exe 2712 winupdate.exe 2712 winupdate.exe -
resource yara_rule behavioral1/memory/2072-2-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2072-4-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2072-5-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2072-6-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2072-7-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2072-17-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-29-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-36-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-34-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-37-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-38-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-40-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-39-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-41-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-42-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-43-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-45-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-44-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2712-46-0x0000000000400000-0x00000000004BA000-memory.dmp upx -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" 739e065498d059c844eefc77fc7b24f9.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" winupdate.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2428 set thread context of 2072 2428 739e065498d059c844eefc77fc7b24f9.exe 28 PID 2628 set thread context of 2712 2628 winupdate.exe 39 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2876 PING.EXE -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeSecurityPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeTakeOwnershipPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeLoadDriverPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeSystemProfilePrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeSystemtimePrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeProfSingleProcessPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeIncBasePriorityPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeCreatePagefilePrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeBackupPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeRestorePrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeShutdownPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeDebugPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeSystemEnvironmentPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeChangeNotifyPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeRemoteShutdownPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeUndockPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeManageVolumePrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeImpersonatePrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeCreateGlobalPrivilege 2072 739e065498d059c844eefc77fc7b24f9.exe Token: 33 2072 739e065498d059c844eefc77fc7b24f9.exe Token: 34 2072 739e065498d059c844eefc77fc7b24f9.exe Token: 35 2072 739e065498d059c844eefc77fc7b24f9.exe Token: SeIncreaseQuotaPrivilege 2712 winupdate.exe Token: SeSecurityPrivilege 2712 winupdate.exe Token: SeTakeOwnershipPrivilege 2712 winupdate.exe Token: SeLoadDriverPrivilege 2712 winupdate.exe Token: SeSystemProfilePrivilege 2712 winupdate.exe Token: SeSystemtimePrivilege 2712 winupdate.exe Token: SeProfSingleProcessPrivilege 2712 winupdate.exe Token: SeIncBasePriorityPrivilege 2712 winupdate.exe Token: SeCreatePagefilePrivilege 2712 winupdate.exe Token: SeBackupPrivilege 2712 winupdate.exe Token: SeRestorePrivilege 2712 winupdate.exe Token: SeShutdownPrivilege 2712 winupdate.exe Token: SeDebugPrivilege 2712 winupdate.exe Token: SeSystemEnvironmentPrivilege 2712 winupdate.exe Token: SeChangeNotifyPrivilege 2712 winupdate.exe Token: SeRemoteShutdownPrivilege 2712 winupdate.exe Token: SeUndockPrivilege 2712 winupdate.exe Token: SeManageVolumePrivilege 2712 winupdate.exe Token: SeImpersonatePrivilege 2712 winupdate.exe Token: SeCreateGlobalPrivilege 2712 winupdate.exe Token: 33 2712 winupdate.exe Token: 34 2712 winupdate.exe Token: 35 2712 winupdate.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2428 739e065498d059c844eefc77fc7b24f9.exe 2628 winupdate.exe 2712 winupdate.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2072 2428 739e065498d059c844eefc77fc7b24f9.exe 28 PID 2428 wrote to memory of 2072 2428 739e065498d059c844eefc77fc7b24f9.exe 28 PID 2428 wrote to memory of 2072 2428 739e065498d059c844eefc77fc7b24f9.exe 28 PID 2428 wrote to memory of 2072 2428 739e065498d059c844eefc77fc7b24f9.exe 28 PID 2428 wrote to memory of 2072 2428 739e065498d059c844eefc77fc7b24f9.exe 28 PID 2428 wrote to memory of 2072 2428 739e065498d059c844eefc77fc7b24f9.exe 28 PID 2428 wrote to memory of 2072 2428 739e065498d059c844eefc77fc7b24f9.exe 28 PID 2428 wrote to memory of 2072 2428 739e065498d059c844eefc77fc7b24f9.exe 28 PID 2428 wrote to memory of 2072 2428 739e065498d059c844eefc77fc7b24f9.exe 28 PID 2072 wrote to memory of 2704 2072 739e065498d059c844eefc77fc7b24f9.exe 29 PID 2072 wrote to memory of 2704 2072 739e065498d059c844eefc77fc7b24f9.exe 29 PID 2072 wrote to memory of 2704 2072 739e065498d059c844eefc77fc7b24f9.exe 29 PID 2072 wrote to memory of 2704 2072 739e065498d059c844eefc77fc7b24f9.exe 29 PID 2072 wrote to memory of 2864 2072 739e065498d059c844eefc77fc7b24f9.exe 31 PID 2072 wrote to memory of 2864 2072 739e065498d059c844eefc77fc7b24f9.exe 31 PID 2072 wrote to memory of 2864 2072 739e065498d059c844eefc77fc7b24f9.exe 31 PID 2072 wrote to memory of 2864 2072 739e065498d059c844eefc77fc7b24f9.exe 31 PID 2072 wrote to memory of 2848 2072 739e065498d059c844eefc77fc7b24f9.exe 33 PID 2072 wrote to memory of 2848 2072 739e065498d059c844eefc77fc7b24f9.exe 33 PID 2072 wrote to memory of 2848 2072 739e065498d059c844eefc77fc7b24f9.exe 33 PID 2072 wrote to memory of 2848 2072 739e065498d059c844eefc77fc7b24f9.exe 33 PID 2704 wrote to memory of 2732 2704 cmd.exe 35 PID 2704 wrote to memory of 2732 2704 cmd.exe 35 PID 2704 wrote to memory of 2732 2704 cmd.exe 35 PID 2704 wrote to memory of 2732 2704 cmd.exe 35 PID 2864 wrote to memory of 2900 2864 cmd.exe 36 PID 2864 wrote to memory of 2900 2864 cmd.exe 36 PID 2864 wrote to memory of 2900 2864 cmd.exe 36 PID 2864 wrote to memory of 2900 2864 cmd.exe 36 PID 2848 wrote to memory of 2876 2848 cmd.exe 37 PID 2848 wrote to memory of 2876 2848 cmd.exe 37 PID 2848 wrote to memory of 2876 2848 cmd.exe 37 PID 2848 wrote to memory of 2876 2848 cmd.exe 37 PID 2072 wrote to memory of 2628 2072 739e065498d059c844eefc77fc7b24f9.exe 38 PID 2072 wrote to memory of 2628 2072 739e065498d059c844eefc77fc7b24f9.exe 38 PID 2072 wrote to memory of 2628 2072 739e065498d059c844eefc77fc7b24f9.exe 38 PID 2072 wrote to memory of 2628 2072 739e065498d059c844eefc77fc7b24f9.exe 38 PID 2072 wrote to memory of 2628 2072 739e065498d059c844eefc77fc7b24f9.exe 38 PID 2072 wrote to memory of 2628 2072 739e065498d059c844eefc77fc7b24f9.exe 38 PID 2072 wrote to memory of 2628 2072 739e065498d059c844eefc77fc7b24f9.exe 38 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 PID 2628 wrote to memory of 2712 2628 winupdate.exe 39 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2732 attrib.exe 2900 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\739e065498d059c844eefc77fc7b24f9.exe"C:\Users\Admin\AppData\Local\Temp\739e065498d059c844eefc77fc7b24f9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\739e065498d059c844eefc77fc7b24f9.exeC:\Users\Admin\AppData\Local\Temp\739e065498d059c844eefc77fc7b24f9.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\739e065498d059c844eefc77fc7b24f9.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\739e065498d059c844eefc77fc7b24f9.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2732
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2900
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5&del "C:\Users\Admin\AppData\Local\Temp\739e065498d059c844eefc77fc7b24f9.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 54⤵
- Runs ping.exe
PID:2876
-
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windupdt\winupdate.exeC:\Windupdt\winupdate.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302KB
MD5739e065498d059c844eefc77fc7b24f9
SHA1211897080482917df88878aa243afdda50d21866
SHA256e7f623cc90369141f45b02da8a9356696fab3e633d4ed695100450d738659372
SHA5122ce2a9935b59702761e8def79c77afd1b4d84ad98106e0691c2830400f95967a44ff67c20fdcc06bd6d811b6e0ad9c57b7317a1348399778dffa815145a5e835