Resubmissions
07/05/2024, 13:41
240507-qzkejshh4y724/02/2024, 05:38
240224-gbqrzsbg3s702/02/2024, 14:39
240202-r1e2wsafcm7Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
02/02/2024, 14:39
General
- Target MediaCreationTool22H2.exe
- Size 18.6MB
- Sample240202-r1e2wsafcm
- SHA256 690c8a63769d444fad47b7ddecee7f24c9333aa735d0bd46587d0df5cf15cde5
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 9 IoCs
- Drops file in Windows directory 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MediaCreationTool22H2.exe"C:\Users\Admin\AppData\Local\Temp\MediaCreationTool22H2.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\$Windows.~WS\Sources\SetupHost.Exe"C:\$Windows.~WS\Sources\SetupHost.Exe" /Download /Web2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MediaSetupUIMgr.dll
MediaSetupUIMgr.dll
SetupCore.dll
SetupCore.dll
SetupHost.exe
SetupMgr.dll
SetupPlatform.dll
WDSCORE.dll
WINDLP.DLL
WinDlp.dll
setupplatform.cfg
setupplatform.dll
setupplatform.dll
unbcl.dll