5d80b2cdb864a9c939379a28a31af810bbb983930808dbcadf672b49cac0b41f

Analysis

max time kernel
141s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f09f2beffe05bd569a50e0e53205134.exe
Size

193KB
MD5

8f09f2beffe05bd569a50e0e53205134
SHA1

39b4f4ceb3e845de05b90b2ce109d51c14828a20
SHA256

5d80b2cdb864a9c939379a28a31af810bbb983930808dbcadf672b49cac0b41f
SHA512

253cbe1f2f21f33df176a13fe89190701d5423a381d841f36613e2b938aaece5ab2572f7304a7fcec3ae0a67e697eb1b85eda2ddeee45b20fcea635fcfe54636
SSDEEP

3072:wuYkh1Wv9JYGBKH/o1Fu+cLvRufmXo1X7UDhdrftOFWug3tx4Vh4FJihQeqauQt5:lWv9iGyQD6C1QDhdDt4nq84JAQ3QLP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mupdate = "c:\\Program Files\\Windows Media Components\\mupdate.exe"	8f09f2beffe05bd569a50e0e53205134.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nupdate = "c:\\Program Files\\Uninstall Information\\nupdate.exe"	8f09f2beffe05bd569a50e0e53205134.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Windows Media Components\mupdate.exe	8f09f2beffe05bd569a50e0e53205134.exe
File created	\??\c:\Program Files\Uninstall Information\nupdate.exe	8f09f2beffe05bd569a50e0e53205134.exe
File created	\??\c:\Program Files\Windows Media Components\mupdate.exe	8f09f2beffe05bd569a50e0e53205134.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3744	8f09f2beffe05bd569a50e0e53205134.exe
3744	8f09f2beffe05bd569a50e0e53205134.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3744	8f09f2beffe05bd569a50e0e53205134.exe
3744	8f09f2beffe05bd569a50e0e53205134.exe

C:\Users\Admin\AppData\Local\Temp\8f09f2beffe05bd569a50e0e53205134.exe
"C:\Users\Admin\AppData\Local\Temp\8f09f2beffe05bd569a50e0e53205134.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3744-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3744-1-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/3744-4-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3744-11-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/3744-12-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download