Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 15:14
Behavioral task
behavioral1
Sample
a229acff4e0605ad24eaf3d9c44fdb1b.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a229acff4e0605ad24eaf3d9c44fdb1b.exe
Resource
win10v2004-20240221-en
General
-
Target
a229acff4e0605ad24eaf3d9c44fdb1b.exe
-
Size
1.4MB
-
MD5
a229acff4e0605ad24eaf3d9c44fdb1b
-
SHA1
997612876080a0446d25a5587f3c8f8fa9b3dca6
-
SHA256
a809e73a913bb35e9ca2368fcedd4e7311a4a651ed9edd081593b81bac03f605
-
SHA512
3c73d379cbd711e32d6384739347b88c5e914ed573a7455714304cbaa853139a172c282f54ab96aa6cd556cf7a90e61d0d9a9013a1e41e5bcdd110ce69fb32f7
-
SSDEEP
24576:yAEENIq8XwyVPQclDq/+WnpsST+7qNXz6:yAEsw722Wnmoz
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" a229acff4e0605ad24eaf3d9c44fdb1b.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts a229acff4e0605ad24eaf3d9c44fdb1b.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate a229acff4e0605ad24eaf3d9c44fdb1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe -
Executes dropped EXE 2 IoCs
pid Process 3056 [TGS]CAPUB V1.11.EXE 2560 winupdate.exe -
Loads dropped DLL 6 IoCs
pid Process 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 2560 winupdate.exe 2560 winupdate.exe 2560 winupdate.exe -
resource yara_rule behavioral1/memory/1844-0-0x0000000000400000-0x0000000000560000-memory.dmp upx behavioral1/files/0x0010000000014dae-16.dat upx behavioral1/memory/1844-26-0x0000000000400000-0x0000000000560000-memory.dmp upx behavioral1/memory/2560-25-0x0000000000400000-0x0000000000560000-memory.dmp upx behavioral1/memory/2560-28-0x0000000000400000-0x0000000000560000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" a229acff4e0605ad24eaf3d9c44fdb1b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a229acff4e0605ad24eaf3d9c44fdb1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier a229acff4e0605ad24eaf3d9c44fdb1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier a229acff4e0605ad24eaf3d9c44fdb1b.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a229acff4e0605ad24eaf3d9c44fdb1b.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier a229acff4e0605ad24eaf3d9c44fdb1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE 3056 [TGS]CAPUB V1.11.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2560 winupdate.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeSecurityPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeTakeOwnershipPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeLoadDriverPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeSystemProfilePrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeSystemtimePrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeProfSingleProcessPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeIncBasePriorityPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeCreatePagefilePrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeBackupPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeRestorePrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeShutdownPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeDebugPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeSystemEnvironmentPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeChangeNotifyPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeRemoteShutdownPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeUndockPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeManageVolumePrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeImpersonatePrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeCreateGlobalPrivilege 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: 33 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: 34 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: 35 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeIncreaseQuotaPrivilege 2560 winupdate.exe Token: SeSecurityPrivilege 2560 winupdate.exe Token: SeTakeOwnershipPrivilege 2560 winupdate.exe Token: SeLoadDriverPrivilege 2560 winupdate.exe Token: SeSystemProfilePrivilege 2560 winupdate.exe Token: SeSystemtimePrivilege 2560 winupdate.exe Token: SeProfSingleProcessPrivilege 2560 winupdate.exe Token: SeIncBasePriorityPrivilege 2560 winupdate.exe Token: SeCreatePagefilePrivilege 2560 winupdate.exe Token: SeBackupPrivilege 2560 winupdate.exe Token: SeRestorePrivilege 2560 winupdate.exe Token: SeShutdownPrivilege 2560 winupdate.exe Token: SeDebugPrivilege 2560 winupdate.exe Token: SeSystemEnvironmentPrivilege 2560 winupdate.exe Token: SeChangeNotifyPrivilege 2560 winupdate.exe Token: SeRemoteShutdownPrivilege 2560 winupdate.exe Token: SeUndockPrivilege 2560 winupdate.exe Token: SeManageVolumePrivilege 2560 winupdate.exe Token: SeImpersonatePrivilege 2560 winupdate.exe Token: SeCreateGlobalPrivilege 2560 winupdate.exe Token: 33 2560 winupdate.exe Token: 34 2560 winupdate.exe Token: 35 2560 winupdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2560 winupdate.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1844 wrote to memory of 3056 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 28 PID 1844 wrote to memory of 3056 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 28 PID 1844 wrote to memory of 3056 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 28 PID 1844 wrote to memory of 3056 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 28 PID 1844 wrote to memory of 2560 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 29 PID 1844 wrote to memory of 2560 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 29 PID 1844 wrote to memory of 2560 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 29 PID 1844 wrote to memory of 2560 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 29 PID 1844 wrote to memory of 2560 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 29 PID 1844 wrote to memory of 2560 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 29 PID 1844 wrote to memory of 2560 1844 a229acff4e0605ad24eaf3d9c44fdb1b.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a229acff4e0605ad24eaf3d9c44fdb1b.exe"C:\Users\Admin\AppData\Local\Temp\a229acff4e0605ad24eaf3d9c44fdb1b.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\[TGS]CAPUB V1.11.EXE"C:\Users\Admin\AppData\Local\Temp\[TGS]CAPUB V1.11.EXE"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3056
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD533231ad6c7ffecc7a034488afad248cf
SHA1ee0602f71af134e0180bb41d89287e28465ddd7a
SHA2566c3c027daf830f992c17220ce827bcecfc2d9113f5f847001f4404156bb8cbf7
SHA5120487fa712c7f8307904cdb1da23b2b84b1983ecff97685866e1332953f15864b9e300a8e2d125c6db10c52934238a8311ba2819ffff02c73c691674eabb65c97
-
Filesize
1.4MB
MD5a229acff4e0605ad24eaf3d9c44fdb1b
SHA1997612876080a0446d25a5587f3c8f8fa9b3dca6
SHA256a809e73a913bb35e9ca2368fcedd4e7311a4a651ed9edd081593b81bac03f605
SHA5123c73d379cbd711e32d6384739347b88c5e914ed573a7455714304cbaa853139a172c282f54ab96aa6cd556cf7a90e61d0d9a9013a1e41e5bcdd110ce69fb32f7