Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 15:14
Behavioral task
behavioral1
Sample
a229acff4e0605ad24eaf3d9c44fdb1b.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a229acff4e0605ad24eaf3d9c44fdb1b.exe
Resource
win10v2004-20240221-en
General
-
Target
a229acff4e0605ad24eaf3d9c44fdb1b.exe
-
Size
1.4MB
-
MD5
a229acff4e0605ad24eaf3d9c44fdb1b
-
SHA1
997612876080a0446d25a5587f3c8f8fa9b3dca6
-
SHA256
a809e73a913bb35e9ca2368fcedd4e7311a4a651ed9edd081593b81bac03f605
-
SHA512
3c73d379cbd711e32d6384739347b88c5e914ed573a7455714304cbaa853139a172c282f54ab96aa6cd556cf7a90e61d0d9a9013a1e41e5bcdd110ce69fb32f7
-
SSDEEP
24576:yAEENIq8XwyVPQclDq/+WnpsST+7qNXz6:yAEsw722Wnmoz
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" a229acff4e0605ad24eaf3d9c44fdb1b.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts a229acff4e0605ad24eaf3d9c44fdb1b.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate a229acff4e0605ad24eaf3d9c44fdb1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation a229acff4e0605ad24eaf3d9c44fdb1b.exe -
Executes dropped EXE 2 IoCs
pid Process 3504 [TGS]CAPUB V1.11.EXE 3244 winupdate.exe -
resource yara_rule behavioral2/memory/4664-0-0x0000000000400000-0x0000000000560000-memory.dmp upx behavioral2/files/0x000700000002321b-16.dat upx behavioral2/memory/4664-45-0x0000000000400000-0x0000000000560000-memory.dmp upx behavioral2/memory/3244-46-0x0000000000400000-0x0000000000560000-memory.dmp upx behavioral2/memory/3244-48-0x0000000000400000-0x0000000000560000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" a229acff4e0605ad24eaf3d9c44fdb1b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a229acff4e0605ad24eaf3d9c44fdb1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a229acff4e0605ad24eaf3d9c44fdb1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier a229acff4e0605ad24eaf3d9c44fdb1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier a229acff4e0605ad24eaf3d9c44fdb1b.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier a229acff4e0605ad24eaf3d9c44fdb1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ a229acff4e0605ad24eaf3d9c44fdb1b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE 3504 [TGS]CAPUB V1.11.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3244 winupdate.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeSecurityPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeTakeOwnershipPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeLoadDriverPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeSystemProfilePrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeSystemtimePrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeProfSingleProcessPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeIncBasePriorityPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeCreatePagefilePrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeBackupPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeRestorePrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeShutdownPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeDebugPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeSystemEnvironmentPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeChangeNotifyPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeRemoteShutdownPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeUndockPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeManageVolumePrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeImpersonatePrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeCreateGlobalPrivilege 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: 33 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: 34 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: 35 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: 36 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe Token: SeIncreaseQuotaPrivilege 3244 winupdate.exe Token: SeSecurityPrivilege 3244 winupdate.exe Token: SeTakeOwnershipPrivilege 3244 winupdate.exe Token: SeLoadDriverPrivilege 3244 winupdate.exe Token: SeSystemProfilePrivilege 3244 winupdate.exe Token: SeSystemtimePrivilege 3244 winupdate.exe Token: SeProfSingleProcessPrivilege 3244 winupdate.exe Token: SeIncBasePriorityPrivilege 3244 winupdate.exe Token: SeCreatePagefilePrivilege 3244 winupdate.exe Token: SeBackupPrivilege 3244 winupdate.exe Token: SeRestorePrivilege 3244 winupdate.exe Token: SeShutdownPrivilege 3244 winupdate.exe Token: SeDebugPrivilege 3244 winupdate.exe Token: SeSystemEnvironmentPrivilege 3244 winupdate.exe Token: SeChangeNotifyPrivilege 3244 winupdate.exe Token: SeRemoteShutdownPrivilege 3244 winupdate.exe Token: SeUndockPrivilege 3244 winupdate.exe Token: SeManageVolumePrivilege 3244 winupdate.exe Token: SeImpersonatePrivilege 3244 winupdate.exe Token: SeCreateGlobalPrivilege 3244 winupdate.exe Token: 33 3244 winupdate.exe Token: 34 3244 winupdate.exe Token: 35 3244 winupdate.exe Token: 36 3244 winupdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3244 winupdate.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4664 wrote to memory of 3504 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe 89 PID 4664 wrote to memory of 3504 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe 89 PID 4664 wrote to memory of 3504 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe 89 PID 4664 wrote to memory of 3244 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe 92 PID 4664 wrote to memory of 3244 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe 92 PID 4664 wrote to memory of 3244 4664 a229acff4e0605ad24eaf3d9c44fdb1b.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\a229acff4e0605ad24eaf3d9c44fdb1b.exe"C:\Users\Admin\AppData\Local\Temp\a229acff4e0605ad24eaf3d9c44fdb1b.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\[TGS]CAPUB V1.11.EXE"C:\Users\Admin\AppData\Local\Temp\[TGS]CAPUB V1.11.EXE"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3504
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3244
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD533231ad6c7ffecc7a034488afad248cf
SHA1ee0602f71af134e0180bb41d89287e28465ddd7a
SHA2566c3c027daf830f992c17220ce827bcecfc2d9113f5f847001f4404156bb8cbf7
SHA5120487fa712c7f8307904cdb1da23b2b84b1983ecff97685866e1332953f15864b9e300a8e2d125c6db10c52934238a8311ba2819ffff02c73c691674eabb65c97
-
Filesize
1.4MB
MD5a229acff4e0605ad24eaf3d9c44fdb1b
SHA1997612876080a0446d25a5587f3c8f8fa9b3dca6
SHA256a809e73a913bb35e9ca2368fcedd4e7311a4a651ed9edd081593b81bac03f605
SHA5123c73d379cbd711e32d6384739347b88c5e914ed573a7455714304cbaa853139a172c282f54ab96aa6cd556cf7a90e61d0d9a9013a1e41e5bcdd110ce69fb32f7