Analysis
- max time kernel
156s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
28/02/2024, 08:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ab7480475c8a0012e162e6693493fc41.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab7480475c8a0012e162e6693493fc41.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target ab7480475c8a0012e162e6693493fc41.exe
- Size 236KB
- Sample240228-kfcmpsfd93
- SHA256 4811c6bd22789abcc42528a1c2afd7fd7684650f9b1a213a296f5528f08e56b2
- MD5 ab7480475c8a0012e162e6693493fc41
- SHA1 4cbe7ffd648fb1659efdeb8d6a3c87b5e9d09230
- SHA512 d478c3dbbbba0c230239b2fa9aaec39ae81030678902bbbea2e72b1d0b180a849a4cf8faf82dce51c84d17358fa76954094fe76f9d0ef453a3d4afbd6a098947
- SSDEEP 6144:FS9QWrvbXjEN5IngAtra+6/747Ko6RI6z:FS9Vv7gSraB7qKS
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" ab7480475c8a0012e162e6693493fc41.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate ab7480475c8a0012e162e6693493fc41.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" ab7480475c8a0012e162e6693493fc41.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3548 set thread context of 3168 3548 ab7480475c8a0012e162e6693493fc41.exe 89 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ab7480475c8a0012e162e6693493fc41.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ab7480475c8a0012e162e6693493fc41.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ab7480475c8a0012e162e6693493fc41.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier ab7480475c8a0012e162e6693493fc41.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier ab7480475c8a0012e162e6693493fc41.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeSecurityPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeTakeOwnershipPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeLoadDriverPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeSystemProfilePrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeSystemtimePrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeProfSingleProcessPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeIncBasePriorityPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeCreatePagefilePrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeBackupPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeRestorePrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeShutdownPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeDebugPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeSystemEnvironmentPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeChangeNotifyPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeRemoteShutdownPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeUndockPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeManageVolumePrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeImpersonatePrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeCreateGlobalPrivilege 3548 ab7480475c8a0012e162e6693493fc41.exe Token: 33 3548 ab7480475c8a0012e162e6693493fc41.exe Token: 34 3548 ab7480475c8a0012e162e6693493fc41.exe Token: 35 3548 ab7480475c8a0012e162e6693493fc41.exe Token: 36 3548 ab7480475c8a0012e162e6693493fc41.exe Token: SeIncreaseQuotaPrivilege 3168 explorer.exe Token: SeSecurityPrivilege 3168 explorer.exe Token: SeTakeOwnershipPrivilege 3168 explorer.exe Token: SeLoadDriverPrivilege 3168 explorer.exe Token: SeSystemProfilePrivilege 3168 explorer.exe Token: SeSystemtimePrivilege 3168 explorer.exe Token: SeProfSingleProcessPrivilege 3168 explorer.exe Token: SeIncBasePriorityPrivilege 3168 explorer.exe Token: SeCreatePagefilePrivilege 3168 explorer.exe Token: SeBackupPrivilege 3168 explorer.exe Token: SeRestorePrivilege 3168 explorer.exe Token: SeShutdownPrivilege 3168 explorer.exe Token: SeDebugPrivilege 3168 explorer.exe Token: SeSystemEnvironmentPrivilege 3168 explorer.exe Token: SeChangeNotifyPrivilege 3168 explorer.exe Token: SeRemoteShutdownPrivilege 3168 explorer.exe Token: SeUndockPrivilege 3168 explorer.exe Token: SeManageVolumePrivilege 3168 explorer.exe Token: SeImpersonatePrivilege 3168 explorer.exe Token: SeCreateGlobalPrivilege 3168 explorer.exe Token: 33 3168 explorer.exe Token: 34 3168 explorer.exe Token: 35 3168 explorer.exe Token: 36 3168 explorer.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 1344 3548 ab7480475c8a0012e162e6693493fc41.exe 88 PID 3548 wrote to memory of 3168 3548 ab7480475c8a0012e162e6693493fc41.exe 89 PID 3548 wrote to memory of 3168 3548 ab7480475c8a0012e162e6693493fc41.exe 89 PID 3548 wrote to memory of 3168 3548 ab7480475c8a0012e162e6693493fc41.exe 89 PID 3548 wrote to memory of 3168 3548 ab7480475c8a0012e162e6693493fc41.exe 89 PID 3548 wrote to memory of 3168 3548 ab7480475c8a0012e162e6693493fc41.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab7480475c8a0012e162e6693493fc41.exe"C:\Users\Admin\AppData\Local\Temp\ab7480475c8a0012e162e6693493fc41.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
PID:1344
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
- Size 236KB
- SHA256 4811c6bd22789abcc42528a1c2afd7fd7684650f9b1a213a296f5528f08e56b2
- MD5 ab7480475c8a0012e162e6693493fc41
- SHA1 4cbe7ffd648fb1659efdeb8d6a3c87b5e9d09230
- SHA512 d478c3dbbbba0c230239b2fa9aaec39ae81030678902bbbea2e72b1d0b180a849a4cf8faf82dce51c84d17358fa76954094fe76f9d0ef453a3d4afbd6a098947
- SSDEEP 6144:FS9QWrvbXjEN5IngAtra+6/747Ko6RI6z:FS9Vv7gSraB7qKS
- MD5 SHA1 SHA512 SSDEEP