Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
17/03/2024, 04:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc619dc3b71bf6ddf8ab304990a4215b.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc619dc3b71bf6ddf8ab304990a4215b.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target cc619dc3b71bf6ddf8ab304990a4215b.exe
- Size 852KB
- Sample240317-emfp2sdh57
- SHA256 35b4a84324681a1000c14cf114b6f94ada34eb6c6ca38b9a4584b31e742aece3
- MD5 cc619dc3b71bf6ddf8ab304990a4215b
- SHA1 9d08d85b6594f112ff6812d667cd835ac81e305a
- SHA512 068f6d394c0ac2c5c110209dfb2aba0051536aee3dddc41b7b867cc7b5a69e3cb5b697189ab8b00485969cd396295f4b0fc55347ce6c3f457397d8855850b4ee
- SSDEEP 24576:bp/YH7l3kAWXz+EQ9Gak77eZpwQ1EaDSTd:147lkD7iGaWSZId
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" Idman.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Idman.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation cc619dc3b71bf6ddf8ab304990a4215b.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation Idman.exe - Executes dropped EXE 2 IoCs
pid Process 3468 Idman.exe 5092 winupdate.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" Idman.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3468 set thread context of 3340 3468 Idman.exe 93 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Idman.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Idman.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Idman.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Idman.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Idman.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Idman.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2836 cc619dc3b71bf6ddf8ab304990a4215b.exe Token: 33 2836 cc619dc3b71bf6ddf8ab304990a4215b.exe Token: SeIncBasePriorityPrivilege 2836 cc619dc3b71bf6ddf8ab304990a4215b.exe Token: SeIncreaseQuotaPrivilege 3468 Idman.exe Token: SeSecurityPrivilege 3468 Idman.exe Token: SeTakeOwnershipPrivilege 3468 Idman.exe Token: SeLoadDriverPrivilege 3468 Idman.exe Token: SeSystemProfilePrivilege 3468 Idman.exe Token: SeSystemtimePrivilege 3468 Idman.exe Token: SeProfSingleProcessPrivilege 3468 Idman.exe Token: SeIncBasePriorityPrivilege 3468 Idman.exe Token: SeCreatePagefilePrivilege 3468 Idman.exe Token: SeBackupPrivilege 3468 Idman.exe Token: SeRestorePrivilege 3468 Idman.exe Token: SeShutdownPrivilege 3468 Idman.exe Token: SeDebugPrivilege 3468 Idman.exe Token: SeSystemEnvironmentPrivilege 3468 Idman.exe Token: SeChangeNotifyPrivilege 3468 Idman.exe Token: SeRemoteShutdownPrivilege 3468 Idman.exe Token: SeUndockPrivilege 3468 Idman.exe Token: SeManageVolumePrivilege 3468 Idman.exe Token: SeImpersonatePrivilege 3468 Idman.exe Token: SeCreateGlobalPrivilege 3468 Idman.exe Token: 33 3468 Idman.exe Token: 34 3468 Idman.exe Token: 35 3468 Idman.exe Token: 36 3468 Idman.exe Token: SeIncreaseQuotaPrivilege 3340 explorer.exe Token: SeSecurityPrivilege 3340 explorer.exe Token: SeTakeOwnershipPrivilege 3340 explorer.exe Token: SeLoadDriverPrivilege 3340 explorer.exe Token: SeSystemProfilePrivilege 3340 explorer.exe Token: SeSystemtimePrivilege 3340 explorer.exe Token: SeProfSingleProcessPrivilege 3340 explorer.exe Token: SeIncBasePriorityPrivilege 3340 explorer.exe Token: SeCreatePagefilePrivilege 3340 explorer.exe Token: SeBackupPrivilege 3340 explorer.exe Token: SeRestorePrivilege 3340 explorer.exe Token: SeShutdownPrivilege 3340 explorer.exe Token: SeDebugPrivilege 3340 explorer.exe Token: SeSystemEnvironmentPrivilege 3340 explorer.exe Token: SeChangeNotifyPrivilege 3340 explorer.exe Token: SeRemoteShutdownPrivilege 3340 explorer.exe Token: SeUndockPrivilege 3340 explorer.exe Token: SeManageVolumePrivilege 3340 explorer.exe Token: SeImpersonatePrivilege 3340 explorer.exe Token: SeCreateGlobalPrivilege 3340 explorer.exe Token: 33 3340 explorer.exe Token: 34 3340 explorer.exe Token: 35 3340 explorer.exe Token: 36 3340 explorer.exe Token: SeIncreaseQuotaPrivilege 5092 winupdate.exe Token: SeSecurityPrivilege 5092 winupdate.exe Token: SeTakeOwnershipPrivilege 5092 winupdate.exe Token: SeLoadDriverPrivilege 5092 winupdate.exe Token: SeSystemProfilePrivilege 5092 winupdate.exe Token: SeSystemtimePrivilege 5092 winupdate.exe Token: SeProfSingleProcessPrivilege 5092 winupdate.exe Token: SeIncBasePriorityPrivilege 5092 winupdate.exe Token: SeCreatePagefilePrivilege 5092 winupdate.exe Token: SeBackupPrivilege 5092 winupdate.exe Token: SeRestorePrivilege 5092 winupdate.exe Token: SeShutdownPrivilege 5092 winupdate.exe Token: SeDebugPrivilege 5092 winupdate.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3340 explorer.exe - Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2836 wrote to memory of 3468 2836 cc619dc3b71bf6ddf8ab304990a4215b.exe 91 PID 2836 wrote to memory of 3468 2836 cc619dc3b71bf6ddf8ab304990a4215b.exe 91 PID 2836 wrote to memory of 3468 2836 cc619dc3b71bf6ddf8ab304990a4215b.exe 91 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3464 3468 Idman.exe 92 PID 3468 wrote to memory of 3340 3468 Idman.exe 93 PID 3468 wrote to memory of 3340 3468 Idman.exe 93 PID 3468 wrote to memory of 3340 3468 Idman.exe 93 PID 3468 wrote to memory of 3340 3468 Idman.exe 93 PID 3468 wrote to memory of 3340 3468 Idman.exe 93 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3340 wrote to memory of 1420 3340 explorer.exe 94 PID 3468 wrote to memory of 5092 3468 Idman.exe 95 PID 3468 wrote to memory of 5092 3468 Idman.exe 95 PID 3468 wrote to memory of 5092 3468 Idman.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc619dc3b71bf6ddf8ab304990a4215b.exe"C:\Users\Admin\AppData\Local\Temp\cc619dc3b71bf6ddf8ab304990a4215b.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\Idman.exe"C:\Users\Admin\AppData\Local\Temp\Idman.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
PID:3464
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe4⤵PID:1420
-
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Idman.exe
- Size 659KB
- SHA256 667a9886aed470a0ae3250161d4737b7d01c740d57c2b32193a2449304d6aa5a
- MD5 c20760ff71d5837f3cbf695ae5988527
- SHA1 7ad133ed3ba7a87875ad69dc892b650090097732
- SHA512 0f264ff8f87dc0719a98f58b025bd69a78ef105e5861cea718540d406ee78a9794eeca216fbe2bcad7c6895bc43d201322f04687166b7db8e9b4deab0439e808
- SSDEEP 12288:B9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKf:3AQ6Zx9cxTmOrucTIEFSpOG2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windupdt\winupdate.exe
- Size 135KB
- SHA256 b1ee7c84dd61c8bafb943bb855b6c7743e9f2ccafd106de899d436c302f8db33
- MD5 76e89cc3717a485f5e1899a8de10ccb5
- SHA1 fef8e2909ac6f8eaa06ec033e82f9a644a3a89b9
- SHA512 371e7fb886913f07279492f2d3f1c9b1e8efd69f282876b1811b5359953f72c30f5d08aaefe75eb638d1d0297c62166e9696a3a487bb775d8b1e1c044c5d7c47
- SSDEEP 3072:BttduyAurwOYFlAh3DIZEvICNhaWGscxKOm9UtLbvGLQP:Btt1AurPAlAd0ZEh8q0//P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windupdt\winupdate.exe
- Size 333KB
- SHA256 47558cfcaaa1391b712510eda0f7d7f4bf1bf310b3ef3ff8649f0bed4b40072f
- MD5 5257b83336998aa08da7267c09ad7317
- SHA1 05eed59e21a6892c2448c6d4433fd9275a6d1ebd
- SHA512 6b02396f9cce4a9a88c2c24550f5ad31c40313f530f0bf3b4e33bc95c67ad291418649ef56100d13a7f7627a8501718bb83ea1b782a960384195acd56c9a0c9f
- SSDEEP 6144:Btt1AurPAlAd0ZEh8q0//CtH4cHkGdV7TGzOExKYJA5IkoJdYcR5KlW+Ah:B9AFlAd0Z+89cxTGzO4AucTDq
- MD5 SHA1 SHA512 SSDEEP