Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
20/03/2024, 01:04
Behavioral task
behavioral1
Sample
d787746ce84ddb512286208763aed516.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d787746ce84ddb512286208763aed516.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target d787746ce84ddb512286208763aed516.exe
- Size 757KB
- Sample240320-bfazfadd7z
- SHA256 640b275c90b8ce4a84dc17cfff99df8f9d01b86b42d00db684e46afe878288e1
- MD5 d787746ce84ddb512286208763aed516
- SHA1 5691ca148f27073339c813e3eee72e88586d7662
- SHA512 8925065351b389471c53b84cd02e9450c5e4f02a6423ff866ce0184101438ad6e055550bedcd873bafa838c918b1700d79729562626e5d180d648e332ac64a14
- SSDEEP 12288:h9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKWRqMd0QZh9u:XAQ6Zx9cxTmOrucTIEFSpOGBRD0QZh9u
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" d787746ce84ddb512286208763aed516.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" explorer.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate d787746ce84ddb512286208763aed516.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe - Deletes itself 1 IoCs
pid Process 4468 notepad.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" d787746ce84ddb512286208763aed516.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe d787746ce84ddb512286208763aed516.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ d787746ce84ddb512286208763aed516.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe d787746ce84ddb512286208763aed516.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4120 set thread context of 4060 4120 d787746ce84ddb512286208763aed516.exe 89 - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier d787746ce84ddb512286208763aed516.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 d787746ce84ddb512286208763aed516.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString d787746ce84ddb512286208763aed516.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier d787746ce84ddb512286208763aed516.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier d787746ce84ddb512286208763aed516.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeSecurityPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeTakeOwnershipPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeLoadDriverPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeSystemProfilePrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeSystemtimePrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeProfSingleProcessPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeIncBasePriorityPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeCreatePagefilePrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeBackupPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeRestorePrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeShutdownPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeDebugPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeSystemEnvironmentPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeChangeNotifyPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeRemoteShutdownPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeUndockPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeManageVolumePrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeImpersonatePrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: SeCreateGlobalPrivilege 4120 d787746ce84ddb512286208763aed516.exe Token: 33 4120 d787746ce84ddb512286208763aed516.exe Token: 34 4120 d787746ce84ddb512286208763aed516.exe Token: 35 4120 d787746ce84ddb512286208763aed516.exe Token: 36 4120 d787746ce84ddb512286208763aed516.exe Token: SeIncreaseQuotaPrivilege 4060 explorer.exe Token: SeSecurityPrivilege 4060 explorer.exe Token: SeTakeOwnershipPrivilege 4060 explorer.exe Token: SeLoadDriverPrivilege 4060 explorer.exe Token: SeSystemProfilePrivilege 4060 explorer.exe Token: SeSystemtimePrivilege 4060 explorer.exe Token: SeProfSingleProcessPrivilege 4060 explorer.exe Token: SeIncBasePriorityPrivilege 4060 explorer.exe Token: SeCreatePagefilePrivilege 4060 explorer.exe Token: SeBackupPrivilege 4060 explorer.exe Token: SeRestorePrivilege 4060 explorer.exe Token: SeShutdownPrivilege 4060 explorer.exe Token: SeDebugPrivilege 4060 explorer.exe Token: SeSystemEnvironmentPrivilege 4060 explorer.exe Token: SeChangeNotifyPrivilege 4060 explorer.exe Token: SeRemoteShutdownPrivilege 4060 explorer.exe Token: SeUndockPrivilege 4060 explorer.exe Token: SeManageVolumePrivilege 4060 explorer.exe Token: SeImpersonatePrivilege 4060 explorer.exe Token: SeCreateGlobalPrivilege 4060 explorer.exe Token: 33 4060 explorer.exe Token: 34 4060 explorer.exe Token: 35 4060 explorer.exe Token: 36 4060 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 2344 4120 d787746ce84ddb512286208763aed516.exe 88 PID 4120 wrote to memory of 4060 4120 d787746ce84ddb512286208763aed516.exe 89 PID 4120 wrote to memory of 4060 4120 d787746ce84ddb512286208763aed516.exe 89 PID 4120 wrote to memory of 4060 4120 d787746ce84ddb512286208763aed516.exe 89 PID 4120 wrote to memory of 4060 4120 d787746ce84ddb512286208763aed516.exe 89 PID 4120 wrote to memory of 4060 4120 d787746ce84ddb512286208763aed516.exe 89 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4120 wrote to memory of 4468 4120 d787746ce84ddb512286208763aed516.exe 91 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92 PID 4060 wrote to memory of 3620 4060 explorer.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\d787746ce84ddb512286208763aed516.exe"C:\Users\Admin\AppData\Local\Temp\d787746ce84ddb512286208763aed516.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2344
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe3⤵PID:3620
-
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe2⤵
- Deletes itself
PID:4468
-