Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 06:52

General

  • Target

    updater/GUP.exe

  • Size

    818KB

  • MD5

    1884dd352c2b8df7e7ee80573af580ac

  • SHA1

    cabd8ed8b7c65f403ecdd90a9dff142b044fb3fc

  • SHA256

    f22a7438a2226321324a81926bb311c25377ce977a32c84064d29e932fa22598

  • SHA512

    a90fa4a1dbf789b0a9d085e4e3dfbb6fe2efe5dccabe311bb6411529e5cb465e575291e414d86acbe82c9b39eb6d6cf92c45e5d29d6ff75782d98c201863039c

  • SSDEEP

    12288:HySK0M5qRxaBr5wFNbgpA0WUVzOR63AczZXBS3CNmBDIOh68ADKbp34zZZ6dNNoq:SqMo2aWqT2KbpIFZ6PNeTw

Score
6/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\updater\GUP.exe
    "C:\Users\Admin\AppData\Local\Temp\updater\GUP.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4368
    • C:\Users\Admin\AppData\Local\Temp\npp.8.6.5.Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\npp.8.6.5.Installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3220

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\npp.8.6.5.Installer.exe

          Filesize

          4.5MB

          MD5

          6f7e2e04a4e06254fd1454515eb0331d

          SHA1

          ba940c6b526da1ce127f43b835b4d8c9d5c4b59c

          SHA256

          5180a17f24df75ccc000cdc2904b14c865ccfd7521909bf06cc75189a65c3e2f

          SHA512

          b230bea0ea463a34c3f01c5714d2dbd8dc9023ac373e46f4ec821fabb876d977fe3f5814740e903650a3d604422fef12bd7bbab7e1b531d9688af8111b30d859

        • C:\Users\Admin\AppData\Local\Temp\nsu9F20.tmp\InstallOptions.dll

          Filesize

          15KB

          MD5

          d095b082b7c5ba4665d40d9c5042af6d

          SHA1

          2220277304af105ca6c56219f56f04e894b28d27

          SHA256

          b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

          SHA512

          61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

        • C:\Users\Admin\AppData\Local\Temp\nsu9F20.tmp\LangDLL.dll

          Filesize

          5KB

          MD5

          50016010fb0d8db2bc4cd258ceb43be5

          SHA1

          44ba95ee12e69da72478cf358c93533a9c7a01dc

          SHA256

          32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

          SHA512

          ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

        • C:\Users\Admin\AppData\Local\Temp\nsu9F20.tmp\System.dll

          Filesize

          12KB

          MD5

          4add245d4ba34b04f213409bfe504c07

          SHA1

          ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

          SHA256

          9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

          SHA512

          1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

        • C:\Users\Admin\AppData\Local\Temp\nsu9F20.tmp\ioSpecial.ini

          Filesize

          1KB

          MD5

          bf874b71933a47516bfeeb045c90b42b

          SHA1

          fa94e0fc3d7c3c38ba0b62d28fe4bf9ed98cc5dd

          SHA256

          01a9b42b23ce0be7164d4a6da8452cb2e2f60ea81c2dd6a6a0616f7760727054

          SHA512

          01d073dd3356225c53b5320bf07d94b6c88c0b484da1b220b0f0981a06898e242cc8c5a0a428cc4821d3a049122acc405a562d455762f5c4f1d100af0661a2ab