5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe
Size

123KB
MD5

5014c394375e8fb65f41236e82b4512c
SHA1

0c113584a5b5c0e0f847925b47a0b679fcf4df42
SHA256

5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a
SHA512

6e1ad228128482005d4e9cbcb1a2ec168f7afe51f51d5b60a7a31568bb0d9d46cab10e43c3cee7813c1277c853c36eee3666c61db78e2bafc9757ce0431538db
SSDEEP

3072:PfU/WF6QMauSuiWNi9CO+WARJrWNZIYvQd2i:AWKauSuiWNiUBRJrW7fi

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2516	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2084	wuauclt.exe

Loads dropped DLL 1 IoCs

pid	Process
2820	5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run"	5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2084	2820	5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe	28
PID 2820 wrote to memory of 2084	2820	5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe	28
PID 2820 wrote to memory of 2084	2820	5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe	28
PID 2820 wrote to memory of 2084	2820	5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe	28
PID 2820 wrote to memory of 2516	2820	5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe	31
PID 2820 wrote to memory of 2516	2820	5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe	31
PID 2820 wrote to memory of 2516	2820	5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe	31
PID 2820 wrote to memory of 2516	2820	5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe	31

C:\Users\Admin\AppData\Local\Temp\5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe
"C:\Users\Admin\AppData\Local\Temp\5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2820
- C:\ProgramData\Update\wuauclt.exe
  "C:\ProgramData\Update\wuauclt.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\windows\SysWOW64\cmd.exe
  "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\5202cf32f841c76cbee0a53882b484d2326ce8d20ecb0baebef7663ac769014a.exe" >> NUL
  2⤵
  - Deletes itself
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\wuauclt.exe

Filesize
123KB

MD5
2efadba405189bdaf6f149a43869890b

SHA1
a029e58a015533ba631eb457a0e8c99535072b8e

SHA256
b021aaeafdbbe03b69658e816029a3fc2b7d0a1ef7d336b17b13e2dc9a2905ab

SHA512
9adf3a10620778f6a1462456c9e484ce15026ceeb40d7ecfac01a343729790f010d34d943d70802da9921041959456680b3f4504b02c11d3cd644bb6d849832f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads