Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 03:34
Static task
static1
Behavioral task
behavioral1
Sample
d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe
Resource
win10v2004-20240412-en
General
-
Target
d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe
-
Size
1.5MB
-
MD5
13c291a51303cb5b0d165e16fb16adbf
-
SHA1
67770e925c3f03212afdbdf20e84a7de8d682465
-
SHA256
d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a
-
SHA512
b2064b2ee4bdd4ac1bc8a3b1ba49c3cd359c098100ebf0ffe55566cb920478a806758a536b53b5216e66fdb2207d1df5ca2ff850a4ea23afc3941f81701205d1
-
SSDEEP
12288:wHZVm/7ePnv+TWM+6+xTGzgFA+u/x8acJdPACFFbLFi8cj5UQbM72voL:2v+NWu/adRYj5UQO5
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
UPX dump on OEP (original entry point) 14 IoCs
Processes:
resource yara_rule behavioral1/memory/2864-48-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-51-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-52-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-53-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-59-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-60-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-62-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-63-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-64-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-66-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-67-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-68-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-70-0x0000000000400000-0x000000000045C000-memory.dmp UPX behavioral1/memory/2864-71-0x0000000000400000-0x000000000045C000-memory.dmp UPX -
Executes dropped EXE 2 IoCs
Processes:
winupdt.exewinupdt.exepid process 2580 winupdt.exe 2864 winupdt.exe -
Loads dropped DLL 6 IoCs
Processes:
d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exewinupdt.exepid process 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe 2580 winupdt.exe -
Processes:
resource yara_rule behavioral1/memory/2864-48-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-51-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-52-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-53-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-59-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-60-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-62-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-63-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-64-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-66-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-67-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-68-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-70-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2864-71-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Window Updates = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
winupdt.exedescription pid process target process PID 2580 set thread context of 2864 2580 winupdt.exe winupdt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exepid process 1820 reg.exe 2876 reg.exe 2892 reg.exe 2624 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
winupdt.exedescription pid process Token: 1 2864 winupdt.exe Token: SeCreateTokenPrivilege 2864 winupdt.exe Token: SeAssignPrimaryTokenPrivilege 2864 winupdt.exe Token: SeLockMemoryPrivilege 2864 winupdt.exe Token: SeIncreaseQuotaPrivilege 2864 winupdt.exe Token: SeMachineAccountPrivilege 2864 winupdt.exe Token: SeTcbPrivilege 2864 winupdt.exe Token: SeSecurityPrivilege 2864 winupdt.exe Token: SeTakeOwnershipPrivilege 2864 winupdt.exe Token: SeLoadDriverPrivilege 2864 winupdt.exe Token: SeSystemProfilePrivilege 2864 winupdt.exe Token: SeSystemtimePrivilege 2864 winupdt.exe Token: SeProfSingleProcessPrivilege 2864 winupdt.exe Token: SeIncBasePriorityPrivilege 2864 winupdt.exe Token: SeCreatePagefilePrivilege 2864 winupdt.exe Token: SeCreatePermanentPrivilege 2864 winupdt.exe Token: SeBackupPrivilege 2864 winupdt.exe Token: SeRestorePrivilege 2864 winupdt.exe Token: SeShutdownPrivilege 2864 winupdt.exe Token: SeDebugPrivilege 2864 winupdt.exe Token: SeAuditPrivilege 2864 winupdt.exe Token: SeSystemEnvironmentPrivilege 2864 winupdt.exe Token: SeChangeNotifyPrivilege 2864 winupdt.exe Token: SeRemoteShutdownPrivilege 2864 winupdt.exe Token: SeUndockPrivilege 2864 winupdt.exe Token: SeSyncAgentPrivilege 2864 winupdt.exe Token: SeEnableDelegationPrivilege 2864 winupdt.exe Token: SeManageVolumePrivilege 2864 winupdt.exe Token: SeImpersonatePrivilege 2864 winupdt.exe Token: SeCreateGlobalPrivilege 2864 winupdt.exe Token: 31 2864 winupdt.exe Token: 32 2864 winupdt.exe Token: 33 2864 winupdt.exe Token: 34 2864 winupdt.exe Token: 35 2864 winupdt.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exewinupdt.exewinupdt.exepid process 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe 2580 winupdt.exe 2864 winupdt.exe 2864 winupdt.exe 2864 winupdt.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.execmd.exewinupdt.exewinupdt.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2004 wrote to memory of 2160 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe cmd.exe PID 2004 wrote to memory of 2160 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe cmd.exe PID 2004 wrote to memory of 2160 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe cmd.exe PID 2004 wrote to memory of 2160 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe cmd.exe PID 2160 wrote to memory of 2756 2160 cmd.exe reg.exe PID 2160 wrote to memory of 2756 2160 cmd.exe reg.exe PID 2160 wrote to memory of 2756 2160 cmd.exe reg.exe PID 2160 wrote to memory of 2756 2160 cmd.exe reg.exe PID 2004 wrote to memory of 2580 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe winupdt.exe PID 2004 wrote to memory of 2580 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe winupdt.exe PID 2004 wrote to memory of 2580 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe winupdt.exe PID 2004 wrote to memory of 2580 2004 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe winupdt.exe PID 2580 wrote to memory of 2864 2580 winupdt.exe winupdt.exe PID 2580 wrote to memory of 2864 2580 winupdt.exe winupdt.exe PID 2580 wrote to memory of 2864 2580 winupdt.exe winupdt.exe PID 2580 wrote to memory of 2864 2580 winupdt.exe winupdt.exe PID 2580 wrote to memory of 2864 2580 winupdt.exe winupdt.exe PID 2580 wrote to memory of 2864 2580 winupdt.exe winupdt.exe PID 2580 wrote to memory of 2864 2580 winupdt.exe winupdt.exe PID 2580 wrote to memory of 2864 2580 winupdt.exe winupdt.exe PID 2580 wrote to memory of 2864 2580 winupdt.exe winupdt.exe PID 2864 wrote to memory of 2500 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2500 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2500 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2500 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2520 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2520 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2520 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2520 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2060 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2060 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2060 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2060 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2132 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2132 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2132 2864 winupdt.exe cmd.exe PID 2864 wrote to memory of 2132 2864 winupdt.exe cmd.exe PID 2500 wrote to memory of 1820 2500 cmd.exe reg.exe PID 2500 wrote to memory of 1820 2500 cmd.exe reg.exe PID 2500 wrote to memory of 1820 2500 cmd.exe reg.exe PID 2500 wrote to memory of 1820 2500 cmd.exe reg.exe PID 2060 wrote to memory of 2876 2060 cmd.exe reg.exe PID 2060 wrote to memory of 2876 2060 cmd.exe reg.exe PID 2060 wrote to memory of 2876 2060 cmd.exe reg.exe PID 2060 wrote to memory of 2876 2060 cmd.exe reg.exe PID 2520 wrote to memory of 2892 2520 cmd.exe reg.exe PID 2520 wrote to memory of 2892 2520 cmd.exe reg.exe PID 2520 wrote to memory of 2892 2520 cmd.exe reg.exe PID 2520 wrote to memory of 2892 2520 cmd.exe reg.exe PID 2132 wrote to memory of 2624 2132 cmd.exe reg.exe PID 2132 wrote to memory of 2624 2132 cmd.exe reg.exe PID 2132 wrote to memory of 2624 2132 cmd.exe reg.exe PID 2132 wrote to memory of 2624 2132 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe"C:\Users\Admin\AppData\Local\Temp\d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\rzMel.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Window Updates" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\rzMel.batFilesize
158B
MD51954c7e666c5b4d1117ef07bc0c9b8ec
SHA1559e3c0273c1463e9184027b749bdaad0a372681
SHA25635e0dbc8b455ca38976157ce9d0293fd6cdca20f46f1cb69058a1e0f0af6f693
SHA5123939de8d0ab7e67b59ff8bebed5580dafd38d8785193fd42a289728500761a68b9e6660605e19e10d4278dd106fea4b273a208f25485e7389c8f19b2958c926a
-
C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exeFilesize
1.5MB
MD57bd713ad3f4f78df7ef3cf9c26ead84e
SHA19e2ff737efee399dea8a120237417d6f8ebf08a2
SHA2561ba94e7021358d974067423031d4e603c86cb8150e45045a1e6f110a378867da
SHA512e32d7b19cd96a1f9ebd48077ca98f3e60291a07f1642929051635875a71759970aab2e57da042b9940ddef1952c67803c21eeacf099878269749b39a129af9b2
-
memory/2004-0-0x0000000000400000-0x000000000058D000-memory.dmpFilesize
1.6MB
-
memory/2864-60-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-63-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-52-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-53-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-59-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-48-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-62-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-51-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-64-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-66-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-67-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-68-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-70-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2864-71-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB