Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 07:41
Static task
static1
Behavioral task
behavioral1
Sample
fixer (2).exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fixer (2).exe
Resource
win10v2004-20240412-en
General
-
Target
fixer (2).exe
-
Size
180KB
-
MD5
db1841bfa15492d1f6a4b46e921068a4
-
SHA1
9526c45f7a9d59e0a5dda1b57ddbaf8425716e9e
-
SHA256
176b2fbe38f0d14ee68c65c56e2731646473c0f51e92d3affd2048959fab6bd8
-
SHA512
22110b41d057696ed5604c84fb40c881024cc8bb045135e258e6f7b0c5baac29d40b7b2b4cb1c4a3391ab2944b43c6b293ec628901abf6447124404111e41b18
-
SSDEEP
3072:jh+8/+IVkJZ5UkcGkKLv/YiJlNZ9pshMniWGkJAPXsPzljLD3rv8Gz:jh95UZ5L8KL3YirfbshMiWFusPzljLDV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
uwudaddy.exepid process 2860 uwudaddy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2672 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fixer (2).exepid process 3028 fixer (2).exe 3028 fixer (2).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fixer (2).exeuwudaddy.exedescription pid process Token: SeDebugPrivilege 3028 fixer (2).exe Token: SeDebugPrivilege 2860 uwudaddy.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
fixer (2).execmd.execmd.exeuwudaddy.execmd.exedescription pid process target process PID 3028 wrote to memory of 2852 3028 fixer (2).exe cmd.exe PID 3028 wrote to memory of 2852 3028 fixer (2).exe cmd.exe PID 3028 wrote to memory of 2852 3028 fixer (2).exe cmd.exe PID 3028 wrote to memory of 3060 3028 fixer (2).exe cmd.exe PID 3028 wrote to memory of 3060 3028 fixer (2).exe cmd.exe PID 3028 wrote to memory of 3060 3028 fixer (2).exe cmd.exe PID 3060 wrote to memory of 2672 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 2672 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 2672 3060 cmd.exe timeout.exe PID 2852 wrote to memory of 2652 2852 cmd.exe schtasks.exe PID 2852 wrote to memory of 2652 2852 cmd.exe schtasks.exe PID 2852 wrote to memory of 2652 2852 cmd.exe schtasks.exe PID 3060 wrote to memory of 2860 3060 cmd.exe uwudaddy.exe PID 3060 wrote to memory of 2860 3060 cmd.exe uwudaddy.exe PID 3060 wrote to memory of 2860 3060 cmd.exe uwudaddy.exe PID 2860 wrote to memory of 5536 2860 uwudaddy.exe cmd.exe PID 2860 wrote to memory of 5536 2860 uwudaddy.exe cmd.exe PID 2860 wrote to memory of 5536 2860 uwudaddy.exe cmd.exe PID 5536 wrote to memory of 5560 5536 cmd.exe schtasks.exe PID 5536 wrote to memory of 5560 5536 cmd.exe schtasks.exe PID 5536 wrote to memory of 5560 5536 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fixer (2).exe"C:\Users\Admin\AppData\Local\Temp\fixer (2).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "uwudaddy" /tr '"C:\Users\Admin\AppData\Roaming\uwudaddy.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "uwudaddy" /tr '"C:\Users\Admin\AppData\Roaming\uwudaddy.exe"'3⤵
- Creates scheduled task(s)
PID:2652 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C86.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2672 -
C:\Users\Admin\AppData\Roaming\uwudaddy.exe"C:\Users\Admin\AppData\Roaming\uwudaddy.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "uwudaddy"4⤵
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "uwudaddy"5⤵PID:5560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\TarC884.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\tmp1C86.tmp.batFilesize
152B
MD58b44d6f902199cde423d110c3b8e233f
SHA1739337a98ab53b003deed8c32f4713b0dcfb986a
SHA256257d0441a0ed256b4559349acd548f71b56e7aff5fdefec5364746d5748f800d
SHA5127f235bda63d5e3d86b1fbc1e6e1d6d31b75101dcd83b780b42aa0dcc96091926ae3b0e9735c6e6183e56f9259887766e668b06699b2a42db3d97ed44dddc315a
-
C:\Users\Admin\AppData\Roaming\uwudaddy.exeFilesize
180KB
MD5db1841bfa15492d1f6a4b46e921068a4
SHA19526c45f7a9d59e0a5dda1b57ddbaf8425716e9e
SHA256176b2fbe38f0d14ee68c65c56e2731646473c0f51e92d3affd2048959fab6bd8
SHA51222110b41d057696ed5604c84fb40c881024cc8bb045135e258e6f7b0c5baac29d40b7b2b4cb1c4a3391ab2944b43c6b293ec628901abf6447124404111e41b18
-
memory/2860-42-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmpFilesize
9.9MB
-
memory/2860-22-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmpFilesize
9.9MB
-
memory/2860-86-0x000000001AF40000-0x000000001AFF2000-memory.dmpFilesize
712KB
-
memory/2860-65-0x0000000000700000-0x0000000000734000-memory.dmpFilesize
208KB
-
memory/2860-43-0x00000000779B0000-0x0000000077B59000-memory.dmpFilesize
1.7MB
-
memory/2860-24-0x00000000779B0000-0x0000000077B59000-memory.dmpFilesize
1.7MB
-
memory/2860-23-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/2860-21-0x00000000002B0000-0x00000000002E6000-memory.dmpFilesize
216KB
-
memory/3028-17-0x00000000779B0000-0x0000000077B59000-memory.dmpFilesize
1.7MB
-
memory/3028-3-0x000000001B150000-0x000000001B1D0000-memory.dmpFilesize
512KB
-
memory/3028-5-0x00000000002D0000-0x00000000002D6000-memory.dmpFilesize
24KB
-
memory/3028-0-0x00000000011A0000-0x00000000011D6000-memory.dmpFilesize
216KB
-
memory/3028-16-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmpFilesize
9.9MB
-
memory/3028-1-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/3028-2-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmpFilesize
9.9MB
-
memory/3028-4-0x00000000004F0000-0x0000000000520000-memory.dmpFilesize
192KB
-
memory/3028-6-0x00000000779B0000-0x0000000077B59000-memory.dmpFilesize
1.7MB