cb3fc239e7d29e7e2425e7fcdbfa1097d15cc3e1100a4d32cf7b20a9d2cdd5f7 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 07:58

Sharing

Report Analysis Logs

General

Target

wufuc/Restore_wuauserv.reg
Size

708B
MD5

99f25f3eb124c29e24c5352371c6b576
SHA1

68e203682392be44065b32ee43e8f5536133b98c
SHA256

e520b1620ae71ffae8908609e99a06d998c7e773c5179532c834d4adbcae8e5b
SHA512

c2dc2361a4dbdf5da93cb67ca9b8c8b18c52ff93b376a006ac04cc6ee9da1255687c49a5c424d4feaacecdac4299fad5caf75cd7caffdf93accb4643bbeb6736

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies security service 2 TTPs 2 IoCs

Modify Registry

Windows Service

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters\ServiceDll = "%systemroot%\\system32\\wuaueng.dll"	regedit.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

regedit.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters\ServiceDll = "%systemroot%\\system32\\wuaueng.dll"	regedit.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

2952 regedit.exe

C:\Windows\regedit.exe
regedit.exe "C:\Users\Admin\AppData\Local\Temp\wufuc\Restore_wuauserv.reg"
1⤵
- Modifies security service
- Sets DLL path for service in the registry
- Runs .reg file with regedit
PID:2952

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download