12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe
Size

94KB
MD5

6f7ae571d87cc19269d19e37eb127943
SHA1

89740577f51a2a1b8f2dcc9838c29ac0702c3aed
SHA256

12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6
SHA512

6790169d8991c348307565742cc05d81db0eb83c576c4e5fbc4418b124336fa411ee80572b20f8eb1317cb54af7ee5e4eb41235bebe5f5f3a10ebe520e4ce556
SSDEEP

1536:PGYU/W2/HG6QMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7uk:PfU/WF6QMauSuiWNi9CO+WARJrWNZH

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3032	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1844	wuauclt.exe

Loads dropped DLL 1 IoCs

pid	Process
2008	12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run"	12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1844	2008	12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe	28
PID 2008 wrote to memory of 1844	2008	12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe	28
PID 2008 wrote to memory of 1844	2008	12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe	28
PID 2008 wrote to memory of 1844	2008	12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe	28
PID 2008 wrote to memory of 3032	2008	12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe	29
PID 2008 wrote to memory of 3032	2008	12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe	29
PID 2008 wrote to memory of 3032	2008	12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe	29
PID 2008 wrote to memory of 3032	2008	12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe	29

C:\Users\Admin\AppData\Local\Temp\12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe
"C:\Users\Admin\AppData\Local\Temp\12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008
- C:\ProgramData\Update\wuauclt.exe
  "C:\ProgramData\Update\wuauclt.exe" /run
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\windows\SysWOW64\cmd.exe
  "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\12905db436b5b60722e45e2dc19fce5547313452c9ac083e6681fb6acd4985e6.exe" >> NUL
  2⤵
  - Deletes itself
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\wuauclt.exe

Filesize
94KB

MD5
022e6db3273692dd21a1d3f7fe14b6c7

SHA1
c6eed5912888989f551e70b35046bc15c1cbe24c

SHA256
c467c95f16a6d8743459ef97dcb0ddfd4b6b60deb605f9fda147ad6fcda6be5e

SHA512
ce1aaf82ba57949f56bdb05d3a51d176db2edddd773f4eb3949555e0672b7fa0703e197db64a424a44ba0b090330170f5556ce14f7ecb8988568cde46d48a102

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads