862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe
Size

134KB
MD5

f07b59c3cee9c9bc4722d4a64731840b
SHA1

3c3e02f8138f3360089a3ff80673c7d3fd939796
SHA256

862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd
SHA512

5e8edc14f84ee1562724b090f55525643160c9f31c36ae1dc7a939f5f41170ea8a4b238f094b198435bfc97aad424bca8d4053a7a491ba37e3568753551890a2
SSDEEP

1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOZ:YfU/WF6QMauSuiWNi9eNOl0007NZIOZ

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/368-0-0x0000000000E10000-0x0000000000E38000-memory.dmp	UPX
C:\ProgramData\Update\wuauclt.exe	UPX
behavioral2/memory/2492-5-0x0000000000B80000-0x0000000000BA8000-memory.dmp	UPX
behavioral2/memory/368-6-0x0000000000E10000-0x0000000000E38000-memory.dmp	UPX
behavioral2/memory/2492-7-0x0000000000B80000-0x0000000000BA8000-memory.dmp	UPX
behavioral2/memory/368-8-0x0000000000E10000-0x0000000000E38000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe

Executes dropped EXE 1 IoCs

Processes:

wuauclt.exe

pid process

2492 wuauclt.exe

pid	process
2492	wuauclt.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/368-0-0x0000000000E10000-0x0000000000E38000-memory.dmp	upx
C:\ProgramData\Update\wuauclt.exe	upx
behavioral2/memory/2492-5-0x0000000000B80000-0x0000000000BA8000-memory.dmp	upx
behavioral2/memory/368-6-0x0000000000E10000-0x0000000000E38000-memory.dmp	upx
behavioral2/memory/2492-7-0x0000000000B80000-0x0000000000BA8000-memory.dmp	upx
behavioral2/memory/368-8-0x0000000000E10000-0x0000000000E38000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run"	862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe

description	pid	process	target process
PID 368 wrote to memory of 2492	368	862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe	wuauclt.exe
PID 368 wrote to memory of 2492	368	862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe	wuauclt.exe
PID 368 wrote to memory of 2492	368	862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe	wuauclt.exe
PID 368 wrote to memory of 1600	368	862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe	cmd.exe
PID 368 wrote to memory of 1600	368	862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe	cmd.exe
PID 368 wrote to memory of 1600	368	862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe
"C:\Users\Admin\AppData\Local\Temp\862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:368

C:\ProgramData\Update\wuauclt.exe
"C:\ProgramData\Update\wuauclt.exe" /run
2⤵
- Executes dropped EXE
PID:2492

C:\windows\SysWOW64\cmd.exe
"C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\862437f0dbc9e4b511b1573caaf7dff5045232aa9fc0e226258bb0768200b4dd.exe" >> NUL
2⤵
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\wuauclt.exe

Filesize
134KB

MD5
e25af0afeb14360857ec10aded96b18e

SHA1
1bb6ab2d7e13180fcb69b652876cd230e1aea74c

SHA256
7adf32825d498a7b6ed98ce9d9a62c13a34d9156a09bf16f14c460e399869686

SHA512
df3bd842f1f03c19158edf8f151024d8253c344985e462610cc774cfeaf3818a6e82f410236f4c7bb5fd9821ebadad1934b124cf83dd8bc8f9f41ddef83723a9

Download Submit
memory/368-0-0x0000000000E10000-0x0000000000E38000-memory.dmp

Filesize
160KB

Download
memory/368-6-0x0000000000E10000-0x0000000000E38000-memory.dmp

Filesize
160KB

Download
memory/368-8-0x0000000000E10000-0x0000000000E38000-memory.dmp

Filesize
160KB

Download
memory/2492-5-0x0000000000B80000-0x0000000000BA8000-memory.dmp

Filesize
160KB

Download
memory/2492-7-0x0000000000B80000-0x0000000000BA8000-memory.dmp

Filesize
160KB

Download