6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe
Size

134KB
MD5

01049e52577b707361c81a3465300b50
SHA1

a90e31406437ff17fa9fa973518bc31a1016c154
SHA256

6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21
SHA512

e5f85a56352bb769ff86ab01e59b3aaae3e6502a2c9b0c26a3cf1a3d880d597eea05c2a9d78cb680782bd2da5a5826e70b28bd40a9ea558d0b38b96dd184be52
SSDEEP

1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SO0:YfU/WF6QMauSuiWNi9eNOl0007NZIO0

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2600 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

wuauclt.exe

pid process

2236 wuauclt.exe
Loads dropped DLL 1 IoCs

Processes:

6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe

pid process

2896 6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe

pid	process
2600	cmd.exe

pid	process
2236	wuauclt.exe

pid	process
2896	6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2896-0-0x0000000001300000-0x0000000001328000-memory.dmp	upx
\ProgramData\Update\wuauclt.exe	upx
behavioral1/memory/2236-6-0x0000000001340000-0x0000000001368000-memory.dmp	upx
behavioral1/memory/2896-7-0x0000000001300000-0x0000000001328000-memory.dmp	upx
behavioral1/memory/2896-9-0x0000000001300000-0x0000000001328000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run"	6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe

description	pid	process	target process
PID 2896 wrote to memory of 2236	2896	6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe	wuauclt.exe
PID 2896 wrote to memory of 2236	2896	6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe	wuauclt.exe
PID 2896 wrote to memory of 2236	2896	6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe	wuauclt.exe
PID 2896 wrote to memory of 2236	2896	6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe	wuauclt.exe
PID 2896 wrote to memory of 2600	2896	6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe	cmd.exe
PID 2896 wrote to memory of 2600	2896	6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe	cmd.exe
PID 2896 wrote to memory of 2600	2896	6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe	cmd.exe
PID 2896 wrote to memory of 2600	2896	6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe
"C:\Users\Admin\AppData\Local\Temp\6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2896

C:\ProgramData\Update\wuauclt.exe
"C:\ProgramData\Update\wuauclt.exe" /run
2⤵
- Executes dropped EXE
PID:2236

C:\windows\SysWOW64\cmd.exe
"C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\6c9bd914e5070d3f708af031c0964d9c0a21c21b7885462ae9ad60e9d6996f21.exe" >> NUL
2⤵
- Deletes itself
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\wuauclt.exe

Filesize
134KB

MD5
1d67ef3aa28bf3d23384d86a48bf0eed

SHA1
6e4f24faa53f94b73ed8be2efb7fb21a0cc59f57

SHA256
769f6547f742cb85d35b6409291f94799fc697f80d725395c8e39e41ea366a23

SHA512
1213be6fb9d80d8cd604c734b8875961a65311d8ef34d966e1db9eb8c465a12132c6c770cfb63760ba58d6ef8370f0f1d2140c0d96400f413d7ccc8f2e956aa8

Download Submit
memory/2236-6-0x0000000001340000-0x0000000001368000-memory.dmp

Filesize
160KB

Download
memory/2896-0-0x0000000001300000-0x0000000001328000-memory.dmp

Filesize
160KB

Download
memory/2896-7-0x0000000001300000-0x0000000001328000-memory.dmp

Filesize
160KB

Download
memory/2896-8-0x00000000001D0000-0x00000000001F8000-memory.dmp

Filesize
160KB

Download
memory/2896-10-0x00000000001D0000-0x00000000001F8000-memory.dmp

Filesize
160KB

Download
memory/2896-9-0x0000000001300000-0x0000000001328000-memory.dmp

Filesize
160KB

Download