a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Original/Document-772976_829712.scr
Size

241KB
MD5

c2d73485095efdbd7ab625e469affb11
SHA1

a0a7b943b46979cc593474b94f14f2451b8ac3c0
SHA256

523b9e8057ef0905e2c7d51b742d4be9374cf2eee5a810f05d987604847c549d
SHA512

ceafd283a2ce95ae5288871fe1732f97b600a4e08981b044fda925e15cfed120a37015c633de4daabfccdd3716dc9e0f4865468f647d8bd627339815d5bcf131
SSDEEP

6144:/GpBEWJvXcs5eyOfevIUdy/ZV6u2nf0+8aq:/GkEEJy3IUdy/ZVrifqaq

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

googleupdaterr.exe

pid process

2752 googleupdaterr.exe
Executes dropped EXE 1 IoCs

Processes:

googleupdaterr.exe

pid process

2752 googleupdaterr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

googleupdaterr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Local\\googleupdaterr.exe"	googleupdaterr.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

544 2752 WerFault.exe googleupdaterr.exe
Modifies registry class 1 IoCs

Processes:

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\

pid	pid_target	process	target process
544	2752	WerFault.exe	googleupdaterr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

googleupdaterr.exe

pid	process
2752	googleupdaterr.exe
2752	googleupdaterr.exe
2752	googleupdaterr.exe
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384
3384

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Document-772976_829712.scrgoogleupdaterr.exe

pid process

992 Document-772976_829712.scr
2752 googleupdaterr.exe

pid	process
992	Document-772976_829712.scr
2752	googleupdaterr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3384
Token: SeCreatePagefilePrivilege	3384
Token: SeShutdownPrivilege	3384
Token: SeCreatePagefilePrivilege	3384
Token: SeDebugPrivilege	3384
Token: SeShutdownPrivilege	3384
Token: SeCreatePagefilePrivilege	3384

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

3384
3384
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

Document-772976_829712.scrgoogleupdaterr.exe

pid process

992 Document-772976_829712.scr
992 Document-772976_829712.scr
2752 googleupdaterr.exe
2752 googleupdaterr.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3384

pid	process
3384
3384

pid	process
992	Document-772976_829712.scr
992	Document-772976_829712.scr
2752	googleupdaterr.exe
2752	googleupdaterr.exe

pid	process
3384

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Document-772976_829712.scr

description	pid	process	target process
PID 992 wrote to memory of 2752	992	Document-772976_829712.scr	googleupdaterr.exe
PID 992 wrote to memory of 2752	992	Document-772976_829712.scr	googleupdaterr.exe
PID 992 wrote to memory of 2752	992	Document-772976_829712.scr	googleupdaterr.exe

C:\Users\Admin\AppData\Local\Temp\Original\Document-772976_829712.scr
"C:\Users\Admin\AppData\Local\Temp\Original\Document-772976_829712.scr" /S
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992

C:\Users\Admin\AppData\Local\googleupdaterr.exe
C:\Users\Admin\AppData\Local\Temp\Original\Document-772976_829712.scr
2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 608
3⤵
- Program crash
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2752 -ip 2752
1⤵
PID:364

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\googleupdaterr.exe
Filesize
241KB

MD5
c2d73485095efdbd7ab625e469affb11

SHA1
a0a7b943b46979cc593474b94f14f2451b8ac3c0

SHA256
523b9e8057ef0905e2c7d51b742d4be9374cf2eee5a810f05d987604847c549d

SHA512
ceafd283a2ce95ae5288871fe1732f97b600a4e08981b044fda925e15cfed120a37015c633de4daabfccdd3716dc9e0f4865468f647d8bd627339815d5bcf131

Download Submit
memory/992-1-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/992-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/992-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/992-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2752-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2752-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2752-29-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3384-24-0x00000000078C0000-0x00000000078E5000-memory.dmp

Filesize
148KB

Download
memory/3384-23-0x00000000078C0000-0x00000000078E5000-memory.dmp

Filesize
148KB

Download
memory/3384-25-0x00000000078C0000-0x00000000078E5000-memory.dmp

Filesize
148KB

Download
memory/3384-21-0x00000000078C0000-0x00000000078E5000-memory.dmp

Filesize
148KB

Download
memory/3384-28-0x00000000078C0000-0x00000000078E5000-memory.dmp

Filesize
148KB

Download
memory/3384-27-0x0000000002270000-0x0000000002293000-memory.dmp

Filesize
140KB

Download