2b40d424237ca996aeb4106ede91f3a831dc106781f7f79196fe10b9efbe98de

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

!!BEST TWEAKS/Windows Post-Installation Pack/1 Disable WUs/2 Disable WUs.cmd
Size

763B
MD5

4d7ad463f41e3489cfa8ec4327a67166
SHA1

b6424856de31b9bf49b2f354186e7f8598802b3b
SHA256

35e2e4cfae6c8e936cef2b3cf2ce179687eef3ad89e8746e81cc228b5588a090
SHA512

01bcc635644cfaf1f8673098b301e0d25e9adabb1b5c3b448041f1edf5bf43c82e2286c992079407916a875d5a9d1c1f152779883e456626a3940d20aec173d6

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DATAST~1\DATAST~1.EDB	cmd.exe
File opened for modification	C:\Windows\SoftwareDistribution\DATAST~1\DATAST~1.JFM	cmd.exe
File opened for modification	C:\Windows\SoftwareDistribution\DATAST~1\Logs\edb.log	cmd.exe
File opened for modification	C:\Windows\SoftwareDistribution\REPORT~1.LOG	cmd.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4500	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	taskkill.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 4500	2016	cmd.exe	83
PID 2016 wrote to memory of 4500	2016	cmd.exe	83
PID 2016 wrote to memory of 64	2016	cmd.exe	85
PID 2016 wrote to memory of 64	2016	cmd.exe	85
PID 64 wrote to memory of 3140	64	net.exe	86
PID 64 wrote to memory of 3140	64	net.exe	86
PID 2016 wrote to memory of 1500	2016	cmd.exe	87
PID 2016 wrote to memory of 1500	2016	cmd.exe	87
PID 1500 wrote to memory of 4868	1500	net.exe	88
PID 1500 wrote to memory of 4868	1500	net.exe	88
PID 2016 wrote to memory of 3568	2016	cmd.exe	89
PID 2016 wrote to memory of 3568	2016	cmd.exe	89
PID 2016 wrote to memory of 3868	2016	cmd.exe	90
PID 2016 wrote to memory of 3868	2016	cmd.exe	90
PID 2016 wrote to memory of 3916	2016	cmd.exe	91
PID 2016 wrote to memory of 3916	2016	cmd.exe	91
PID 2016 wrote to memory of 2300	2016	cmd.exe	92
PID 2016 wrote to memory of 2300	2016	cmd.exe	92
PID 2016 wrote to memory of 3776	2016	cmd.exe	93
PID 2016 wrote to memory of 3776	2016	cmd.exe	93
PID 2016 wrote to memory of 2516	2016	cmd.exe	102
PID 2016 wrote to memory of 2516	2016	cmd.exe	102
PID 2516 wrote to memory of 1828	2516	net.exe	103
PID 2516 wrote to memory of 1828	2516	net.exe	103
PID 2016 wrote to memory of 1260	2016	cmd.exe	104
PID 2016 wrote to memory of 1260	2016	cmd.exe	104
PID 1260 wrote to memory of 4624	1260	net.exe	105
PID 1260 wrote to memory of 4624	1260	net.exe	105

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\!!BEST TWEAKS\Windows Post-Installation Pack\1 Disable WUs\2 Disable WUs.cmd"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\taskkill.exe
  taskkill /F /FI "IMAGENAME eq SystemSettings.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:3140
- C:\Windows\system32\net.exe
  net stop UsoSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop UsoSvc
    3⤵
    PID:4868
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DoNotConnectToWindowsUpdateInternetLocations" /t REG_DWORD /d "1" /f
  2⤵
  PID:3568
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "SetDisableUXWUAccess" /t REG_DWORD /d "1" /f
  2⤵
  PID:3868
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d "1" /f
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "ExcludeWUDriversInQualityUpdate" /t REG_DWORD /d "1" /f
  2⤵
  PID:2300
- C:\Windows\system32\gpupdate.exe
  gpupdate /force
  2⤵
  PID:3776
- C:\Windows\system32\net.exe
  net start wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start wuauserv
    3⤵
    PID:1828
- C:\Windows\system32\net.exe
  net start UsoSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start UsoSvc
    3⤵
    PID:4624

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads