cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe
Size

134KB
MD5

03513b2a2332c193f750f38c9a77e8f3
SHA1

30886b24bd5eb9285c1d45e3e89c1ac108f7992a
SHA256

cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2
SHA512

c57cb1820607e60bb957394ee15f1f6a1779acc480aa0d972259de6fc327d52d2aa91706963a479efea533cf0ee3d2d2d78489b8a4df51f3e53654d588aa663f
SSDEEP

1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOH:YfU/WF6QMauSuiWNi9eNOl0007NZIOH

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1284	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1948	wuauclt.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2416-0-0x00000000012B0000-0x00000000012D8000-memory.dmp	upx
behavioral1/files/0x000a00000001471a-5.dat	upx
behavioral1/memory/1948-7-0x0000000001390000-0x00000000013B8000-memory.dmp	upx
behavioral1/memory/2416-8-0x00000000012B0000-0x00000000012D8000-memory.dmp	upx
behavioral1/memory/1948-10-0x0000000001390000-0x00000000013B8000-memory.dmp	upx
behavioral1/memory/2416-11-0x00000000012B0000-0x00000000012D8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run"	cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1948	2416	cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe	28
PID 2416 wrote to memory of 1948	2416	cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe	28
PID 2416 wrote to memory of 1948	2416	cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe	28
PID 2416 wrote to memory of 1948	2416	cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe	28
PID 2416 wrote to memory of 1284	2416	cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe	29
PID 2416 wrote to memory of 1284	2416	cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe	29
PID 2416 wrote to memory of 1284	2416	cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe	29
PID 2416 wrote to memory of 1284	2416	cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe	29

C:\Users\Admin\AppData\Local\Temp\cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe
"C:\Users\Admin\AppData\Local\Temp\cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2416
- C:\ProgramData\Update\wuauclt.exe
  "C:\ProgramData\Update\wuauclt.exe" /run
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\windows\SysWOW64\cmd.exe
  "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\cbd888379ea2584436c0a55e9ccf04a02f03ca02624cd3e68700fcc3a02276a2.exe" >> NUL
  2⤵
  - Deletes itself
  PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\wuauclt.exe

Filesize
134KB

MD5
7a5560f40cd943385083b95931977500

SHA1
9608a2d882d9fa740961a57f2296af035f9fd204

SHA256
849774faa61ad65668e06c28f40c5457ba0ab1f4c54f42b7aff9f4fab02c1306

SHA512
6823fd40b15cdff1910eb3da4cff5692b11d725660a4ab41e55badf287739ea5cdb1389707ab47622c5782707ecb8e98b6346ad0d377556b66c9022e31279136

Download Submit
memory/1948-7-0x0000000001390000-0x00000000013B8000-memory.dmp

Filesize
160KB

Download
memory/1948-10-0x0000000001390000-0x00000000013B8000-memory.dmp

Filesize
160KB

Download
memory/2416-0-0x00000000012B0000-0x00000000012D8000-memory.dmp

Filesize
160KB

Download
memory/2416-6-0x0000000000080000-0x00000000000A8000-memory.dmp

Filesize
160KB

Download
memory/2416-8-0x00000000012B0000-0x00000000012D8000-memory.dmp

Filesize
160KB

Download
memory/2416-9-0x0000000000080000-0x00000000000A8000-memory.dmp

Filesize
160KB

Download
memory/2416-11-0x00000000012B0000-0x00000000012D8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads