999e219ddeed9d4b0826f78d30abb823122ccaf2eefe8f5bb4ff8316f9443556

Analysis

max time kernel
150s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update_checker.exe
Size

190KB
MD5

fd9b065e442d3c9a81188c8fc5dbfc96
SHA1

7ef66c2fb137008fed913aff96c8d331b239ac22
SHA256

f854d61b9b0be2610bd8cb766b7206e07b25fe85715bda060d88ecff80dfc340
SHA512

6bb900abdb254f141624de3d79ea01830192ebaa5c4ba800cb48c85fc578f3ea5d6bb4c51363bba25270a10a645ba0f156bc14d966b31fae30f6fdd7cec8d744
SSDEEP

3072:60Ta3qy6st1ZQMO+0YOTaWKDjuipiMfCg86Js88XOSZDDiI5P4qVvQOhHFWUYCIz:Pa3qy6stjQOMLKDjumnJsX5S64qVoORa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\sdp	update_checker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\sdp\WarnOnOpen = "0"	update_checker.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdp	update_checker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sdp\ = "URL:SDP Protocol"	update_checker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sdp\URL Protocol	update_checker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdp\shell\open\command	update_checker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdp\shell	update_checker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdp\shell\open	update_checker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sdp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\update_checker.exe\" /protocol %1"	update_checker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
740	update_checker.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
740	update_checker.exe

C:\Users\Admin\AppData\Local\Temp\update_checker.exe
"C:\Users\Admin\AppData\Local\Temp\update_checker.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...