Analysis
-
max time kernel
107s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 05:28
Behavioral task
behavioral1
Sample
98bfdcdeac069f922226ba62fd105920N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
98bfdcdeac069f922226ba62fd105920N.exe
Resource
win10v2004-20240709-en
General
-
Target
98bfdcdeac069f922226ba62fd105920N.exe
-
Size
135KB
-
MD5
98bfdcdeac069f922226ba62fd105920
-
SHA1
ae9020f09a75123797cf8d865b85d257ae0456e3
-
SHA256
d5b893634668ba25aec12ab1d46453d4bbb3ccb38eb54062d34600e8535c4c66
-
SHA512
d060098cbfbf8aa699a87cf542ea7377a36038494af7c775727a375cac24d205fd1224715803a99c9c35cdfede7197f5468f9efe7615b0929a9631c1bbc3899a
-
SSDEEP
1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOH:YfU/WF6QMauSuiWNi9eNOl0007NZIOH
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
98bfdcdeac069f922226ba62fd105920N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation 98bfdcdeac069f922226ba62fd105920N.exe -
Executes dropped EXE 1 IoCs
Processes:
wuauclt.exepid process 1232 wuauclt.exe -
Processes:
resource yara_rule behavioral2/memory/5104-0-0x00000000007D0000-0x00000000007F8000-memory.dmp upx C:\ProgramData\Update\wuauclt.exe upx behavioral2/memory/1232-5-0x0000000000FF0000-0x0000000001018000-memory.dmp upx behavioral2/memory/5104-6-0x00000000007D0000-0x00000000007F8000-memory.dmp upx behavioral2/memory/1232-7-0x0000000000FF0000-0x0000000001018000-memory.dmp upx behavioral2/memory/5104-8-0x00000000007D0000-0x00000000007F8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
98bfdcdeac069f922226ba62fd105920N.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run" 98bfdcdeac069f922226ba62fd105920N.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
98bfdcdeac069f922226ba62fd105920N.exewuauclt.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98bfdcdeac069f922226ba62fd105920N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauclt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
98bfdcdeac069f922226ba62fd105920N.exedescription pid process target process PID 5104 wrote to memory of 1232 5104 98bfdcdeac069f922226ba62fd105920N.exe wuauclt.exe PID 5104 wrote to memory of 1232 5104 98bfdcdeac069f922226ba62fd105920N.exe wuauclt.exe PID 5104 wrote to memory of 1232 5104 98bfdcdeac069f922226ba62fd105920N.exe wuauclt.exe PID 5104 wrote to memory of 4468 5104 98bfdcdeac069f922226ba62fd105920N.exe cmd.exe PID 5104 wrote to memory of 4468 5104 98bfdcdeac069f922226ba62fd105920N.exe cmd.exe PID 5104 wrote to memory of 4468 5104 98bfdcdeac069f922226ba62fd105920N.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98bfdcdeac069f922226ba62fd105920N.exe"C:\Users\Admin\AppData\Local\Temp\98bfdcdeac069f922226ba62fd105920N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Update\wuauclt.exe"C:\ProgramData\Update\wuauclt.exe" /run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\98bfdcdeac069f922226ba62fd105920N.exe" >> NUL2⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Update\wuauclt.exeFilesize
135KB
MD5081583a95cff7bb1d78acb9933f1db53
SHA165e6c974de316a57af42a61557816d0d6f5b698d
SHA256cd173746f0aca8b313063f671ee8522a0717bca9205ef36e483f9eca9e0cafeb
SHA51256172b062b7a530089e29186b2e03ff081078469c7603c38cb37a2f264f19d5d67408a65d40e163153433c3d5d434776f50d15feea7a4f9382cad5328ef32fa9
-
memory/1232-5-0x0000000000FF0000-0x0000000001018000-memory.dmpFilesize
160KB
-
memory/1232-7-0x0000000000FF0000-0x0000000001018000-memory.dmpFilesize
160KB
-
memory/5104-0-0x00000000007D0000-0x00000000007F8000-memory.dmpFilesize
160KB
-
memory/5104-6-0x00000000007D0000-0x00000000007F8000-memory.dmpFilesize
160KB
-
memory/5104-8-0x00000000007D0000-0x00000000007F8000-memory.dmpFilesize
160KB