Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
02-08-2024 13:05
Behavioral task
behavioral1
Sample
windows update.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
windows update.exe
Resource
win10v2004-20240730-en
General
-
Target
windows update.exe
-
Size
76.5MB
-
MD5
0cf0b1a0d4ddcf3e9ff391acf06adf74
-
SHA1
a2795e52bbd984640f8178e5af63109d3368537d
-
SHA256
13d1623ec2530efe0741550cf19a5ca5861c57f979227807dc99337c43496065
-
SHA512
396c91ef4b5ec7cdb7eaaa2d92f9f820bb28e207de2a622832a745ae90a8e71b5ba86bf8d09a98e54f4b3737d3a99590dba668d8dbfdf9b1c89e18ab23a5dd87
-
SSDEEP
1572864:JvHcRlPSk8IpG7V+VPhqYdfME7FFlHFziYweyJulZUdgAdW4zjtux3a/Z9U:JvHcRlSkB05awcfhdCpukdRPA49U
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
windows update.exepid process 2552 windows update.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI16482\python312.dll upx behavioral1/memory/2552-1253-0x000007FEF5E50000-0x000007FEF6514000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
windows update.exedescription pid process target process PID 1648 wrote to memory of 2552 1648 windows update.exe windows update.exe PID 1648 wrote to memory of 2552 1648 windows update.exe windows update.exe PID 1648 wrote to memory of 2552 1648 windows update.exe windows update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows update.exe"C:\Users\Admin\AppData\Local\Temp\windows update.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\windows update.exe"C:\Users\Admin\AppData\Local\Temp\windows update.exe"2⤵
- Loads dropped DLL
PID:2552
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5506c760a20e6bb940590229d41449ffa
SHA1b7c439f253987fb0ff66fc5ce959cf711b18eb8d
SHA256e63503b2715df3eab8abb9b2682129e27a7add9acea9008f06f55494a2b2f3d5
SHA51234df2e8e53caac0cd72cb3c5848296ca8cfa10c542c0a5f88385d6b35ab70b86957540de2ff105a27cefb37ccbb5789261a69132b535a857df32875c1f9deb9e