1c12ecb57f113a18084e8034ff757adf3dfecb8e06b954ac08dd3f0ddd533591

Analysis

max time kernel
100s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09f8456cc2de8bb7f2e68268788b8b60N.exe
Size

135KB
MD5

09f8456cc2de8bb7f2e68268788b8b60
SHA1

73b7c211c60b3d61157251e2b52016a3319cba1b
SHA256

1c12ecb57f113a18084e8034ff757adf3dfecb8e06b954ac08dd3f0ddd533591
SHA512

41cb8e80503aac4ac4611ab8addd6f31cf0465d81b2de61d455869ce2b74a9ad66b81c9a7cbe3b91960b87a070b5d059c7107fd5f68dafe5b855af6dc1c30a1a
SSDEEP

1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOq:YfU/WF6QMauSuiWNi9eNOl0007NZIOq

Score

7^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	09f8456cc2de8bb7f2e68268788b8b60N.exe

Executes dropped EXE 1 IoCs

pid	Process
3444	wuauclt.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2012-0-0x00000000005B0000-0x00000000005D8000-memory.dmp	upx
behavioral2/memory/3444-4-0x00000000009C0000-0x00000000009E8000-memory.dmp	upx
behavioral2/files/0x0007000000023455-3.dat	upx
behavioral2/memory/2012-6-0x00000000005B0000-0x00000000005D8000-memory.dmp	upx
behavioral2/memory/3444-7-0x00000000009C0000-0x00000000009E8000-memory.dmp	upx
behavioral2/memory/2012-8-0x00000000005B0000-0x00000000005D8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run"	09f8456cc2de8bb7f2e68268788b8b60N.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09f8456cc2de8bb7f2e68268788b8b60N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuauclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3444	2012	09f8456cc2de8bb7f2e68268788b8b60N.exe	84
PID 2012 wrote to memory of 3444	2012	09f8456cc2de8bb7f2e68268788b8b60N.exe	84
PID 2012 wrote to memory of 3444	2012	09f8456cc2de8bb7f2e68268788b8b60N.exe	84
PID 2012 wrote to memory of 3212	2012	09f8456cc2de8bb7f2e68268788b8b60N.exe	97
PID 2012 wrote to memory of 3212	2012	09f8456cc2de8bb7f2e68268788b8b60N.exe	97
PID 2012 wrote to memory of 3212	2012	09f8456cc2de8bb7f2e68268788b8b60N.exe	97

C:\Users\Admin\AppData\Local\Temp\09f8456cc2de8bb7f2e68268788b8b60N.exe
"C:\Users\Admin\AppData\Local\Temp\09f8456cc2de8bb7f2e68268788b8b60N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012
- C:\ProgramData\Update\wuauclt.exe
  "C:\ProgramData\Update\wuauclt.exe" /run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3444
- C:\windows\SysWOW64\cmd.exe
  "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\09f8456cc2de8bb7f2e68268788b8b60N.exe" >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\wuauclt.exe

Filesize
135KB

MD5
0ccc34971b66bf32174ed4d48eb72d0d

SHA1
bbddd2aab15e0e15077950e7c8dc55b4bb7ec901

SHA256
dab2bfaf29ae6d4631bb5ab97f83f6de03abb080d522d081e431c41f7f691a95

SHA512
81bf90038f9019c3275ecf16bae22f0222a0e5347df5c8d4af2af05119edb6232e1dffbf17c4378ddcd7d548357b5059d8259a37a1395b948c537f49cff082a5

Download Submit
memory/2012-0-0x00000000005B0000-0x00000000005D8000-memory.dmp

Filesize
160KB

Download
memory/2012-6-0x00000000005B0000-0x00000000005D8000-memory.dmp

Filesize
160KB

Download
memory/2012-8-0x00000000005B0000-0x00000000005D8000-memory.dmp

Filesize
160KB

Download
memory/3444-4-0x00000000009C0000-0x00000000009E8000-memory.dmp

Filesize
160KB

Download
memory/3444-7-0x00000000009C0000-0x00000000009E8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads