0c35ab1832945198c2e913891461a84f4872b5be60a64fd91084eead9e4e23e6

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update.exe
Size

16KB
MD5

af87d850a15f1fbde5e824116e1f174b
SHA1

9d704094e5f7386104dc5b7b155768fbac9fc0f9
SHA256

11863fecf89dd0fd635456d680fa4a268d9f63dc5a76093fbb79c6686d5ae17b
SHA512

b0962ca6b3f96defd0b34c723bf13ec35cbda1ed5551ac41ee0ef04fffb799284ad7e4324c856443f14511b7ee83dc2bdc5588c6d6a87050ac4344c4d08c13b3
SSDEEP

384:K0sAA+LPsuTnVshZ9hA+b3Qj5MRjVpV/QBOIjLbd:KaV/+b3N3pV/yb

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (840) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt.abc	update.exe
File created	C:\Windows\SysWOW64\drivers\gm.dls.abc	update.exe
File created	C:\Windows\SysWOW64\drivers\README.txt	update.exe
File created	C:\Windows\SysWOW64\drivers\afunix.sys.abc	update.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	update.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	update.exe
File opened (read-only)	\??\Y:	update.exe
File opened (read-only)	\??\G:	update.exe
File opened (read-only)	\??\M:	update.exe
File opened (read-only)	\??\N:	update.exe
File opened (read-only)	\??\O:	update.exe
File opened (read-only)	\??\R:	update.exe
File opened (read-only)	\??\T:	update.exe
File opened (read-only)	\??\Z:	update.exe
File opened (read-only)	\??\A:	update.exe
File opened (read-only)	\??\B:	update.exe
File opened (read-only)	\??\E:	update.exe
File opened (read-only)	\??\J:	update.exe
File opened (read-only)	\??\P:	update.exe
File opened (read-only)	\??\W:	update.exe
File opened (read-only)	\??\H:	update.exe
File opened (read-only)	\??\I:	update.exe
File opened (read-only)	\??\L:	update.exe
File opened (read-only)	\??\Q:	update.exe
File opened (read-only)	\??\S:	update.exe
File opened (read-only)	\??\V:	update.exe
File opened (read-only)	\??\K:	update.exe
File opened (read-only)	\??\U:	update.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\adsmsext.dll.abc	update.exe
File created	C:\Windows\SysWOW64\en-US\dsregtask.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\KBDHE319.DLL.abc	update.exe
File created	C:\Windows\SysWOW64\l3codecp.acm.abc	update.exe
File created	C:\Windows\SysWOW64\en-US\gpedit.msc.abc	update.exe
File created	C:\Windows\SysWOW64\fr-FR\tapi3.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\ja-JP\tapi3.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\msdart.dll.abc	update.exe
File created	C:\Windows\SysWOW64\ro-RO\README.txt	update.exe
File created	C:\Windows\SysWOW64\ja-JP\appmgmts.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\de-DE\wuapi.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\dmcompos.dll.abc	update.exe
File created	C:\Windows\SysWOW64\avifil32.dll.abc	update.exe
File created	C:\Windows\SysWOW64\Dism\AssocProvider.dll.abc	update.exe
File created	C:\Windows\SysWOW64\downlevel\api-ms-win-core-datetime-l1-1-1.dll.abc	update.exe
File created	C:\Windows\SysWOW64\en-US\p2p.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\en-US\DevicePairingFolder.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\fr-FR\wlanutil.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\ja-JP\spp.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\MSAC3ENC.DLL.abc	update.exe
File created	C:\Windows\SysWOW64\gmsaclient.dll.abc	update.exe
File created	C:\Windows\SysWOW64\icsigd.dll.abc	update.exe
File created	C:\Windows\SysWOW64\ja-JP\WebcamUi.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\de-DE\aeevts.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\dxtrans.dll.abc	update.exe
File created	C:\Windows\SysWOW64\hr-HR\README.txt.abc	update.exe
File created	C:\Windows\SysWOW64\Keywords\ti_dnn_fast_es-ES.table.abc	update.exe
File created	C:\Windows\SysWOW64\de-DE\rsop.msc.abc	update.exe
File created	C:\Windows\SysWOW64\es-ES\g711codc.ax.mui.abc	update.exe
File created	C:\Windows\SysWOW64\it-IT\Windows.ApplicationModel.Store.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\it-IT\winmsipc.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\README.txt	update.exe
File created	C:\Windows\SysWOW64\d3d8.dll.abc	update.exe
File created	C:\Windows\SysWOW64\djctq.rs.abc	update.exe
File created	C:\Windows\SysWOW64\dwmapi.dll.abc	update.exe
File created	C:\Windows\SysWOW64\htui.dll.abc	update.exe
File created	C:\Windows\SysWOW64\ja-JP\qdvd.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\en-US\ActiveSyncProvider.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\en-US\SyncRes.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\LAPRXY.DLL.abc	update.exe
File created	C:\Windows\SysWOW64\cic.dll.abc	update.exe
File created	C:\Windows\SysWOW64\en-US\audiodev.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\fr-FR\Windows.ApplicationModel.Store.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\bdaplgin.ax.abc	update.exe
File created	C:\Windows\SysWOW64\de-DE\wcncsvc.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\downlevel\api-ms-win-core-fibers-l1-1-0.dll.abc	update.exe
File created	C:\Windows\SysWOW64\ja-JP\activeds.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\ja-JP\msoert2.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\ja-JP\onexui.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\ja-JP\packager.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\Dism\OSProvider.dll.abc	update.exe
File created	C:\Windows\SysWOW64\Keywords\ti_dnn_es.table.abc	update.exe
File created	C:\Windows\SysWOW64\loadperf.dll.abc	update.exe
File created	C:\Windows\SysWOW64\bcrypt.dll.abc	update.exe
File created	C:\Windows\SysWOW64\de-DE\PeerDistSh.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\de-DE\rastls.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\drt.dll.abc	update.exe
File created	C:\Windows\SysWOW64\it-IT\sendmail.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\it-IT\cmutil.dll.mui.abc	update.exe
File created	C:\Windows\SysWOW64\Kswdmcap.ax.abc	update.exe
File created	C:\Windows\SysWOW64\dlnashext.dll.abc	update.exe
File created	C:\Windows\SysWOW64\mprmsg.dll.abc	update.exe
File created	C:\Windows\SysWOW64\DisplayManager.dll.abc	update.exe
File created	C:\Windows\SysWOW64\en-US\cdosys.dll.mui.abc	update.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\README.txt	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\MyOffice.winmd.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\oneclient.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\CalculatorApp.winmd.abc	update.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.abc	update.exe
File created	C:\Program Files\Mozilla Firefox\libEGL.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\logo.png.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\LICENSE.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\BuildInfo.xml.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxManifest.xml.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\README.txt	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\VideoWhatsNewItems.json.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml.abc	update.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Threading.Tasks.Extensions.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\resources.pri.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\README.txt	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Diagnostics.Tools.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\logo.png.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\Microsoft.Services.Store.Engagement.winmd.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\yoga.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\TimeAppService.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\MemMDL2.1.85.ttf.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Net.NameResolution.dll.abc	update.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Microsoft.Apps.People.BackgroundTasks.winmd.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Helper.winmd.abc	update.exe
File created	C:\Program Files (x86)\Windows Mail\wabimp.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\README.txt	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\msvcp140.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.VideoTk.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\StandardShader.vs.cso.abc	update.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.abc	update.exe
File created	C:\Program Files\Windows Media Player\ja-JP\README.txt	update.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\README.txt	update.exe
File created	C:\Program Files (x86)\Windows Media Player\it-IT\README.txt	update.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui.abc	update.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Runtime.WindowsRuntime.UI.Xaml.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml.abc	update.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui.abc	update.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\logo.png.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Numerics.Vectors.WindowsRuntime.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\AppxSignature.p7x.abc	update.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.HxCalendar.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\mrt100_app.dll.abc	update.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\wmpnssci.dll.mui.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\README.txt	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\mso50imm.dll.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\BuildInfo.xml.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\README.txt	update.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\clrjit.dll.abc	update.exe
File created	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl.abc	update.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.abc	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Cng.dll.abc	update.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..artup-cpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_144e3fa397d780b5\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.173_none_af877ec0b0472fde\oskclearui.xml.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-timedate.resources_31bf3856ad364e35_10.0.19041.1_it-it_66605a628b963f04\timedate.cpl.mui.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-webservices_31bf3856ad364e35_10.0.19041.546_none_ec759f398d818a49\webservices.dll.abc	update.exe
File created	C:\Windows\WinSxS\Backup\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7_winshfhc.dll_c3811e1c.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_microsoft.activities.build.resources_31bf3856ad364e35_4.0.15805.0_de-de_e429a236dfb5f440.manifest.abc	update.exe
File created	C:\Windows\WinSxS\x86_netfx-web_engine_dll_b03f5f7f11d50a3a_10.0.19041.1_none_f787ded4c8ebc005\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..assistant.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c6b85fccfedad2f\pcaevts.dll.mui.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\xhrBreakpointDisabled.png.abc	update.exe
File created	C:\Windows\WinSxS\amd64_wave.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5c51c4beb532170e\wave.inf_loc.abc	update.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.19041.1_none_b3552a6f4dc424b4_s8514oem.fon_304f98b5.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-t..tkeyboard.resources_31bf3856ad364e35_10.0.19041.1_de-de_f5299921f6a2df66.manifest.abc	update.exe
File created	C:\Windows\WinSxS\msil_system.windows.presentation.resources_b77a5c561934e089_10.0.19041.1_ja-jp_5365731127a04e9c\README.txt	update.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..anagement.resources_31bf3856ad364e35_10.0.19041.1_de-de_ddc0ee03bd59c330\diskmgmt.msc.abc	update.exe
File created	C:\Windows\WinSxS\x86_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.19041.1_none_6fa7e5bbaa15a17d\topGradRepeat.jpg.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.19041.1_none_25afcd12036f5605\secproc_ssp.dll.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..providers.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c976a292fae256ac\WimProvider.dll.mui.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ieframe.resources_31bf3856ad364e35_11.0.19041.1_en-us_79a8d08cd7e5bb3a\ieframe.dll.mui.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-opengl_31bf3856ad364e35_10.0.19041.1_none_c4b6039628c533bc\glu32.dll.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-storageservice_31bf3856ad364e35_10.0.19041.1266_none_241e2b8a1f785c57\StorageUsage.dll.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-m..agnostics.resources_31bf3856ad364e35_10.0.19041.1_pt-pt_e586b0bfbc4c3337.manifest.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-t..interface.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_eb38476f1c1f46e0.manifest.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..nt-winproviders-ibs_31bf3856ad364e35_10.0.19041.1_none_97acae5dfa83b75b\IBSProvider.dll.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.1_none_0423901f2a62a812\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft.build.tasks.v4.0.resources_b03f5f7f11d50a3a_4.0.15805.0_it-it_1238242afefaa6a9\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_10.0.19041.1_de-de_ddddec6e41bac435\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_windows-defender-ui.resources_31bf3856ad364e35_10.0.19041.1_it-it_ca22445a16ca15aa\README.txt	update.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-partitionmanager_31bf3856ad364e35_10.0.19041.1_none_978d210f59cd170e.manifest.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-usercpl.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_d35b1adf70e84e97\usercpl.dll.mui.abc	update.exe
File created	C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\SecurityHealthAgent.dll.abc	update.exe
File created	C:\Windows\WinSxS\FileMaps\$$_microsoft.net_assembly_gac_msil_system.web.services.resources_v4.0_4.0.0.0_de_b03f5f7f11d50a3a_df478fa4bf591501.cdf-ms.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_bthoob.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_1138818ab7c252e9.manifest.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-l2na.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_8b0c677534e50dc9\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..ion_service_runtime_31bf3856ad364e35_10.0.19041.1_none_aef1e827e1e3c993\ias.dll.abc	update.exe
File created	C:\Windows\WinSxS\Catalogs\18675d3cc752eda5c889ebb4065d43f247b85ff9b145d95eafbaa1812fbc9f13.cat.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-t..-tlsbrand.resources_31bf3856ad364e35_10.0.19041.1_de-de_2a57a572a8d5f6c9.manifest.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_he-il_0be8f8db96d74140\README.txt	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-i..trolpanel.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_2fa8e294647b83df.manifest.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..opinstallcomponents_31bf3856ad364e35_10.0.19041.662_none_d0ad3eafc6e540ad\umpnpmgr.mof.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..tooth-hfp.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8f2a08510b438b16\README.txt	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-m..extension.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c872acfba83ed9a7.manifest.abc	update.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-perceptiondevice-dll_31bf3856ad364e35_10.0.19041.1_none_51b0f1e38713aa1e\PerceptionDevice.dll.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_tr-tr_c2f24ed0bf347cdd\bootmgr.efi.mui.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_10.0.19041.264_none_1075dbf41234b43d\wiarpc.dll.abc	update.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9baaad1ae7af9c30_memtest.efi.mui_71e15c22.abc	update.exe
File created	C:\Windows\WinSxS\Catalogs\51e2248ed500304e4ed997354ab0d519ae64bdb40c169c4ef3f4a669a498597f.cat.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d9215e46435b05ba.manifest.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..-cryptngc.resources_31bf3856ad364e35_10.0.19041.1_it-it_fb59d4d28a2f4365.manifest.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_wcf-m_smsvchost_perf_c_ini_31bf3856ad364e35_10.0.19041.1_none_ea279e98ab8cfa9a.manifest.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-stobject.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_7546d62018135073\stobject.dll.mui.abc	update.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_pt-pt_793f302d0ac255cf.manifest.abc	update.exe
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.19041.1081_none_2adbc983514c73da_iprtprio.dll_5829c3c7.abc	update.exe
File created	C:\Windows\WinSxS\Catalogs\df480763014bc8959a7d136f309731b0600bcb836afd6505eb0a7dd48b4f6eab.cat.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ne-dsacls.resources_31bf3856ad364e35_10.0.19041.1_es-es_95368ec63f03ed08\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_1e878507ca43aae4\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_10.0.19041.1_de-de_49514db39052ad33\nsisvc.dll.mui.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_wpf-nonwow64regkeys_31bf3856ad364e35_10.0.19041.1_none_7a297d94949a6746.manifest.abc	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..atibility.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_66188cfb51e0e707\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus.res.resources_31bf3856ad364e35_10.0.19041.1_en-us_590d912de16dd7ff\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ellibrary.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_75fa55d68d990101\wdf01000.sys.mui.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-i..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_uk-ua_cb7c43b70bc5b9f8.manifest.abc	update.exe
File created	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-u..k-library.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_96bc4689091c7817.manifest.abc	update.exe
File created	C:\Windows\WinSxS\amd64_dual_mdmrock3.inf_31bf3856ad364e35_10.0.19041.1_none_897a553137c7ac31\README.txt	update.exe
File created	C:\Windows\WinSxS\amd64_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.15805.0_none_3303de6fba37b5c7\deselectedTab_1x1.gif.abc	update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 756	4888	update.exe	86
PID 4888 wrote to memory of 756	4888	update.exe	86
PID 4888 wrote to memory of 756	4888	update.exe	86

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\update.exe
  "C:\Users\Admin\AppData\Local\Temp\update.exe" --foodsum
  2⤵
  - Drops file in Drivers directory
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui.abc

Filesize
3KB

MD5
ac7898f40cefd0d9e031244ca053ed25

SHA1
3951e75fefcfdd21358e2ec5b2160a98b6440092

SHA256
b94da01eaf8b09ffc3ef1740b9a2db6516285e5e638f4c0614214cd2657e3dcf

SHA512
7353c9da8c5546a6585a7d8f1d10491226ada5c39e7a9d2bcfa2f379240a7a1c68fac2798ffbae048914e8719426959cfcdd333ddfad3194ddf639c72a9d4ef5

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\mpvis.dll.mui.abc

Filesize
3KB

MD5
8c207eb2d09a5b8c5d94111d8500cc2b

SHA1
8585d24b4bc1af858f5c0ce37219647ca65e9634

SHA256
3f054eb418dbc69f3ec8196f15f171471260d6b171eba71762584c1e9e46a33d

SHA512
df8d13ffbe3fe03c90ae945079fb5f9eb0dbe7a3c5037f80420759172b26033dbf64c007ec27f02149f9de81cc2008f825fda781f61b07cec2354588ca3de8f2

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui.abc

Filesize
18KB

MD5
d72e2621186d570c9b6fd74e139e7fb8

SHA1
bf22a1790a11f0f598a3f7c88dfe528a00e242d0

SHA256
eed0be81a7b69a3d77fbf5c95053c44c8a9203626a34a9e715d72ac40c6138ad

SHA512
6b308ee1aad692ba32a0d0c2a29a01fc0a0512841b0b51e03648175ab8ff286d38595bd9118b2e814e6a12b9442a46ca3487fb8ff74fb68683072fd68ab39e0f

Download Submit
C:\Users\Admin\Documents\CompleteConnect.mht.abc

Filesize
569KB

MD5
f3cfdef316eab81ceb02522bd0c8ee2c

SHA1
0a18bcd2c18672d3497b2910cf3ab738e518bd7d

SHA256
a8139162dcdd587420feee75fc9cbfe272fe9609355652191ac0e20ede073fb8

SHA512
20b104ae9702857212acc3defc36f5c1220d6bbd2d81e6e6badd941feb62ddb620321aeecf686fe03267e1574c2f837a223ad26e091e663963cdb985f10ce595

Download Submit
C:\Users\Admin\Documents\README.txt

Filesize
111B

MD5
ed96f73c7232b4e6bc6b8e54993d1d7b

SHA1
4a517548e17356dfba09be166daf34ff91f69387

SHA256
e5d27c881c0308284da6b846e90625da4b959fcf8600e9dd015fac46177d63ef

SHA512
540243245e4eca9b30f32b61eff6098ece0246c7a25ee61ffebdf398436c8b9c9f24f552dad3e14d61601828780001340c3b628c1a2c43cab68f4e8688920f1b

Download Submit
C:\Windows\Cursors\no_m.cur.abc

Filesize
8KB

MD5
e19473270a51a8709647858b5254d847

SHA1
21f8c07b1b358e81a9525f43f6709f04611f8ce4

SHA256
4d97b1ccd5f45ff602b7299ac435bff5d3ab681b5d16995f305eabdfa13e346a

SHA512
33ab97b243524cbd0e252922a121b5835643472075783904e6594316eab3149a53b9f915dd4bd42e44749f336b7e05e5ed794037318d9f3e73be615f183adb56

Download Submit
C:\Windows\SysWOW64\bg-BG\windows.ui.xaml.dll.mui.abc

Filesize
18KB

MD5
86dd1f690cffd98b4622159daf5bf255

SHA1
abdc8b61658dd9b2c71bf824b8b5a53e66f758a5

SHA256
89321e99d05d710dc1082602f928550547ff9f8c7a05e5ff925b0eb5ba6f3285

SHA512
f25d1224ebafe764acc4c9087d48ba356a029bc690f201bcea06d99271a3ac86342eca8e70944a87dfa3c7acc80b1e715fff23fe8978ce05b6c045f773b01c55

Download Submit
C:\Windows\SysWOW64\de-DE\cic.dll.mui.abc

Filesize
2KB

MD5
5d4b93a97d2266bb66b6f273b09c0428

SHA1
a5785b48941b315879b241d543d41aed1a82360b

SHA256
b15d6a5f09663c881461e91a125953a87858afe14985c43678fc895ad6170c08

SHA512
2475b10fc6f31d074d19b61ff409cfec88b52e2bd84f9b2eaf3b3a4cf4d5d28bbd4ab5519b9a4fd2c870e5a03cf3721ba1569efbcf5d2b6fbfb4b5bf7931bb2a

Download Submit
C:\Windows\SysWOW64\en-US\user32.dll.mui.abc

Filesize
17KB

MD5
84452717431b6037b13f0d3ae1d42923

SHA1
a76416201fcf94e8bd6d3ec800d4ed199c863607

SHA256
a89d0ad1e45ae818d103a198d7f2733a6cf2cb1d1ce456fafd190fe7a7553886

SHA512
655740066b86f4bf1a90332d73b8d89b2b232ba297100734c026fc6e126c958cdd1b21cbe1c9ab60be869b8fedd34f3a11b03e7ea899e7f6947aff9bdaa74d3c

Download Submit
C:\Windows\SysWOW64\es-ES\audiodev.dll.mui.abc

Filesize
15KB

MD5
be56e6d7c99578d8bb282ce944e84886

SHA1
145f0780b0ebfb21af1e5a65a3b7a6aa92238fe8

SHA256
cb7e0ec5e43cdd707e8cbb3591cd96615230b7348f1bc74245530739ab28df91

SHA512
5af3e589db3aa566cded50dae29538e97c4afa29009ba61becd1f32f6c6c88b5dc06a2ccf96e7e4062176e09dd3313336ea7128c1a634124e7cf12fa60311971

Download Submit
C:\Windows\SysWOW64\ja-JP\BWContextHandler.dll.mui.abc

Filesize
4KB

MD5
8bb655bc460ab2e1437afa3002a14bde

SHA1
b7f4a763ace78ad9de278721def9edda14a2e171

SHA256
0c7c235ea0b911da2794bcccb1b199a31bc432bde4b6259f662102812bbce8b1

SHA512
5919289c028d8c0595698d6463ea7aa0a396814d94a87f727fdffbb8d0a4646fbca350a04eea3f98644de4bfbf3aeeb4c3a8ad549f48cb7088db16cee7892da9

Download Submit
C:\Windows\SysWOW64\msasn1.dll.abc

Filesize
49KB

MD5
05a60d9412a6b2e2f5b0d4c2f27464b6

SHA1
b18de5aeda915cb211b0e5bc0f06018ad1e6ad1a

SHA256
55c17e17fd6a6da34f0e9fd2ead8613bbe2ec942f2e405d21fe63e2b6410861c

SHA512
df1317c9d8dd6c1cb9f93d028a3371b3237b628332e4980e8f01563206c8763c28ce668d5c361515316c8e928dd62d6a3caf5f88bcc54cb215f2a64dd5b78344

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads