4d1ef9fd9979a62482d47fba038dc1069919eb266efe97d0d6b7e044be5a3ad7

General

Target

37448b9ab4397450a0d86c85139121b0N.exe
Size

135KB
MD5

37448b9ab4397450a0d86c85139121b0
SHA1

5110b5806c6326b6285fc26fe5386066fbe7cd5c
SHA256

4d1ef9fd9979a62482d47fba038dc1069919eb266efe97d0d6b7e044be5a3ad7
SHA512

00848ed7a5847196a7e9c10d3a003c05968ec744c74ebf2daa9b0518b597a2ce0446f9f7cb0244b3b3f29668d2cabfb2947b69692ec65170e68c5f8a8589e93e
SSDEEP

1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOK:YfU/WF6QMauSuiWNi9eNOl0007NZIOK

Score

7^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2676	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2996	wuauclt.exe

Loads dropped DLL 1 IoCs

pid	Process
1772	37448b9ab4397450a0d86c85139121b0N.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000018671-2.dat	upx
behavioral1/memory/1772-4-0x0000000000DF0000-0x0000000000E18000-memory.dmp	upx
behavioral1/memory/1772-0-0x00000000010D0000-0x00000000010F8000-memory.dmp	upx
behavioral1/memory/1772-7-0x00000000010D0000-0x00000000010F8000-memory.dmp	upx
behavioral1/memory/2996-8-0x0000000000DF0000-0x0000000000E18000-memory.dmp	upx
behavioral1/memory/1772-9-0x00000000010D0000-0x00000000010F8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run"	37448b9ab4397450a0d86c85139121b0N.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37448b9ab4397450a0d86c85139121b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuauclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2996	1772	37448b9ab4397450a0d86c85139121b0N.exe	30
PID 1772 wrote to memory of 2996	1772	37448b9ab4397450a0d86c85139121b0N.exe	30
PID 1772 wrote to memory of 2996	1772	37448b9ab4397450a0d86c85139121b0N.exe	30
PID 1772 wrote to memory of 2996	1772	37448b9ab4397450a0d86c85139121b0N.exe	30
PID 1772 wrote to memory of 2676	1772	37448b9ab4397450a0d86c85139121b0N.exe	32
PID 1772 wrote to memory of 2676	1772	37448b9ab4397450a0d86c85139121b0N.exe	32
PID 1772 wrote to memory of 2676	1772	37448b9ab4397450a0d86c85139121b0N.exe	32
PID 1772 wrote to memory of 2676	1772	37448b9ab4397450a0d86c85139121b0N.exe	32

C:\Users\Admin\AppData\Local\Temp\37448b9ab4397450a0d86c85139121b0N.exe
"C:\Users\Admin\AppData\Local\Temp\37448b9ab4397450a0d86c85139121b0N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1772
- C:\ProgramData\Update\wuauclt.exe
  "C:\ProgramData\Update\wuauclt.exe" /run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2996
- C:\windows\SysWOW64\cmd.exe
  "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\37448b9ab4397450a0d86c85139121b0N.exe" >> NUL
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\wuauclt.exe

Filesize
135KB

MD5
8ba481d57a26cf68add20d77990c35b9

SHA1
9b2fd98dd5bb264fd46bdb87f5fa1e0e2b62e0aa

SHA256
724b3cdaf689589cc09c82b03270bab5060d4bb86a0ca430ec7c132160db4c05

SHA512
8051ca2edc933f584cfa0bfdf077aa9d5002c9bb506d05c7e9d12b44cb6a409f29f13a46146bdf59ec548ce5ff3b8fedd94f2e2c2a54fe6165ea477e08d34f1d

Download Submit
memory/1772-4-0x0000000000DF0000-0x0000000000E18000-memory.dmp

Filesize
160KB

Download
memory/1772-0-0x00000000010D0000-0x00000000010F8000-memory.dmp

Filesize
160KB

Download
memory/1772-7-0x00000000010D0000-0x00000000010F8000-memory.dmp

Filesize
160KB

Download
memory/1772-9-0x00000000010D0000-0x00000000010F8000-memory.dmp

Filesize
160KB

Download
memory/1772-10-0x0000000000DF0000-0x0000000000E18000-memory.dmp

Filesize
160KB

Download
memory/2996-8-0x0000000000DF0000-0x0000000000E18000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads