efd131b8a6f9f5f4f26f46772df589778295452c23074079077bd7df77f74924

Analysis

max time kernel
117s
max time network
19s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59386e7fe3940a5972e2b9608fe8b950N.exe
Size

1.5MB
MD5

59386e7fe3940a5972e2b9608fe8b950
SHA1

37626270e2bdec961894f74dd985d8db6f91217e
SHA256

efd131b8a6f9f5f4f26f46772df589778295452c23074079077bd7df77f74924
SHA512

a6bb0fa4d18a44a482f413846b5f9ebcf9a7e233038d0be59252c4e86e48ed154ed061601d99b3f0e7349d19eb8ac950b47365f2e7810e4c9ad068721ce096a2
SSDEEP

12288:wHZVm/7ePnv+TWM+6+xTGzgFA+u/x8acJdPACFFbLFi8cj5UQbM72voQ:2v+NWu/adRYj5UQOy

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
1868	winupdt.exe
3028	winupdt.exe

Loads dropped DLL 6 IoCs

pid	Process
2756	59386e7fe3940a5972e2b9608fe8b950N.exe
2756	59386e7fe3940a5972e2b9608fe8b950N.exe
2756	59386e7fe3940a5972e2b9608fe8b950N.exe
2756	59386e7fe3940a5972e2b9608fe8b950N.exe
2756	59386e7fe3940a5972e2b9608fe8b950N.exe
1868	winupdt.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3028-48-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/3028-54-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/3028-51-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/3028-59-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/3028-61-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/3028-63-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/3028-64-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/3028-65-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/3028-67-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/3028-69-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\Window Updates = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 3028	1868	winupdt.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59386e7fe3940a5972e2b9608fe8b950N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdt.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1384	reg.exe
1360	reg.exe
1320	reg.exe
2868	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	3028	winupdt.exe
Token: SeCreateTokenPrivilege	3028	winupdt.exe
Token: SeAssignPrimaryTokenPrivilege	3028	winupdt.exe
Token: SeLockMemoryPrivilege	3028	winupdt.exe
Token: SeIncreaseQuotaPrivilege	3028	winupdt.exe
Token: SeMachineAccountPrivilege	3028	winupdt.exe
Token: SeTcbPrivilege	3028	winupdt.exe
Token: SeSecurityPrivilege	3028	winupdt.exe
Token: SeTakeOwnershipPrivilege	3028	winupdt.exe
Token: SeLoadDriverPrivilege	3028	winupdt.exe
Token: SeSystemProfilePrivilege	3028	winupdt.exe
Token: SeSystemtimePrivilege	3028	winupdt.exe
Token: SeProfSingleProcessPrivilege	3028	winupdt.exe
Token: SeIncBasePriorityPrivilege	3028	winupdt.exe
Token: SeCreatePagefilePrivilege	3028	winupdt.exe
Token: SeCreatePermanentPrivilege	3028	winupdt.exe
Token: SeBackupPrivilege	3028	winupdt.exe
Token: SeRestorePrivilege	3028	winupdt.exe
Token: SeShutdownPrivilege	3028	winupdt.exe
Token: SeDebugPrivilege	3028	winupdt.exe
Token: SeAuditPrivilege	3028	winupdt.exe
Token: SeSystemEnvironmentPrivilege	3028	winupdt.exe
Token: SeChangeNotifyPrivilege	3028	winupdt.exe
Token: SeRemoteShutdownPrivilege	3028	winupdt.exe
Token: SeUndockPrivilege	3028	winupdt.exe
Token: SeSyncAgentPrivilege	3028	winupdt.exe
Token: SeEnableDelegationPrivilege	3028	winupdt.exe
Token: SeManageVolumePrivilege	3028	winupdt.exe
Token: SeImpersonatePrivilege	3028	winupdt.exe
Token: SeCreateGlobalPrivilege	3028	winupdt.exe
Token: 31	3028	winupdt.exe
Token: 32	3028	winupdt.exe
Token: 33	3028	winupdt.exe
Token: 34	3028	winupdt.exe
Token: 35	3028	winupdt.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2756	59386e7fe3940a5972e2b9608fe8b950N.exe
1868	winupdt.exe
3028	winupdt.exe
3028	winupdt.exe
3028	winupdt.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2736	2756	59386e7fe3940a5972e2b9608fe8b950N.exe	30
PID 2756 wrote to memory of 2736	2756	59386e7fe3940a5972e2b9608fe8b950N.exe	30
PID 2756 wrote to memory of 2736	2756	59386e7fe3940a5972e2b9608fe8b950N.exe	30
PID 2756 wrote to memory of 2736	2756	59386e7fe3940a5972e2b9608fe8b950N.exe	30
PID 2736 wrote to memory of 1500	2736	cmd.exe	32
PID 2736 wrote to memory of 1500	2736	cmd.exe	32
PID 2736 wrote to memory of 1500	2736	cmd.exe	32
PID 2736 wrote to memory of 1500	2736	cmd.exe	32
PID 2756 wrote to memory of 1868	2756	59386e7fe3940a5972e2b9608fe8b950N.exe	33
PID 2756 wrote to memory of 1868	2756	59386e7fe3940a5972e2b9608fe8b950N.exe	33
PID 2756 wrote to memory of 1868	2756	59386e7fe3940a5972e2b9608fe8b950N.exe	33
PID 2756 wrote to memory of 1868	2756	59386e7fe3940a5972e2b9608fe8b950N.exe	33
PID 1868 wrote to memory of 3028	1868	winupdt.exe	34
PID 1868 wrote to memory of 3028	1868	winupdt.exe	34
PID 1868 wrote to memory of 3028	1868	winupdt.exe	34
PID 1868 wrote to memory of 3028	1868	winupdt.exe	34
PID 1868 wrote to memory of 3028	1868	winupdt.exe	34
PID 1868 wrote to memory of 3028	1868	winupdt.exe	34
PID 1868 wrote to memory of 3028	1868	winupdt.exe	34
PID 1868 wrote to memory of 3028	1868	winupdt.exe	34
PID 1868 wrote to memory of 3028	1868	winupdt.exe	34
PID 3028 wrote to memory of 1340	3028	winupdt.exe	35
PID 3028 wrote to memory of 1340	3028	winupdt.exe	35
PID 3028 wrote to memory of 1340	3028	winupdt.exe	35
PID 3028 wrote to memory of 1340	3028	winupdt.exe	35
PID 3028 wrote to memory of 1796	3028	winupdt.exe	36
PID 3028 wrote to memory of 1796	3028	winupdt.exe	36
PID 3028 wrote to memory of 1796	3028	winupdt.exe	36
PID 3028 wrote to memory of 1796	3028	winupdt.exe	36
PID 3028 wrote to memory of 2320	3028	winupdt.exe	38
PID 3028 wrote to memory of 2320	3028	winupdt.exe	38
PID 3028 wrote to memory of 2320	3028	winupdt.exe	38
PID 3028 wrote to memory of 2320	3028	winupdt.exe	38
PID 3028 wrote to memory of 2120	3028	winupdt.exe	40
PID 3028 wrote to memory of 2120	3028	winupdt.exe	40
PID 3028 wrote to memory of 2120	3028	winupdt.exe	40
PID 3028 wrote to memory of 2120	3028	winupdt.exe	40
PID 1796 wrote to memory of 1384	1796	cmd.exe	43
PID 1796 wrote to memory of 1384	1796	cmd.exe	43
PID 1796 wrote to memory of 1384	1796	cmd.exe	43
PID 1796 wrote to memory of 1384	1796	cmd.exe	43
PID 1340 wrote to memory of 2868	1340	cmd.exe	44
PID 1340 wrote to memory of 2868	1340	cmd.exe	44
PID 1340 wrote to memory of 2868	1340	cmd.exe	44
PID 1340 wrote to memory of 2868	1340	cmd.exe	44
PID 2120 wrote to memory of 1320	2120	cmd.exe	45
PID 2120 wrote to memory of 1320	2120	cmd.exe	45
PID 2120 wrote to memory of 1320	2120	cmd.exe	45
PID 2120 wrote to memory of 1320	2120	cmd.exe	45
PID 2320 wrote to memory of 1360	2320	cmd.exe	46
PID 2320 wrote to memory of 1360	2320	cmd.exe	46
PID 2320 wrote to memory of 1360	2320	cmd.exe	46
PID 2320 wrote to memory of 1360	2320	cmd.exe	46

C:\Users\Admin\AppData\Local\Temp\59386e7fe3940a5972e2b9608fe8b950N.exe
"C:\Users\Admin\AppData\Local\Temp\59386e7fe3940a5972e2b9608fe8b950N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\lfHWd.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Window Updates" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1500
- C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
  "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
    "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1340
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2868
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1384
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1360
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lfHWd.bat

Filesize
158B

MD5
1954c7e666c5b4d1117ef07bc0c9b8ec

SHA1
559e3c0273c1463e9184027b749bdaad0a372681

SHA256
35e0dbc8b455ca38976157ce9d0293fd6cdca20f46f1cb69058a1e0f0af6f693

SHA512
3939de8d0ab7e67b59ff8bebed5580dafd38d8785193fd42a289728500761a68b9e6660605e19e10d4278dd106fea4b273a208f25485e7389c8f19b2958c926a

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe

Filesize
1.5MB

MD5
58823079ab019bd084e6b2ce2d55b82c

SHA1
06d404fd46eda1c638cb0a9649a209b2b208b66b

SHA256
41a10892deed2176dae64e0ffc4661ccf0d22dbb446282442bb77954da98b19f

SHA512
295d34d40ea064588eb3371be92b52a5cd91e56dcfe07baa1cf0a648fede9f3a1e1be5dad78c89bae0f4439f6b857601bc9b3a3fb92fd8aaae2cf12481d90c20

Download Submit
memory/2756-0-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download
memory/3028-59-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3028-54-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3028-51-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3028-48-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3028-61-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3028-63-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3028-64-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3028-65-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3028-67-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3028-69-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads