4454d5fc11bafd948976ffe7232f0bd34e84e8ab4d8991abea1073c22478b33c

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QuickUpgrade.exe
Size

470KB
MD5

06c4fe95b2ac2a6b334dbbd795fcee23
SHA1

5a58f4866fd38dacf198943883cf894d079fd7eb
SHA256

322410618f06240a9a7f6e853385fbb4ab6dd191f40a79c10ab059d369e3a625
SHA512

0d1d5e534061a94ef7d0a275908f4fdf41c231e835673a07d9fd4a355f155348c02f7f7a39c5b7752f1e07d473e40a9d207043ca615e4cb3ae56fc0460a10e8f
SSDEEP

3072:8MlF9kZSKyI9m1+rxy9dTDs/ZR1ctUA/86KF7HEG+qMQOrUsLVtPk7HoZ7WK7TBR:8MlsT9u+ty9xElcyWK+OKfLP7WG4

Score

6^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	QuickUpgrade.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	pl4sfx.exe

Executes dropped EXE 4 IoCs

pid	Process
3108	pl4sfx.exe
2248	PostUpdate.exe
2080	bitsumsessionagent.exe
2124	processlasso.exe

Loads dropped DLL 6 IoCs

pid	Process
3020	QuickUpgrade.exe
3020	QuickUpgrade.exe
2248	PostUpdate.exe
2248	PostUpdate.exe
2124	processlasso.exe
2124	processlasso.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pl4sfx.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PostUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PostUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processlasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processlasso.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2080	bitsumsessionagent.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2124	processlasso.exe
Token: SeDebugPrivilege	2124	processlasso.exe
Token: SeChangeNotifyPrivilege	2124	processlasso.exe
Token: SeIncBasePriorityPrivilege	2124	processlasso.exe
Token: SeIncreaseQuotaPrivilege	2124	processlasso.exe
Token: SeCreateGlobalPrivilege	2124	processlasso.exe
Token: SeProfSingleProcessPrivilege	2124	processlasso.exe
Token: SeBackupPrivilege	2124	processlasso.exe
Token: SeRestorePrivilege	2124	processlasso.exe
Token: SeShutdownPrivilege	2124	processlasso.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3108	3020	QuickUpgrade.exe	85
PID 3020 wrote to memory of 3108	3020	QuickUpgrade.exe	85
PID 3020 wrote to memory of 3108	3020	QuickUpgrade.exe	85
PID 3108 wrote to memory of 2248	3108	pl4sfx.exe	87
PID 3108 wrote to memory of 2248	3108	pl4sfx.exe	87
PID 2248 wrote to memory of 2124	2248	PostUpdate.exe	90
PID 2248 wrote to memory of 2124	2248	PostUpdate.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\QuickUpgrade.exe
"C:\Users\Admin\AppData\Local\Temp\QuickUpgrade.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Users\Admin\AppData\Local\Temp\PostUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\PostUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\processlasso.exe
      /postupdate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:2124

C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe
C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe ----------------------------------------------------------------
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PostUpdate.exe

Filesize
671KB

MD5
c718173b986d22f20375264a6ff8db2e

SHA1
6e25917fa5b41bdf458e308ca56b4e28c3ccf4d0

SHA256
a522ce2c6f9b773ec166e9a8dc837eafac1fcc92ded372d88eb70672af2f2bd5

SHA512
a29ce1b593f777dbe908e221ab0223889083b1cb0867f327a99671c5e42a9bb0837ca8d1cc155cfb2c10c4e237260ba7b1ed31b3ef2f0e8a9bfe04ed20574bc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe

Filesize
1.8MB

MD5
a555448319d6288393a890aa21b96ebc

SHA1
aea2e5ec00ab28e8a79bae1987412821fff344b1

SHA256
f35aafd8036c5256208fb2ea14a49ea81e90c616488f7e0520d3c1c0c2d21295

SHA512
f17d69ce1576062bbaf230c385a0a91308c14c9078550efee14c0b1eda37fd4f93aa0fe07cbe0993f399873ac440dd9b3cc1a37ec388cef38c32e60524c9906e

Download Submit
C:\Users\Admin\AppData\Local\Temp\QuickUpgrade.exe.Replacement

Filesize
471KB

MD5
91737cb259a911c4d3ebe86a80394a5a

SHA1
9ee7e343fc820f6490079df703c58b0057f2a3fe

SHA256
b11ea3ccf82d23d243d582a6f9543e6030dffe2fb251c4bbf32592ca104a4ad6

SHA512
a206468cb89f8fece354043dbc41f8165020af9b1500a88c6113215bbad3da8c8a3f4b91422d55daeceef85987827345f9be0325e4b9501e20ec673e9359168e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe

Filesize
2.9MB

MD5
cb28b620348ca4d4820fa04e887ad29b

SHA1
695d150253f733e40a8026d75d1595015b8e9dea

SHA256
19c0884a408640c004b19f731182c41988771eeaa993a99756a8345b304c4c17

SHA512
feba492c07ba74fff6a851cc3a3a1d919507118124aa19b54cec27fa27d73d03d5a4305bc3615ae1e011b24abed84fa07800e9c2f8293e7e7395fcbfef089bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe

Filesize
177KB

MD5
6d53279214e6376453e52b2b47832053

SHA1
9682159603dc9989707197fa2a7c1a4173b22fdc

SHA256
f065abf599ba12d271fb59801624187b0044324dd8c06e9fba47a749829f47e5

SHA512
6ff0f79976760211df6f0f34a00692105c952e65b19fb7668a30a0466de1b5c1490129eed7c96f32b4d5c297630c49d163a7f2ba35ddf90ae16d284105011914

Download Submit
C:\Users\Admin\AppData\Local\Temp\pl_rsrc_english.dll

Filesize
1.9MB

MD5
83b9b6fb187dd48de9026d9cd6aa5237

SHA1
620fd74c83a7e0431827a38f3dd721a978721c3a

SHA256
4ae449321a4c39be7188e2396cc84fd4f7d5dbd3d8ebf106d2946b255731e0c7

SHA512
246410a10304505eab65f2813f7122731c0987ce2c9faeaa854f211e87e396c451d419185bea2ba006fcd1f870ae49d17565aba28363b2ae8004bf46a690ef54

Download Submit
C:\Users\Admin\AppData\Local\Temp\pl_rsrc_temp.dll

Filesize
1.9MB

MD5
998bdc4750f4717bfa380483d8fc40d3

SHA1
a76eb51d66ce876b73b9def4e9b2cf2962be8989

SHA256
0f77e042e7c6c475b1585113ccb9b7af66e6e998b8c946dcc1448e3f62a9475b

SHA512
c3f3f518a7aeb45ee91500bc668c20b8f76b313d98b052b6046fcac24bb70f59e1918188cc1178ed4b307d13aa9743f7632a008941e42d01f3f1a79569d7ff32

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads