13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe
Size

1.7MB
MD5

ef120979c171eba0bedab797ab827380
SHA1

84e2cebef703f1235cf88d5b0d7aef5c3dc1f513
SHA256

13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76
SHA512

cf1028ba928586c3f3ea0ec374c0bbaf9a318ab09a94e15d2144360ae3566c170e16ecb4ea30015639a12e4db0d8383e9aaf7db3973672c335e4ddc78dded702
SSDEEP

12288:DZISeMFVhdL1XBvXxzGNABnwHdxkn7L1GzR1FYoxkM2N4JHUcTwoSB:VIW0rXi1GzRQo08i

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
2572	winupdt.exe
2844	winupdt.exe
1204	winupdt.exe

Loads dropped DLL 7 IoCs

pid	Process
2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe
2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe
2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe
2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe
2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe
2572	winupdt.exe
2572	winupdt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Window Updates = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2572 set thread context of 2844	2572	winupdt.exe	34
PID 2572 set thread context of 1204	2572	winupdt.exe	35

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-0-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral1/files/0x00080000000161fb-27.dat	upx
behavioral1/memory/2368-43-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral1/memory/2844-50-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2572-49-0x00000000029C0000-0x0000000002B73000-memory.dmp	upx
behavioral1/memory/2572-48-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral1/memory/1204-56-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2572-58-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral1/memory/1204-63-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1204-70-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2844-69-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1204-62-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2844-55-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2844-54-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2844-72-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2844-75-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2844-77-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2844-80-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2844-82-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2844-84-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2844-89-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2844-94-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2880	reg.exe
976	reg.exe
1648	reg.exe
1960	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	winupdt.exe
Token: 1	2844	winupdt.exe
Token: SeCreateTokenPrivilege	2844	winupdt.exe
Token: SeAssignPrimaryTokenPrivilege	2844	winupdt.exe
Token: SeLockMemoryPrivilege	2844	winupdt.exe
Token: SeIncreaseQuotaPrivilege	2844	winupdt.exe
Token: SeMachineAccountPrivilege	2844	winupdt.exe
Token: SeTcbPrivilege	2844	winupdt.exe
Token: SeSecurityPrivilege	2844	winupdt.exe
Token: SeTakeOwnershipPrivilege	2844	winupdt.exe
Token: SeLoadDriverPrivilege	2844	winupdt.exe
Token: SeSystemProfilePrivilege	2844	winupdt.exe
Token: SeSystemtimePrivilege	2844	winupdt.exe
Token: SeProfSingleProcessPrivilege	2844	winupdt.exe
Token: SeIncBasePriorityPrivilege	2844	winupdt.exe
Token: SeCreatePagefilePrivilege	2844	winupdt.exe
Token: SeCreatePermanentPrivilege	2844	winupdt.exe
Token: SeBackupPrivilege	2844	winupdt.exe
Token: SeRestorePrivilege	2844	winupdt.exe
Token: SeShutdownPrivilege	2844	winupdt.exe
Token: SeDebugPrivilege	2844	winupdt.exe
Token: SeAuditPrivilege	2844	winupdt.exe
Token: SeSystemEnvironmentPrivilege	2844	winupdt.exe
Token: SeChangeNotifyPrivilege	2844	winupdt.exe
Token: SeRemoteShutdownPrivilege	2844	winupdt.exe
Token: SeUndockPrivilege	2844	winupdt.exe
Token: SeSyncAgentPrivilege	2844	winupdt.exe
Token: SeEnableDelegationPrivilege	2844	winupdt.exe
Token: SeManageVolumePrivilege	2844	winupdt.exe
Token: SeImpersonatePrivilege	2844	winupdt.exe
Token: SeCreateGlobalPrivilege	2844	winupdt.exe
Token: 31	2844	winupdt.exe
Token: 32	2844	winupdt.exe
Token: 33	2844	winupdt.exe
Token: 34	2844	winupdt.exe
Token: 35	2844	winupdt.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe
2572	winupdt.exe
2844	winupdt.exe
1204	winupdt.exe
2844	winupdt.exe
2844	winupdt.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2532	2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe	30
PID 2368 wrote to memory of 2532	2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe	30
PID 2368 wrote to memory of 2532	2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe	30
PID 2368 wrote to memory of 2532	2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe	30
PID 2532 wrote to memory of 2096	2532	cmd.exe	32
PID 2532 wrote to memory of 2096	2532	cmd.exe	32
PID 2532 wrote to memory of 2096	2532	cmd.exe	32
PID 2532 wrote to memory of 2096	2532	cmd.exe	32
PID 2368 wrote to memory of 2572	2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe	33
PID 2368 wrote to memory of 2572	2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe	33
PID 2368 wrote to memory of 2572	2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe	33
PID 2368 wrote to memory of 2572	2368	13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe	33
PID 2572 wrote to memory of 2844	2572	winupdt.exe	34
PID 2572 wrote to memory of 2844	2572	winupdt.exe	34
PID 2572 wrote to memory of 2844	2572	winupdt.exe	34
PID 2572 wrote to memory of 2844	2572	winupdt.exe	34
PID 2572 wrote to memory of 2844	2572	winupdt.exe	34
PID 2572 wrote to memory of 2844	2572	winupdt.exe	34
PID 2572 wrote to memory of 2844	2572	winupdt.exe	34
PID 2572 wrote to memory of 2844	2572	winupdt.exe	34
PID 2572 wrote to memory of 2844	2572	winupdt.exe	34
PID 2572 wrote to memory of 1204	2572	winupdt.exe	35
PID 2572 wrote to memory of 1204	2572	winupdt.exe	35
PID 2572 wrote to memory of 1204	2572	winupdt.exe	35
PID 2572 wrote to memory of 1204	2572	winupdt.exe	35
PID 2572 wrote to memory of 1204	2572	winupdt.exe	35
PID 2572 wrote to memory of 1204	2572	winupdt.exe	35
PID 2572 wrote to memory of 1204	2572	winupdt.exe	35
PID 2572 wrote to memory of 1204	2572	winupdt.exe	35
PID 2572 wrote to memory of 1204	2572	winupdt.exe	35
PID 2844 wrote to memory of 2920	2844	winupdt.exe	36
PID 2844 wrote to memory of 2920	2844	winupdt.exe	36
PID 2844 wrote to memory of 2920	2844	winupdt.exe	36
PID 2844 wrote to memory of 2920	2844	winupdt.exe	36
PID 2844 wrote to memory of 2624	2844	winupdt.exe	37
PID 2844 wrote to memory of 2624	2844	winupdt.exe	37
PID 2844 wrote to memory of 2624	2844	winupdt.exe	37
PID 2844 wrote to memory of 2624	2844	winupdt.exe	37
PID 2844 wrote to memory of 2900	2844	winupdt.exe	38
PID 2844 wrote to memory of 2900	2844	winupdt.exe	38
PID 2844 wrote to memory of 2900	2844	winupdt.exe	38
PID 2844 wrote to memory of 2900	2844	winupdt.exe	38
PID 2844 wrote to memory of 2648	2844	winupdt.exe	40
PID 2844 wrote to memory of 2648	2844	winupdt.exe	40
PID 2844 wrote to memory of 2648	2844	winupdt.exe	40
PID 2844 wrote to memory of 2648	2844	winupdt.exe	40
PID 2624 wrote to memory of 1960	2624	cmd.exe	44
PID 2624 wrote to memory of 1960	2624	cmd.exe	44
PID 2624 wrote to memory of 1960	2624	cmd.exe	44
PID 2624 wrote to memory of 1960	2624	cmd.exe	44
PID 2920 wrote to memory of 1648	2920	cmd.exe	45
PID 2920 wrote to memory of 1648	2920	cmd.exe	45
PID 2920 wrote to memory of 1648	2920	cmd.exe	45
PID 2920 wrote to memory of 1648	2920	cmd.exe	45
PID 2648 wrote to memory of 976	2648	cmd.exe	46
PID 2648 wrote to memory of 976	2648	cmd.exe	46
PID 2648 wrote to memory of 976	2648	cmd.exe	46
PID 2648 wrote to memory of 976	2648	cmd.exe	46
PID 2900 wrote to memory of 2880	2900	cmd.exe	47
PID 2900 wrote to memory of 2880	2900	cmd.exe	47
PID 2900 wrote to memory of 2880	2900	cmd.exe	47
PID 2900 wrote to memory of 2880	2900	cmd.exe	47

C:\Users\Admin\AppData\Local\Temp\13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe
"C:\Users\Admin\AppData\Local\Temp\13398c378fe9ec371e7e08f8b2372412e3900b54ce3d2361564c8bb6154a2a76N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FUaDT.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Window Updates" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2096
- C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
  "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
    "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1648
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1960
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:976
- - C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
    "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FUaDT.bat

Filesize
158B

MD5
1954c7e666c5b4d1117ef07bc0c9b8ec

SHA1
559e3c0273c1463e9184027b749bdaad0a372681

SHA256
35e0dbc8b455ca38976157ce9d0293fd6cdca20f46f1cb69058a1e0f0af6f693

SHA512
3939de8d0ab7e67b59ff8bebed5580dafd38d8785193fd42a289728500761a68b9e6660605e19e10d4278dd106fea4b273a208f25485e7389c8f19b2958c926a

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe

Filesize
1.7MB

MD5
4cf438efd1cdeaf6c3a66cff25cb9fab

SHA1
9afdde4d66255934d40123f50ff977a22cbf5a8d

SHA256
223461ba89893e1ac225189d033bc0359a5d55234d042a030c5b7e692fb60160

SHA512
6cc0a6017c355147bbb0c71825704940d08534fbfc2c23b33ef7e18d33509cfe4b902bc8f60ca3477bf02df97fcca4a6a1eb8092357876d6d2d074dcd05d5648

Download Submit
memory/1204-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1204-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1204-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1204-70-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2368-43-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2368-71-0x00000000037B0000-0x0000000003963000-memory.dmp

Filesize
1.7MB

Download
memory/2368-0-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2572-48-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2572-49-0x00000000029C0000-0x0000000002B73000-memory.dmp

Filesize
1.7MB

Download
memory/2572-58-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2844-72-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-55-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-54-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-50-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-69-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-75-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-77-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-80-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-82-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-84-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-89-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2844-94-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads