Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2024 01:12

General

  • Target

    3088b0302d4b38c63ef4fead57aa6049da2cc62bf9f4a5d9331552c84fe516e6.exe

  • Size

    26KB

  • MD5

    0e926b28fc49f6259a70c032ae83cd14

  • SHA1

    abb5856b3853cfe4ecc5e25ff1a7aa605afac007

  • SHA256

    3088b0302d4b38c63ef4fead57aa6049da2cc62bf9f4a5d9331552c84fe516e6

  • SHA512

    1f4306c38e6604f3945a4d1215576ee81514c34757318035d9220fb81da5bb4f39d23b8a22f404902fe3e67f0326a1f9ff45dc6ce8d3a41a69aab54de488fb77

  • SSDEEP

    384:BvV0KF7OERZOTPx3hd/N7az/bCKQIRB1F7M9ekamfrqEjDEFCFUa0gW71JBr:B9LZOTPxNG5z7uTqVCFUa0gWR

Malware Config

Signatures

  • Drops startup file 64 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3088b0302d4b38c63ef4fead57aa6049da2cc62bf9f4a5d9331552c84fe516e6.exe
    "C:\Users\Admin\AppData\Local\Temp\3088b0302d4b38c63ef4fead57aa6049da2cc62bf9f4a5d9331552c84fe516e6.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\UUSIService.exe
      "C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\UUSIService.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\EdgeUpdaters.exe
        "C:\Users\Admin\AppData\Local\Temp\EdgeUpdater\EdgeUpdaters.exe" --checker
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UUSIService_4f1168100d5c4387b9cee976ac9bc369.lnk

    Filesize

    1KB

    MD5

    496fee9ff7427a53d4e93df4810dbb48

    SHA1

    18a38195ca3852a3edc7dd18ff4cb6a4bcdef91e

    SHA256

    cc91bd2a42e9a7216efce00045be73adea0955ffd6a8736d4230aff4378ea45a

    SHA512

    84414cfef6aa642ae39276e2a95859a2a5966bd8f4c01edac6618a1d2e4e304c2f17d4564e7a3b0b484896ba17f0d5a28a66307247c48741eb7aa8066d74109d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UUSIService_6c1e7d97fa454438a946ae5009a46183.lnk

    Filesize

    1KB

    MD5

    6cc955766f75b3efcb7fd5f7d50bd3d6

    SHA1

    4df86e5c308200dccebd3568b1e67573d07ce5bd

    SHA256

    6f49bae9605f21bf5bbb8f82c3f006f2dc3ab0eaa862895a75d95d8faaf54f39

    SHA512

    a6b7b555ab8054fce05d84e05521ec74cd5272a6c14b8c18329a5eb26c24835256b4f8cae599828d8bd06d404907df7db903f7134a1ae65a70861322988fa88a

  • \Users\Admin\AppData\Local\Temp\EdgeUpdater\UUSIService.exe

    Filesize

    26KB

    MD5

    0e926b28fc49f6259a70c032ae83cd14

    SHA1

    abb5856b3853cfe4ecc5e25ff1a7aa605afac007

    SHA256

    3088b0302d4b38c63ef4fead57aa6049da2cc62bf9f4a5d9331552c84fe516e6

    SHA512

    1f4306c38e6604f3945a4d1215576ee81514c34757318035d9220fb81da5bb4f39d23b8a22f404902fe3e67f0326a1f9ff45dc6ce8d3a41a69aab54de488fb77

  • memory/1832-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

    Filesize

    4KB

  • memory/1832-1-0x0000000000270000-0x000000000027C000-memory.dmp

    Filesize

    48KB

  • memory/2756-28-0x0000000000040000-0x000000000004C000-memory.dmp

    Filesize

    48KB

  • memory/2932-14-0x00000000010B0000-0x00000000010BC000-memory.dmp

    Filesize

    48KB

  • memory/2932-17-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-29-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-58-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-62-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB