9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6

General

Target

9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe
Size

1.7MB
MD5

d4335bd224e4c17aa2d9771fae5560a4
SHA1

3fbc7bcc1ae2755be1975193e03d71ac12c4ec57
SHA256

9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6
SHA512

43f9afbe9b0d97faf4edfdef713ec37cfe59203f7920852652a9c7a8f3d30f486935cc66bfb4ff68d29084527c78dcc3c1893ca29a344398a593935c7127b985
SSDEEP

12288:DZISeMFVhdL1XBvXxzGNABnwHdxkn7L1GzR1FYoxkM2N4JHUcTwoSI:VIW0rXi1GzRQo08z

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Executes dropped EXE 3 IoCs

Processes:

winupdt.exewinupdt.exewinupdt.exe

pid process

2700 winupdt.exe
2564 winupdt.exe
2976 winupdt.exe

pid	process
2700	winupdt.exe
2564	winupdt.exe
2976	winupdt.exe

Loads dropped DLL 7 IoCs

Processes:

9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exewinupdt.exe

pid	process
3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe
3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe
3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe
3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe
3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe
2700	winupdt.exe
2700	winupdt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Window Updates = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

winupdt.exe

description	pid	process	target process
PID 2700 set thread context of 2564	2700	winupdt.exe	winupdt.exe
PID 2700 set thread context of 2976	2700	winupdt.exe	winupdt.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3068-0-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe	upx
behavioral1/memory/3068-47-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral1/memory/2564-56-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2976-69-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2700-68-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral1/memory/2976-66-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2976-64-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2564-53-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2564-50-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2564-72-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2976-73-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2564-74-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2564-76-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2564-79-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2564-81-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2564-83-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2564-85-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2564-90-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2564-95-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2564-100-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.exereg.exereg.exereg.exe9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exereg.exewinupdt.exewinupdt.execmd.execmd.exewinupdt.execmd.exereg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

2488 reg.exe
2132 reg.exe
2860 reg.exe
2160 reg.exe

pid	process
2488	reg.exe
2132	reg.exe
2860	reg.exe
2160	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

winupdt.exewinupdt.exe

description	pid	process
Token: 1	2564	winupdt.exe
Token: SeCreateTokenPrivilege	2564	winupdt.exe
Token: SeAssignPrimaryTokenPrivilege	2564	winupdt.exe
Token: SeLockMemoryPrivilege	2564	winupdt.exe
Token: SeIncreaseQuotaPrivilege	2564	winupdt.exe
Token: SeMachineAccountPrivilege	2564	winupdt.exe
Token: SeTcbPrivilege	2564	winupdt.exe
Token: SeSecurityPrivilege	2564	winupdt.exe
Token: SeTakeOwnershipPrivilege	2564	winupdt.exe
Token: SeLoadDriverPrivilege	2564	winupdt.exe
Token: SeSystemProfilePrivilege	2564	winupdt.exe
Token: SeSystemtimePrivilege	2564	winupdt.exe
Token: SeProfSingleProcessPrivilege	2564	winupdt.exe
Token: SeIncBasePriorityPrivilege	2564	winupdt.exe
Token: SeCreatePagefilePrivilege	2564	winupdt.exe
Token: SeCreatePermanentPrivilege	2564	winupdt.exe
Token: SeBackupPrivilege	2564	winupdt.exe
Token: SeRestorePrivilege	2564	winupdt.exe
Token: SeShutdownPrivilege	2564	winupdt.exe
Token: SeDebugPrivilege	2564	winupdt.exe
Token: SeAuditPrivilege	2564	winupdt.exe
Token: SeSystemEnvironmentPrivilege	2564	winupdt.exe
Token: SeChangeNotifyPrivilege	2564	winupdt.exe
Token: SeRemoteShutdownPrivilege	2564	winupdt.exe
Token: SeUndockPrivilege	2564	winupdt.exe
Token: SeSyncAgentPrivilege	2564	winupdt.exe
Token: SeEnableDelegationPrivilege	2564	winupdt.exe
Token: SeManageVolumePrivilege	2564	winupdt.exe
Token: SeImpersonatePrivilege	2564	winupdt.exe
Token: SeCreateGlobalPrivilege	2564	winupdt.exe
Token: 31	2564	winupdt.exe
Token: 32	2564	winupdt.exe
Token: 33	2564	winupdt.exe
Token: 34	2564	winupdt.exe
Token: 35	2564	winupdt.exe
Token: SeDebugPrivilege	2976	winupdt.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exewinupdt.exewinupdt.exewinupdt.exe

pid	process
3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe
2700	winupdt.exe
2564	winupdt.exe
2564	winupdt.exe
2976	winupdt.exe
2564	winupdt.exe

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.execmd.exewinupdt.exewinupdt.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3068 wrote to memory of 2680	3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe	cmd.exe
PID 3068 wrote to memory of 2680	3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe	cmd.exe
PID 3068 wrote to memory of 2680	3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe	cmd.exe
PID 3068 wrote to memory of 2680	3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe	cmd.exe
PID 2680 wrote to memory of 2880	2680	cmd.exe	reg.exe
PID 2680 wrote to memory of 2880	2680	cmd.exe	reg.exe
PID 2680 wrote to memory of 2880	2680	cmd.exe	reg.exe
PID 2680 wrote to memory of 2880	2680	cmd.exe	reg.exe
PID 3068 wrote to memory of 2700	3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe	winupdt.exe
PID 3068 wrote to memory of 2700	3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe	winupdt.exe
PID 3068 wrote to memory of 2700	3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe	winupdt.exe
PID 3068 wrote to memory of 2700	3068	9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe	winupdt.exe
PID 2700 wrote to memory of 2564	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2564	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2564	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2564	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2564	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2564	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2564	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2564	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2564	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2976	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2976	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2976	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2976	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2976	2700	winupdt.exe	winupdt.exe
PID 2564 wrote to memory of 2320	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 2320	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 2320	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 2320	2564	winupdt.exe	cmd.exe
PID 2700 wrote to memory of 2976	2700	winupdt.exe	winupdt.exe
PID 2564 wrote to memory of 2992	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 2992	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 2992	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 2992	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 1820	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 1820	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 1820	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 1820	2564	winupdt.exe	cmd.exe
PID 2700 wrote to memory of 2976	2700	winupdt.exe	winupdt.exe
PID 2564 wrote to memory of 1748	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 1748	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 1748	2564	winupdt.exe	cmd.exe
PID 2564 wrote to memory of 1748	2564	winupdt.exe	cmd.exe
PID 2700 wrote to memory of 2976	2700	winupdt.exe	winupdt.exe
PID 2700 wrote to memory of 2976	2700	winupdt.exe	winupdt.exe
PID 2320 wrote to memory of 2160	2320	cmd.exe	reg.exe
PID 2320 wrote to memory of 2160	2320	cmd.exe	reg.exe
PID 2320 wrote to memory of 2160	2320	cmd.exe	reg.exe
PID 2320 wrote to memory of 2160	2320	cmd.exe	reg.exe
PID 2992 wrote to memory of 2488	2992	cmd.exe	reg.exe
PID 2992 wrote to memory of 2488	2992	cmd.exe	reg.exe
PID 2992 wrote to memory of 2488	2992	cmd.exe	reg.exe
PID 2992 wrote to memory of 2488	2992	cmd.exe	reg.exe
PID 1820 wrote to memory of 2860	1820	cmd.exe	reg.exe
PID 1820 wrote to memory of 2860	1820	cmd.exe	reg.exe
PID 1820 wrote to memory of 2860	1820	cmd.exe	reg.exe
PID 1820 wrote to memory of 2860	1820	cmd.exe	reg.exe
PID 1748 wrote to memory of 2132	1748	cmd.exe	reg.exe
PID 1748 wrote to memory of 2132	1748	cmd.exe	reg.exe
PID 1748 wrote to memory of 2132	1748	cmd.exe	reg.exe
PID 1748 wrote to memory of 2132	1748	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe
"C:\Users\Admin\AppData\Local\Temp\9d7238111e9251aa374d7b8d31ab00897a7d1055cd9516e04f71e41cb7101ed6.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\OtzNe.bat" "
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Window Updates" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /f
3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2880

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2160

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2488

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2860

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2132

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OtzNe.bat

Filesize
158B

MD5
1954c7e666c5b4d1117ef07bc0c9b8ec

SHA1
559e3c0273c1463e9184027b749bdaad0a372681

SHA256
35e0dbc8b455ca38976157ce9d0293fd6cdca20f46f1cb69058a1e0f0af6f693

SHA512
3939de8d0ab7e67b59ff8bebed5580dafd38d8785193fd42a289728500761a68b9e6660605e19e10d4278dd106fea4b273a208f25485e7389c8f19b2958c926a

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe

Filesize
1.7MB

MD5
c79fe00fab409f516eb42bd2fbfb4871

SHA1
961c977b4f3e7401845fd3d7b227e19dfa5b8055

SHA256
10c8fcfed530f2e51fe5451181b20fc0234176d4842b378e0e29fdb4c29075ec

SHA512
003d948edc0324f24d6b8b5373415198ef42e551810f5a3ad7067eef54c177f2c4e52cfd532743d1c7fab49c8dfbdd00c0080e9be6221121d842dac71553e2da

Download Submit
memory/2564-50-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-74-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-72-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-95-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-56-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-90-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-85-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-83-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-81-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-53-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-100-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-79-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2564-76-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2700-68-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2976-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-73-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3068-42-0x0000000003310000-0x00000000034C3000-memory.dmp

Filesize
1.7MB

Download
memory/3068-43-0x0000000003310000-0x00000000034C3000-memory.dmp

Filesize
1.7MB

Download
memory/3068-47-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/3068-0-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads