Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 01:39
Static task
static1
Behavioral task
behavioral1
Sample
ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe
Resource
win10v2004-20241007-en
General
-
Target
ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe
-
Size
94KB
-
MD5
d978e4ca064ce01f293e62f827ae425a
-
SHA1
295e04b231f2a37bdec90b2d6e9a2436c3b9ac97
-
SHA256
ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a
-
SHA512
d5a84924ed4eb210da275172696f8085ce509a88ff554b3faa84d21ff46d8310c1d6045417964affac9ae988f13e97c91e1c352fde655dc744033d1953e5d3b6
-
SSDEEP
1536:PGYU/W2/HG6QMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7P:PfU/WF6QMauSuiWNi9CO+WARJrWNZx
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2916 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
wuauclt.exepid process 2412 wuauclt.exe -
Loads dropped DLL 1 IoCs
Processes:
ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exepid process 2072 ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run" ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exead782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exewuauclt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauclt.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exedescription pid process target process PID 2072 wrote to memory of 2412 2072 ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe wuauclt.exe PID 2072 wrote to memory of 2412 2072 ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe wuauclt.exe PID 2072 wrote to memory of 2412 2072 ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe wuauclt.exe PID 2072 wrote to memory of 2412 2072 ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe wuauclt.exe PID 2072 wrote to memory of 2916 2072 ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe cmd.exe PID 2072 wrote to memory of 2916 2072 ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe cmd.exe PID 2072 wrote to memory of 2916 2072 ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe cmd.exe PID 2072 wrote to memory of 2916 2072 ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe"C:\Users\Admin\AppData\Local\Temp\ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\ProgramData\Update\wuauclt.exe"C:\ProgramData\Update\wuauclt.exe" /run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412 -
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe" >> NUL2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD54965ceb9a2b8357efc11809dea7f9038
SHA10ba7e246d7d8da9206b31e9b7875db8e1bbac3b7
SHA256c6c1038954847dfdd07204efb73fba838a2b2165114f65c0206c81a787b5242d
SHA512fe0983149cd93765a697e0a9dbb5e210f23253d73ec03c9d532b01e8d42ec942c81875a8b897f3de2a25ebf7dfa5c529859e6b0050ccab6ae3f9d0cb2d2d7ff2