Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-11-2024 01:39

General

  • Target

    ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe

  • Size

    94KB

  • MD5

    d978e4ca064ce01f293e62f827ae425a

  • SHA1

    295e04b231f2a37bdec90b2d6e9a2436c3b9ac97

  • SHA256

    ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a

  • SHA512

    d5a84924ed4eb210da275172696f8085ce509a88ff554b3faa84d21ff46d8310c1d6045417964affac9ae988f13e97c91e1c352fde655dc744033d1953e5d3b6

  • SSDEEP

    1536:PGYU/W2/HG6QMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7P:PfU/WF6QMauSuiWNi9CO+WARJrWNZx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe
    "C:\Users\Admin\AppData\Local\Temp\ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\ProgramData\Update\wuauclt.exe
      "C:\ProgramData\Update\wuauclt.exe" /run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2412
    • C:\windows\SysWOW64\cmd.exe
      "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe" >> NUL
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\Update\wuauclt.exe

    Filesize

    94KB

    MD5

    4965ceb9a2b8357efc11809dea7f9038

    SHA1

    0ba7e246d7d8da9206b31e9b7875db8e1bbac3b7

    SHA256

    c6c1038954847dfdd07204efb73fba838a2b2165114f65c0206c81a787b5242d

    SHA512

    fe0983149cd93765a697e0a9dbb5e210f23253d73ec03c9d532b01e8d42ec942c81875a8b897f3de2a25ebf7dfa5c529859e6b0050ccab6ae3f9d0cb2d2d7ff2