Analysis

  • max time kernel
    92s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:39

General

  • Target

    ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe

  • Size

    94KB

  • MD5

    d978e4ca064ce01f293e62f827ae425a

  • SHA1

    295e04b231f2a37bdec90b2d6e9a2436c3b9ac97

  • SHA256

    ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a

  • SHA512

    d5a84924ed4eb210da275172696f8085ce509a88ff554b3faa84d21ff46d8310c1d6045417964affac9ae988f13e97c91e1c352fde655dc744033d1953e5d3b6

  • SSDEEP

    1536:PGYU/W2/HG6QMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7P:PfU/WF6QMauSuiWNi9CO+WARJrWNZx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe
    "C:\Users\Admin\AppData\Local\Temp\ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\ProgramData\Update\wuauclt.exe
      "C:\ProgramData\Update\wuauclt.exe" /run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2188
    • C:\windows\SysWOW64\cmd.exe
      "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\ad782a33f1fe98a5a5d75bd19e8a3b5e699e20932af5972e75634951670ca90a.exe" >> NUL
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Update\wuauclt.exe

    Filesize

    94KB

    MD5

    1aab322529410bb409300f5a6b8f0287

    SHA1

    a9a124adcbe19ad6b76cdb1c1c90a70d898ea419

    SHA256

    a37a07e88c7833f19e9ae63eb534e7ea7bb4cf86e619b07ef93522ca6abc79fb

    SHA512

    604fa4f4b89a87314035c63ab5bece23c2386f879eec8e308e93deb34d693432a4b61b55c63c2272748e091241daa5b2cee994c3f588abdadad0d812410d8d33