Malware Analysis Report

2024-12-07 11:35

Sample ID 241113-t8jfdsvhmh
Target aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe
SHA256 aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaa
Tags
upx discovery evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaa

Threat Level: Known bad

The file aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe was found to be: Known bad.

Malicious Activity Summary

upx discovery evasion persistence

Modifies firewall policy service

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry key

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 16:43

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 16:43

Reported

2024-11-13 16:45

Platform

win7-20240903-en

Max time kernel

119s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2200 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2200 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2200 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3008 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3008 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3008 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3008 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2664 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2272 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 1736 wrote to memory of 548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1736 wrote to memory of 548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1736 wrote to memory of 548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1736 wrote to memory of 548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2732 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2732 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2732 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2732 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe

"C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\ucLwj.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /f

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 havefunnuke.servequake.com udp

Files

memory/3008-1-0x0000000000400000-0x00000000005CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ucLwj.bat

MD5 49bb161b07149b1bda99901c71d98b1f
SHA1 e5e3b389c09d551bd8f3a4cf71ee30e566fdf6e2
SHA256 734c4f48449a118dbdfbbe4971ecf112b26b2b45d1889678c01dea98eb5767d8
SHA512 da09a2af9b7f9528916ab719ed97ee8b61179bba92016eaed64b3e7d6bf08646801aeeb0eb332bdde175eb64b48106f7cf2fe2bf01ea6128753e4ce1d48707be

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

MD5 892e95d3e3f53ab326d89d38daa47e88
SHA1 e0e2d747fb78f24457710ef6d0b84bbb717d7a03
SHA256 ee1d3ca0275f27c7433b4fa6adb4bb70018c73c9b64e379829249ef62dd4bb39
SHA512 c9fc77e88218868e57a58914ae25b3b37d72b5f83a6438124e9b53a7d8c212fe54cf7c2939ad806ab3858ec79af5df8b120c5834c22a6e0b19b8955e44b9fe22

memory/3008-43-0x00000000037D0000-0x000000000399A000-memory.dmp

memory/3008-42-0x00000000037D0000-0x000000000399A000-memory.dmp

memory/3008-45-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2664-57-0x0000000002930000-0x0000000002AFA000-memory.dmp

memory/2272-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2272-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2272-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2596-65-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2596-63-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2596-70-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2664-69-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2272-73-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2596-74-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2272-75-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2272-77-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2272-80-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2272-82-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2272-84-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2272-86-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2272-91-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2272-96-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 16:43

Reported

2024-11-13 16:45

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

109s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3136 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Windows\SysWOW64\cmd.exe
PID 2832 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2832 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2832 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3136 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3136 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3136 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2328 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2540 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 3740 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3740 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3740 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3540 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3540 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3540 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2424 wrote to memory of 832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2424 wrote to memory of 832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2424 wrote to memory of 832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5104 wrote to memory of 3284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5104 wrote to memory of 3284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5104 wrote to memory of 3284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe

"C:\Users\Admin\AppData\Local\Temp\aac0a537d4aed51eeb6ac90685dd5547d1588ca4262417800681ac424745cdaaN.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KJEDn.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /f

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 99.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp

Files

memory/3136-0-0x0000000000400000-0x00000000005CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\KJEDn.txt

MD5 49bb161b07149b1bda99901c71d98b1f
SHA1 e5e3b389c09d551bd8f3a4cf71ee30e566fdf6e2
SHA256 734c4f48449a118dbdfbbe4971ecf112b26b2b45d1889678c01dea98eb5767d8
SHA512 da09a2af9b7f9528916ab719ed97ee8b61179bba92016eaed64b3e7d6bf08646801aeeb0eb332bdde175eb64b48106f7cf2fe2bf01ea6128753e4ce1d48707be

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.txt

MD5 7f6a28a5f1ddb95f9c0aa7bbf4eb62f8
SHA1 52a2569844e34cfe4be3342ac4989c343c5fce9a
SHA256 6b9828895bcb96d5b7f73fe48a55f55c09123f5fd208a2a1f789501055d005d9
SHA512 1d939a61abd48596b3272a0ed3a902c37c1e7765affd89f64f4f6e8c876078ee1e701a8e67d9fc97e5fd561b664a896bb0719ee278f914f8bdee579f0407f1cc

memory/3136-30-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2540-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2540-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2540-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4972-44-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4972-40-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4972-37-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2328-48-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2540-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4972-52-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2540-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2540-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2540-58-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2540-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2540-62-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2540-65-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2540-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2540-69-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2540-74-0x0000000000400000-0x000000000045C000-memory.dmp