Overview

overview

10

Static

static

10

WindowsUpd...ce.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    105s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2025, 17:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WindowsUpdateService.exe

  • Size

    9.5MB

  • MD5

    792d47eaf8e8f7752ee07df094f402ba

  • SHA1

    79b8dd99dbfb362a3adbe8d5e798510623b7a9a6

  • SHA256

    2782a2bbab02cefb45d92ad5d82d68e389286904f0cb0bd2be80562f1349bc7d

  • SHA512

    9b67a632b0dd6dfbfa27651da2366c40e3447fc4f8a4e26e04408ea9a93c7b2742b60195b099fbf68fa2015c46644b0074960e642b75112e5c58ed09cd0b2f71

  • SSDEEP

    98304:80gjE8Kq+sJgTVxXM29X9BdNrHEYWvFnsVs:IEe+sJit9X9BfrkY3s

Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5420
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
      2⤵
      • Views/modifies file attributes
      PID:972
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    PID:4264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    Filesize

    5.9MB

    MD5

    3ae91008688bf95f154afeeaf9e6c647

    SHA1

    a4b60188ddaec293bc39910127427fac570503aa

    SHA256

    71544ca3d4a50971551dea5dfa234fa42dd1e917045aca0a9e6f0460174c77ad

    SHA512

    c4918214560df18a334d0f4f23c892784addfc5661d60f6e4bc43689c96f06b25f7194527f4df78727bbbc88dae2ae6a9aa9d5efeddd1341191be40dd041e7fa

    Download Submit