Overview
overview
5Static
static
5LegacyUpda...11.exe
windows10-2004-x64
5LegacyUpda...11.exe
windows11-21h2-x64
5$PLUGINSDI...IS.dll
windows10-2004-x64
3$PLUGINSDI...IS.dll
windows11-21h2-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LegacyUpdate.dll
windows10-2004-x64
3LegacyUpdate.dll
windows11-21h2-x64
3Analysis
-
max time kernel
103s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250619-en -
resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2025, 18:13
Behavioral task
behavioral1
Sample
LegacyUpdate-1.111.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
LegacyUpdate-1.111.exe
Resource
win11-20250619-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LegacyUpdateNSIS.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LegacyUpdateNSIS.dll
Resource
win11-20250619-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSxfer.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSxfer.dll
Resource
win11-20250502-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250610-en
Behavioral task
behavioral9
Sample
LegacyUpdate.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral10
Sample
LegacyUpdate.dll
Resource
win11-20250619-en
General
-
Target
LegacyUpdate-1.111.exe
-
Size
601KB
-
MD5
65cf19fe7e1491409f95cc280f744fec
-
SHA1
75f8a05ff04f725521f7f46ad9c50c454ea39d20
-
SHA256
b826a873c50c9cbf6cb52f6bfbf7efad03dbf56cf0928504e1b2b7100aab29ac
-
SHA512
1f3503e0de4c74eb93a4f09d3952d2db10315629d8bc073ef69604e90f2a582021d77d5174e462cf2aec0f6620f386578c14791732610b615cf84b503682aebd
-
SSDEEP
12288:dBKdu4egRoStQ21qW9w7/RSX2wSqwRGIvccEq694AYTeen4OkZWnonzDkIBvP:Wdu4/R31qW9G5SX2JqwRGIvccE79w4xh
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation LegacyUpdate.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
resource yara_rule behavioral1/memory/3748-0-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/3748-41-0x0000000000400000-0x0000000000487000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Legacy Update\Uninstall.exe LegacyUpdate-1.111.exe File created C:\Program Files\Legacy Update\LegacyUpdate.dll LegacyUpdate-1.111.exe File created C:\Program Files\Legacy Update\LegacyUpdate.exe LegacyUpdate-1.111.exe -
Executes dropped EXE 2 IoCs
pid Process 3512 LegacyUpdate.exe 4556 LegacyUpdate.exe -
Loads dropped DLL 7 IoCs
pid Process 3748 LegacyUpdate-1.111.exe 3748 LegacyUpdate-1.111.exe 3512 LegacyUpdate.exe 6140 regsvr32.exe 5712 regsvr32.exe 1888 Process not Found 3336 IEXPLORE.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LegacyUpdate-1.111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "458417817" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\legacyupdate.net IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31190287" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a99294cc0d6ed74b8afae24cc34a9c32000000000200000000001066000000010000200000005c968459e421c10fbf7df8a628b0394235e7b3ead89d0ac4e59fac7dd3e44414000000000e8000000002000020000000d188626017cc7b27aacea74ce7306a454238ff034b3fe679a3c05202ffaab87820000000f8f3109b477e6734f8f2289556a43e58ee04057b668588dbea3b5fb4305018c34000000098aa377b552ecb1b1d9ea4f08f4a01a5fc092cdd04396306643d472819b163661e4f94cf16dd94833fb5d0219afa8ee99e45391fe4209ed0853903e23e3d8ec5 iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D800943-0434-49F2-89A1-472A259AD982}\AppName = "LegacyUpdate.exe" LegacyUpdate-1.111.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\legacyupdate.net\ = "11" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2129262184" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D800943-0434-49F2-89A1-472A259AD982} LegacyUpdate-1.111.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D800943-0434-49F2-89A1-472A259AD982} LegacyUpdate-1.111.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D800943-0434-49F2-89A1-472A259AD982}\Policy = "3" LegacyUpdate-1.111.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "11" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31190287" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0044e47f0feddb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D800943-0434-49F2-89A1-472A259AD982}\AppPath = "C:\\Program Files\\Legacy Update" LegacyUpdate-1.111.exe Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AA5C4909-5902-11F0-B464-724A1EDA80BB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2129731050" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D800943-0434-49F2-89A1-472A259AD982}\Policy = "3" LegacyUpdate-1.111.exe Set value (str) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\DOMStorage\legacyupdate.net IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\legacyupdate.net\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\legacyupdate.net\Total = "11" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a7da7f0feddb01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a99294cc0d6ed74b8afae24cc34a9c32000000000200000000001066000000010000200000008f4b682ef0528d9467d166d54887d703ae07e469a90342e8889fd2db5996d1b5000000000e800000000200002000000027af786eda649b4cce05900574f7a3507f83ef9d28b23b5c32098bfa0d65775f20000000057a054cb0138da1756e622580db63299b46d3554f2a7652afd2d0da27d3db3340000000884faac6373638a7002712273a3f33a45f23d82683d31ff43a64ea34d279d9ecc20840fa792ad97df066d9e62bebd72ca26c7f74d8b2002648bace0cef513f77 iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D800943-0434-49F2-89A1-472A259AD982}\AppPath = "C:\\Program Files\\Legacy Update" LegacyUpdate-1.111.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D800943-0434-49F2-89A1-472A259AD982}\AppName = "LegacyUpdate.exe" LegacyUpdate-1.111.exe Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FFBE8D44-E9CF-4DD8-9FD6-976802C94D9C}\Shell\Open LegacyUpdate-1.111.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D0A82CD0-B6F0-4101-83ED-DA47D0D04830}\ = "Legacy Update Control" LegacyUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\VersionIndependentProgID LegacyUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\Implemented Categories LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7B875A2F-2DFB-4D38-91F5-5C0BFB74C377}\InprocServer32\ThreadingModel = "Apartment" LegacyUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7B875A2F-2DFB-4D38-91F5-5C0BFB74C377}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84F517AD-6438-478F-BEA8-F0B808DC257F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7B875A2F-2DFB-4D38-91F5-5C0BFB74C377}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7B875A2F-2DFB-4D38-91F5-5C0BFB74C377}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4524BFBF-70BD-4EAC-AD33-6BADA4FB0638}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4524BFBF-70BD-4EAC-AD33-6BADA4FB0638}\ProxyStubClsid32\ = "{3236E684-0E4B-4780-9F31-F1983F5AB78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3236E684-0E4B-4780-9F31-F1983F5AB78D}\NumMethods regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FFBE8D44-E9CF-4DD8-9FD6-976802C94D9C}\ShellFolder\Attributes = "0" LegacyUpdate-1.111.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7B875A2F-2DFB-4D38-91F5-5C0BFB74C377}\MiscStatus\1\ = "131473" LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\LegacyUpdate.dll\AppID = "{D0A82CD0-B6F0-4101-83ED-DA47D0D04830}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.Control\CurVer\ = "LegacyUpdate.Control.1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C33085BB-C3E1-4D27-A214-AF01953DF5E5}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.Control LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C33085BB-C3E1-4D27-A214-AF01953DF5E5}\ = "ILegacyUpdateCtrl" LegacyUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84F517AD-6438-478F-BEA8-F0B808DC257F}\Elevation\Enabled = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7B875A2F-2DFB-4D38-91F5-5C0BFB74C377}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C33085BB-C3E1-4D27-A214-AF01953DF5E5}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FFBE8D44-E9CF-4DD8-9FD6-976802C94D9C} LegacyUpdate-1.111.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84F517AD-6438-478F-BEA8-F0B808DC257F}\TypeLib LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\VersionIndependentProgID\ = "LegacyUpdate.Control" LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3236E684-0E4B-4780-9F31-F1983F5AB78D}\InProcServer32\ = "C:\\Program Files\\Legacy Update\\LegacyUpdate.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.ElevationHelper\CurVer\ = "LegacyUpdate.ElevationHelper.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.ProgressBar.1\CLSID\ = "{7B875A2F-2DFB-4D38-91F5-5C0BFB74C377}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3236E684-0E4B-4780-9F31-F1983F5AB78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\ProgID\ = "LegacyUpdate.Control.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4524BFBF-70BD-4EAC-AD33-6BADA4FB0638}\ = "IProgressBarControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\LegacyUpdate.dll\AppID = "{D0A82CD0-B6F0-4101-83ED-DA47D0D04830}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3236E684-0E4B-4780-9F31-F1983F5AB78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3236E684-0E4B-4780-9F31-F1983F5AB78D}\InProcServer32\ = "C:\\Program Files\\Legacy Update\\LegacyUpdate32.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C33085BB-C3E1-4D27-A214-AF01953DF5E5}\TypeLib\Version = "1.0" LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.Control.1\CLSID\ = "{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3236E684-0E4B-4780-9F31-F1983F5AB78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3236E684-0E4B-4780-9F31-F1983F5AB78D}\ = "IElevationHelper" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.ProgressBar\CurVer\ = "LegacyUpdate.ProgressBar.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.ElevationHelper\ = "Legacy Update Elevation Helper" LegacyUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\Version LegacyUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C33085BB-C3E1-4D27-A214-AF01953DF5E5}\TypeLib LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.ProgressBar.1\ = "ProgressBarControl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4524BFBF-70BD-4EAC-AD33-6BADA4FB0638}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\TypeLib\ = "{05D22F33-C7C3-4C90-BDD9-CEDC86EA8FBE}" LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.ProgressBar\ = "ProgressBarControl Class" LegacyUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D22F33-C7C3-4C90-BDD9-CEDC86EA8FBE}\1.0\HELPDIR LegacyUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7B875A2F-2DFB-4D38-91F5-5C0BFB74C377}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4524BFBF-70BD-4EAC-AD33-6BADA4FB0638} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.ProgressBar\ = "ProgressBarControl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B875A2F-2DFB-4D38-91F5-5C0BFB74C377}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4524BFBF-70BD-4EAC-AD33-6BADA4FB0638}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84F517AD-6438-478F-BEA8-F0B808DC257F}\ProgID\ = "LegacyUpdate.ElevationHelper.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4524BFBF-70BD-4EAC-AD33-6BADA4FB0638}\NumMethods\ = "9" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84F517AD-6438-478F-BEA8-F0B808DC257F}\ = "Legacy Update Elevation Helper" LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84F517AD-6438-478F-BEA8-F0B808DC257F}\Version\ = "1.0" LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD28E0DF-5F5A-40B5-9432-85EFD97D1F9F}\InprocServer32\ = "C:\\Program Files\\Legacy Update\\LegacyUpdate.dll" LegacyUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LegacyUpdate.ElevationHelper\ = "Legacy Update Elevation Helper" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84F517AD-6438-478F-BEA8-F0B808DC257F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84F517AD-6438-478F-BEA8-F0B808DC257F}\TypeLib\ = "{05D22F33-C7C3-4C90-BDD9-CEDC86EA8FBE}" regsvr32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3748 LegacyUpdate-1.111.exe 4128 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4128 iexplore.exe 4128 iexplore.exe 3336 IEXPLORE.EXE 3336 IEXPLORE.EXE 3336 IEXPLORE.EXE 3336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3748 wrote to memory of 3512 3748 LegacyUpdate-1.111.exe 96 PID 3748 wrote to memory of 3512 3748 LegacyUpdate-1.111.exe 96 PID 3512 wrote to memory of 6140 3512 LegacyUpdate.exe 97 PID 3512 wrote to memory of 6140 3512 LegacyUpdate.exe 97 PID 3512 wrote to memory of 4012 3512 LegacyUpdate.exe 98 PID 3512 wrote to memory of 4012 3512 LegacyUpdate.exe 98 PID 4012 wrote to memory of 5712 4012 regsvr32.exe 99 PID 4012 wrote to memory of 5712 4012 regsvr32.exe 99 PID 4012 wrote to memory of 5712 4012 regsvr32.exe 99 PID 3748 wrote to memory of 4556 3748 LegacyUpdate-1.111.exe 101 PID 3748 wrote to memory of 4556 3748 LegacyUpdate-1.111.exe 101 PID 4128 wrote to memory of 3336 4128 iexplore.exe 106 PID 4128 wrote to memory of 3336 4128 iexplore.exe 106 PID 4128 wrote to memory of 3336 4128 iexplore.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\LegacyUpdate-1.111.exe"C:\Users\Admin\AppData\Local\Temp\LegacyUpdate-1.111.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Program Files\Legacy Update\LegacyUpdate.exe"C:\Program Files\Legacy Update\LegacyUpdate.exe" /regserver 6559902⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\Legacy Update\LegacyUpdate.dll"3⤵
- Loads dropped DLL
- Modifies registry class
PID:6140
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\Legacy Update\LegacyUpdate32.dll"3⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\Legacy Update\LegacyUpdate32.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5712
-
-
-
-
C:\Program Files\Legacy Update\LegacyUpdate.exe"C:\Program Files\Legacy Update\LegacyUpdate.exe" /launch /firstrun2⤵
- Executes dropped EXE
PID:4556
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:5172
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4128 CREDAT:17410 /prefetch:22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3336
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
419KB
MD574350e57247d8e2ca48f296167749f6b
SHA14c6a29a11b3238896c635159475ee75726191974
SHA256b98d511ed5039d3b8c9bf02eb25155b3917f38234d4e38113209276cea46bce3
SHA5124fcc7d146a169b95e8839c92a79993a83203e47d8a293a96795b2b497d6cb39e0f702922d55514773d0992b7e11c63cfa7cccf755ae3becdbdfd4323f1f14054
-
Filesize
127KB
MD5a658cd3da26882d5cafc03cb04f28828
SHA1952c0dd7b9a0a4fdaaf5a6bfd92649d76cec97f5
SHA256e27c064ebb7c99ec65494d9371165f2b207e35cf2a5cd660e74223c0013e98c1
SHA51223ad1e341dae59e5edadc92d56b0da0a5729228b079e0e57a4232c7ba83789d77ce7daf713b219811692327a1507b6bce0ccbc5dc99c2e253bf78216df63230e
-
Filesize
295KB
MD5a16b3a0f15a907da1a868b8e9842f1a4
SHA1afd21759cfd0f68b765f3cd9365280094c8a618e
SHA2569eb6498716330a0e1019316fc21261e1e81ccd319ed1a9c8d2555ecaeb0229ec
SHA512f95a1b2ffabf3795a1b77eb67506603d213391efc04ec4a1592f24af4297777763518bb9c0c7e4be975591125cec587e33e48ec39f2c2fd641abd33a83687015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0
Filesize471B
MD5db3f2e41632254f91f7e5e41942d8ff0
SHA17da106440ca2f41c46abf0c425b49bbce80a1cfb
SHA256601e2bdca83d313ce5087a94b902e3a8237c1255e1221deeb40b3ae5c3a9d9d3
SHA5120cb09d9c84a09722a83150f24caf27cd72f873f77e765b45ac00b177c895f095d9126aafbba60aa3c54b2d3acbee104aa5d0ad1942aca4038586a2242528fbfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0
Filesize400B
MD51f12e0bf0132a75fa39048ac84b34b09
SHA138c60f3cc4a2a6c0d57ffd2702e33452f329827a
SHA2563a11f528a4cd6b959a784ee816170463b43fd58ac09b94c8fe4f095344a65968
SHA5124f8913a522cc1cf9b9a2c69be3ba158a6a128e275c1dae96bf675bec0ab31a3181cf453d5b2a018d41bebb4b295a1d1a1c947b28a69503fa354ab8ad4a13f677
-
Filesize
15KB
MD5b8bfd4f0b46a40ef47592936a1ff8671
SHA1d5d743ac3f2bbd43c95733ba49b5e34c9e675db2
SHA2568c969228feaa34c8e0efcc6e0f3ab21961755f208e8676e2e7c871fe07117d4c
SHA512ff8fb95c910afa2f69da2ec0803bbe92bf4c24aa05a77eb73af21ec76dda18391c674b6f70451e395244efe1c266e9061eaf67b21360114758e7b3966a27b6af
-
Filesize
11KB
MD5851da6986ad50596a4a737884c8a34f7
SHA157694850292dac81b60de2946adeaee7a298d567
SHA256cc90dadd7bbbe71807a845d9be7004c80552f0b6ac80c807e5e59752ea4a4ade
SHA5129b26a790d244b45ee5f43f7c85c92e0597d0180972a898f3b851cae18e1848db527c9487635ba26a4a8a3b671535292ccf3cc12ea6ea44e0c3c04a67e59505ac
-
Filesize
22KB
MD53f5c85e6db94d3770df4d5316d368e48
SHA162b31c769534010e8c4cd7697417a66356788993
SHA25620da3eca3de93ab83a58bb5b08b9ccf8022c863049dbdd069415171f4600099c
SHA512b99c2f369f32ce065878ddd69db947d2e6d351e745933a6946efa024e668692068318ef42e1623499a96a81de32c1a29557ae40c459b0cb999880db965f95013
-
Filesize
1KB
MD59b7ff692b36f18db4aba6662aac3bccb
SHA1ad579f3c5b37f4694892422436cb045d39640e8c
SHA2562ba11644aa731e07ef950e9ec9649c30f76a03c660b93f69ef94f038c93eabd1
SHA512c89475b95873f304d93238f6a369c81369b50b81a985c9c5e3ee085f9a362fdd6f5d9d20872ea1e00bc03b340b29197aa58db8a857b22c3fe453b9175274be0b
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
14KB
MD5234bff2200db4dd16e96bcb6ae5da9f0
SHA1d348cd7dd3ab3b86cbd2548203186d0db6d4884e
SHA25648282bd4c2ef47c6c51bab7011c8cef46395138d05ab83ac55b0415d64bcd277
SHA5123bf1867fba4d0b0d9e1f30d0fadd71cdc3de964da7743d0ad2129aa0a7e96f6c057070bb8a122dab8fefdfa72324c4149db97e5fd622fd018fbb08ce17d9edfe
-
Filesize
45KB
MD59faba20acb994499221c4066aa5bc043
SHA1d19d76e98d0e433166d4c8f1f2b6ffbc9443548a
SHA256afaa11c241ad99d31fe29dc07a0d2190dc0490f21d3bd6399b87498ad1055ec4
SHA5123a8028e53259e193360b6fb7f49ac4f4ef9d8cf29b0681026ddfb4d5dc62cf35feea8184e05fccf212abf8e37da5b31c80e77ac323aab360ddd5fe827ca49224
-
Filesize
32KB
MD5617f4e0a6c8782cfca9aee923fc7f8e4
SHA1c907a6310e450f1ff9fd14c4afd10b70add8f2ee
SHA25643a5e3313332eb6835290e99f37dc84de6991d62cd8cb285f1dea32f66d1507e
SHA512ef3fae21758358042a471b4c898bcda491b9e48edbe2f9f68c02c5f4d1e50313282323134916e5ad0b3b721f4c802d9aee77902831a580e5e54a1c2e36bbed2a