3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c

General

Target
3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
Size 6.8MB
Sample261002-e83rpsvz9m
SHA256 3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c
MD5 0ece90b6149c4c60a881c23ca7b4dac7
SHA1 a963e56fc2aee3bacf475bc2e3f33ee9b3c43b97
SHA512 0997e808059812ed937d90940e48e5fd9fff7346e0dc78cc5f2075db566906b13e2dee0a17043f9b9554a43758fe5ed8c2d4bf94c8079087eabd778befb54e69
SSDEEP 49152:lj5httrugT8oWmKUCgC4JBI/5IU6iIxX:DhajfUTJk++2
TLSH
T15C76E5D25593C681F213C8605451BFE20536B47BE9F888B6B3BA1B48DF7EF61160AE4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2004	Update.exe
4592	Update.exe
1036	Update.exe
1252	Update.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Options	wordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List	wordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Management	wordpad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wordpad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wordpad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad	wordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Settings	wordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wordpad.exe	wordpad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\wordpad.exe\JScriptSetScriptStateStarted = "240719750"	wordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wordpad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Applets	wordpad.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3324	3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
3324	3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
2004	Update.exe
1036	Update.exe
1036	Update.exe
4592	Update.exe
4592	Update.exe
2004	Update.exe
1252	Update.exe
1252	Update.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4408	wordpad.exe
4408	wordpad.exe
4408	wordpad.exe
4624	wordpad.exe
4624	wordpad.exe
4624	wordpad.exe
4408	wordpad.exe
4408	wordpad.exe
4624	wordpad.exe
4624	wordpad.exe
3300	wordpad.exe
3300	wordpad.exe
3300	wordpad.exe
3300	wordpad.exe
3300	wordpad.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 2004	3324	3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe	87
PID 4592 wrote to memory of 4408	4592	Update.exe	92
PID 2004 wrote to memory of 4624	2004	Update.exe	94
PID 4592 wrote to memory of 4408	4592	Update.exe	92
PID 4592 wrote to memory of 4408	4592	Update.exe	92
PID 2004 wrote to memory of 4624	2004	Update.exe	94
PID 2004 wrote to memory of 4624	2004	Update.exe	94
PID 1036 wrote to memory of 3300	1036	Update.exe	108
PID 1036 wrote to memory of 3300	1036	Update.exe	108
PID 1036 wrote to memory of 3300	1036	Update.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
"C:\Users\Admin\AppData\Local\Temp\3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
  j48fHGRD54f5fy6f
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4624

C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe j48fHGRD54f5fy6f
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4408

C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe j48fHGRD54f5fy6f
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:3300

C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
Size 1.7MB
SHA256 b3b703b2073e2b999288d1440dd5185cdb7e53bb2f53655ae43fb76fe1e4ab28
MD5 27c43cf8d661221925b1f2d83dc509c2
SHA1 83c720a50219558c0d6fde070951eedf1f1cf915
SHA512 74fa7c928e7973d4b9e71dc080d728f2cbb184a295d72c422ea72c0916ba6c098570b78c795c127b22bc20f3dec7cb640c88e9b2eda47cde03ff8020a0239f2e
SSDEEP 24576:+pLlAuyJSxqngRLhtQ6cVLJtQn652gO8KrNRRsFM3VIH06iy5xk5:cLWuyIqngRLhK6cVl4y+ZqYIU6i0
TLSH
T11D857C11BA865E99C459C4B883874FB25A31B4DB0F26E7AF02D591323E6E7F11F2C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing