Managed XDR

c-users-user-appdata-r...windows-winupdater.exe — malware analysis report

File info

Filename
c-users-user-appdata-roaming-microsoft-windows-winupdater.exe
File type
PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
File size
1.5 MB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
dd1815b472d3264d258591b01887c20d61323370
SHA256
98a285b008865a8cb1bbc13757bb0732c26cf48f2d7aa138aa44d641e78cdc34
MD5
5e68ed35940007feb9e80ae67e0437c8

Signatures

Persistence

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1564.001 stealth_file: Creates hidden or system files
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
copies_self: Creates a copy of itself
creates_exe: Creates executable files in the file system
pe_overlay: PE file contains overlay