Analysis
-
max time kernel
36s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
18-09-2022 14:13
General
-
Target
TrashMalwares-main/PC shaking v4.0.exe
-
Size
21.7MB
-
MD5
d2eb6a0f3b1353b6f60c1ce3a63ef8d1
-
SHA1
a879af3e84106f4da79519ce08643eeb91f72a15
-
SHA256
b8d65832342d1fec828025eacbcc6e1df9c2f3276524a4abb1a965707fd475ee
-
SHA512
9473e711b785eba3e5cfcb36437069a96290864fe9562a5619d95f9fac9c0b46b0c3c942be8ff7fec4204a938392e8be471ea6ce683027cd29b181028b0e2481
-
SSDEEP
393216:MUbg/uqZ8EuLjIlYgJMFBoJPYG6O4BcwikWGmivl4yA1cmBBS:6G9LjHgUOJPEOyresC4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Windows directory 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\PC shaking v4.0.exe"C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\PC shaking v4.0.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Media\PCshakingv4.0.exe"C:\Windows\Media\PCshakingv4.0.exe"2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x52c 0x5281⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Media\PCshakingv4.0.exeFilesize
71KB
MD5129c1a8094f0a6a9cdc9f63e86f8a482
SHA1917c6809ae03670edbf5da4cb19c49e85390642c
SHA2562eadcdfd00b8bec4d18b71830cd334569844002a7971c56d3e1e38ff7972c4f3
SHA512076cf44955bebbad12ca905a36a12da4cd20520d8795e2f47f972ad996932731be4f007792954c9737b68330cd395a17ad19aa1e5b1c9e248379c37dcdf1a9e5
-
C:\Windows\Media\PCshakingv4.0.exeFilesize
71KB
MD5129c1a8094f0a6a9cdc9f63e86f8a482
SHA1917c6809ae03670edbf5da4cb19c49e85390642c
SHA2562eadcdfd00b8bec4d18b71830cd334569844002a7971c56d3e1e38ff7972c4f3
SHA512076cf44955bebbad12ca905a36a12da4cd20520d8795e2f47f972ad996932731be4f007792954c9737b68330cd395a17ad19aa1e5b1c9e248379c37dcdf1a9e5
-
C:\Windows\Media\mouse.icoFilesize
203KB
MD53abff26e58afe2b94ce801295336bf82
SHA1b3222e30303115469b5b3e3d03ed9aed846d830f
SHA256fb078b09259f96b032dce2c345c683b6b9d9316819dc363edd780b91dc11704d
SHA512ba546709378b529eb8887cc5f7ff9f4bc587bae61af009adf8778dc3972c2e57d9291df6f2b6cc8ba36b27c262b8eb6f650d610fc1d731c154bb4cad6df46ac2
-
\??\c:\Windows\Media\Tobu.wavFilesize
33.3MB
MD5d0533435fa1c748c3154263a8081a941
SHA15714ab67aa46a57bb3b8efcb521e96fa00283c73
SHA2560ccd3ab6ac691e67c3bfeab4aab35500d8ebe803d15eb958bee942650e9e2dd6
SHA5125a600cc219dcadbea8f8c651f5ef874ff5ceb05dc5b384a822571ea672165cdbfd1b0b9d5a6e5761088fcff7a83459eabf6c688826429d71e8c09a72b42d3cf6
-
memory/3288-132-0x0000000000000000-mapping.dmp