Resubmissions
23-02-2023 14:03
230223-rcnzwsga69 1020-01-2023 12:25
230120-plqhzaff6y 1016-01-2023 12:00
230116-n6kyjsad9v 1015-01-2023 04:12
230115-esqr7sdg4v 1015-01-2023 04:01
230115-elc8jahg27 815-01-2023 03:56
230115-ehjk5shf75 815-01-2023 01:02
230115-bebjksbg8w 1015-01-2023 00:38
230115-azcfyafg72 8Analysis
-
max time kernel
115s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2023 01:02
Static task
static1
Behavioral task
behavioral1
Sample
88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe
Resource
win7-20220812-en
General
-
Target
88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe
-
Size
1.6MB
-
MD5
9f7aaf3a9a3f325dd533ecc38d85a351
-
SHA1
1ebdc55b96e11d9b924fbba8c5fa1799ff247970
-
SHA256
88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd
-
SHA512
0afdcb5362be67938d00baaeb3974af3ad2b7342c8024ec2390ce87bad4c6252e4c8277a0bb36979cdcb4036aa9f7dc93ac23f78acdd04033c3086fa3fd7286f
-
SSDEEP
24576:yWmAFubS9dt9Mcp5CPu4YV5GaCxYiluVuTY4PRVGEw6GPDp5MwNrsJjF2GKGI8L:q29dRpYW4YV5QxYiET8ahPDMwNrs2y
Malware Config
Signatures
-
Processes:
jsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" jsc.exe -
Executes dropped EXE 2 IoCs
Processes:
Engine.exeChampion.exe.pifpid process 4468 Engine.exe 2228 Champion.exe.pif -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SETUP_4199\Engine.exe upx C:\Users\Admin\AppData\Local\Temp\SETUP_4199\Engine.exe upx behavioral2/memory/4468-136-0x0000000000400000-0x0000000000558000-memory.dmp upx behavioral2/memory/4468-161-0x0000000000400000-0x0000000000558000-memory.dmp upx behavioral2/memory/4468-162-0x0000000000400000-0x0000000000558000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Drops desktop.ini file(s) 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 55 eth0.me -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Champion.exe.pifdescription pid process target process PID 2228 set thread context of 3800 2228 Champion.exe.pif jsc.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4244 taskkill.exe -
Modifies registry class 2 IoCs
Processes:
svchost.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4246620582-653642754-1174164128-1000\{79D15526-EEF9-44CC-85FB-B79BAD60D298} svchost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4246620582-653642754-1174164128-1000\{4091C479-8BC9-4204-8B81-6E36055B2874} svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
powershell.exepowershell.exeChampion.exe.pifjsc.exepid process 1904 powershell.exe 1904 powershell.exe 1904 powershell.exe 2776 powershell.exe 2776 powershell.exe 2776 powershell.exe 2776 powershell.exe 2228 Champion.exe.pif 2228 Champion.exe.pif 2228 Champion.exe.pif 2228 Champion.exe.pif 2228 Champion.exe.pif 2228 Champion.exe.pif 2228 Champion.exe.pif 2228 Champion.exe.pif 3800 jsc.exe 3800 jsc.exe 3800 jsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OpenWith.exepid process 3724 OpenWith.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exejsc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1904 powershell.exe Token: SeDebugPrivilege 2776 powershell.exe Token: SeDebugPrivilege 3800 jsc.exe Token: SeDebugPrivilege 4244 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Champion.exe.pifpid process 2228 Champion.exe.pif 2228 Champion.exe.pif 2228 Champion.exe.pif -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Champion.exe.pifpid process 2228 Champion.exe.pif 2228 Champion.exe.pif 2228 Champion.exe.pif -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3724 OpenWith.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exeEngine.execmd.execmd.exeChampion.exe.pifjsc.exedescription pid process target process PID 4884 wrote to memory of 4468 4884 88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe Engine.exe PID 4884 wrote to memory of 4468 4884 88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe Engine.exe PID 4884 wrote to memory of 4468 4884 88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe Engine.exe PID 4468 wrote to memory of 2348 4468 Engine.exe cmd.exe PID 4468 wrote to memory of 2348 4468 Engine.exe cmd.exe PID 4468 wrote to memory of 2348 4468 Engine.exe cmd.exe PID 2348 wrote to memory of 1280 2348 cmd.exe cmd.exe PID 2348 wrote to memory of 1280 2348 cmd.exe cmd.exe PID 2348 wrote to memory of 1280 2348 cmd.exe cmd.exe PID 1280 wrote to memory of 1904 1280 cmd.exe powershell.exe PID 1280 wrote to memory of 1904 1280 cmd.exe powershell.exe PID 1280 wrote to memory of 1904 1280 cmd.exe powershell.exe PID 1280 wrote to memory of 2776 1280 cmd.exe powershell.exe PID 1280 wrote to memory of 2776 1280 cmd.exe powershell.exe PID 1280 wrote to memory of 2776 1280 cmd.exe powershell.exe PID 1280 wrote to memory of 3612 1280 cmd.exe findstr.exe PID 1280 wrote to memory of 3612 1280 cmd.exe findstr.exe PID 1280 wrote to memory of 3612 1280 cmd.exe findstr.exe PID 1280 wrote to memory of 2228 1280 cmd.exe Champion.exe.pif PID 1280 wrote to memory of 2228 1280 cmd.exe Champion.exe.pif PID 1280 wrote to memory of 2228 1280 cmd.exe Champion.exe.pif PID 1280 wrote to memory of 964 1280 cmd.exe PING.EXE PID 1280 wrote to memory of 964 1280 cmd.exe PING.EXE PID 1280 wrote to memory of 964 1280 cmd.exe PING.EXE PID 2228 wrote to memory of 3800 2228 Champion.exe.pif jsc.exe PID 2228 wrote to memory of 3800 2228 Champion.exe.pif jsc.exe PID 2228 wrote to memory of 3800 2228 Champion.exe.pif jsc.exe PID 2228 wrote to memory of 3800 2228 Champion.exe.pif jsc.exe PID 2228 wrote to memory of 3800 2228 Champion.exe.pif jsc.exe PID 3800 wrote to memory of 4244 3800 jsc.exe taskkill.exe PID 3800 wrote to memory of 4244 3800 jsc.exe taskkill.exe PID 3800 wrote to memory of 4244 3800 jsc.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe"C:\Users\Admin\AppData\Local\Temp\88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SETUP_4199\Engine.exeC:\Users\Admin\AppData\Local\Temp\SETUP_4199\Engine.exe /TH_ID=_4888 /OriginExe="C:\Users\Admin\AppData\Local\Temp\88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cmd < 43⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avastui5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avgui5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ibXEdmiVmigethPmiCeveAlmmdbbRGVlGZgkrkVHBRdIphNCcvDTejGGhntqwKrSktcyZDvWGxUklCdjCVwceeizaHYEiVGRNbvySICSZHhIac$" 455⤵
-
C:\Users\Admin\AppData\Local\Temp\5col3ccv.tda\22214\Champion.exe.pif22214\\Champion.exe.pif 22214\\S5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe6⤵
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /im chrome.exe /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 185⤵
- Runs ping.exe
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD5def65711d78669d7f8e69313be4acf2e
SHA16522ebf1de09eeb981e270bd95114bc69a49cda6
SHA256aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
SHA51205b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ae4c8e5584800fb329245575326981e2
SHA1523196625373566515846c111be27aa9ea38c449
SHA256b30c4a136064607386d8ccbe369d035b9825e3d062758773b65b4a4907cf9d84
SHA5125cf0bac5a0cdaa0ada36eb0dbeffb1f80e94af8905f9d68c8c0319b36d4bba1f743f10b70c334ed91396fb18935cb02b8d35b67d7581741440c59cd310356079
-
C:\Users\Admin\AppData\Local\Temp\5col3ccv.tda\22214\Champion.exe.pifFilesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\SETUP_4199\00000#4Filesize
12KB
MD54839bb17c0c82a044dbd0072c6c98cb6
SHA13c06dcc178dd8a8e2290b746cfc7e704a537c91f
SHA256a7e6636cd2ba510513484cfea9201884f64f7b664951402b909caf9728704ec2
SHA51213d607b989efca3105363a10f481ef02fdcfcd5da4a267da0b87f3f2417456e672337c8e6332e0be286f6401bea203149a1cd23a24a8006f689b32e9d6199b55
-
C:\Users\Admin\AppData\Local\Temp\SETUP_4199\00001#45Filesize
872KB
MD5a3b85111ecdfc29672319893192bb7fd
SHA14ec865fd387eade4cd0b0ad8cabd68cae89ac8d5
SHA256ec8149d7c157e53108c089f07b8d2bf1156b8c1f8632c938a2130279927e2367
SHA5120c9e75843ebe962246a0fd2d15e2b90ae71257aac15ee7b1cf12a3fc383a144fef5959c0a81c7d9f55ef6893937b1a9868a7c2546d70045c40810a7b3a0be804
-
C:\Users\Admin\AppData\Local\Temp\SETUP_4199\00002#7Filesize
1.5MB
MD5536073c3748e4eb7bbee303547b7227d
SHA14397b1d855e799f4d38467a848cda2273c1c6c73
SHA2568e289b8dfc7e4994d808ef79a88adb513365177604fe587f6efa812f284e21a3
SHA5123b1e1c853c362770a4ddcc4c7b3b932f9adf9db006bf649266a1b0c9c6c7b0afb7f0cd5687f672ed58908c9af8b56a830888b6f30defb97297cbde8de18f7651
-
C:\Users\Admin\AppData\Local\Temp\SETUP_4199\Engine.exeFilesize
392KB
MD5a7a99a201774531d761f6aac2651a9df
SHA1b122ae368c4bf103e959a6ebb54ddb310117ab96
SHA256e6e73497e85e9ece4c92ac7d49e07b9d55e932ba2d9e5789b94b95a9841ee524
SHA512056504da2afeed547a4123ac8c38b35291b7dc0126fb638ae304eee802ac572715f9d608e9f1655788a030f488354741ee27c805434111c8e915cf841c0892f1
-
C:\Users\Admin\AppData\Local\Temp\SETUP_4199\Engine.exeFilesize
392KB
MD5a7a99a201774531d761f6aac2651a9df
SHA1b122ae368c4bf103e959a6ebb54ddb310117ab96
SHA256e6e73497e85e9ece4c92ac7d49e07b9d55e932ba2d9e5789b94b95a9841ee524
SHA512056504da2afeed547a4123ac8c38b35291b7dc0126fb638ae304eee802ac572715f9d608e9f1655788a030f488354741ee27c805434111c8e915cf841c0892f1
-
C:\Users\Admin\AppData\Local\Temp\SETUP_4199\Modern_Icon.bmpFilesize
7KB
MD51dd88f67f029710d5c5858a6293a93f1
SHA13e5ef66613415fe9467b2a24ccc27d8f997e7df6
SHA256b5dad33ceb6eb1ac2a05fbda76e29a73038403939218a88367925c3a20c05532
SHA5127071fd64038e0058c8c586c63c62677c0ca403768100f90323cf9c0bc7b7fcb538391e6f3606bd7970b8769445606ada47adcdcfc1e991e25caf272a13e10c94
-
C:\Users\Admin\AppData\Local\Temp\SETUP_4199\Setup.txtFilesize
2KB
MD5ae90fca8c12f2c43c468fbd0954381f7
SHA1d475bb8f5891ab5f4c7cd2c90847cbfa68758842
SHA256d9f67a975a877aa95e76821542311adb21704988d8452916d5b51feeeff3e720
SHA5126880c7b658b7852bfcd597a57fd6e85f8a218e18d7acc248edc8efb2bea5a61063c4eeb5ae48008cc07408501c1af0eefc6a9010820ba823ab3fe66dae1f9041
-
memory/964-160-0x0000000000000000-mapping.dmp
-
memory/1280-142-0x0000000000000000-mapping.dmp
-
memory/1904-152-0x0000000006CD0000-0x0000000006CF2000-memory.dmpFilesize
136KB
-
memory/1904-151-0x0000000006C80000-0x0000000006C9A000-memory.dmpFilesize
104KB
-
memory/1904-146-0x00000000057E0000-0x0000000005802000-memory.dmpFilesize
136KB
-
memory/1904-147-0x0000000006110000-0x0000000006176000-memory.dmpFilesize
408KB
-
memory/1904-148-0x0000000006180000-0x00000000061E6000-memory.dmpFilesize
408KB
-
memory/1904-149-0x0000000006790000-0x00000000067AE000-memory.dmpFilesize
120KB
-
memory/1904-150-0x0000000007950000-0x00000000079E6000-memory.dmpFilesize
600KB
-
memory/1904-143-0x0000000000000000-mapping.dmp
-
memory/1904-145-0x0000000005970000-0x0000000005F98000-memory.dmpFilesize
6.2MB
-
memory/1904-153-0x0000000007FA0000-0x0000000008544000-memory.dmpFilesize
5.6MB
-
memory/1904-144-0x0000000002E60000-0x0000000002E96000-memory.dmpFilesize
216KB
-
memory/2228-158-0x0000000000000000-mapping.dmp
-
memory/2348-141-0x0000000000000000-mapping.dmp
-
memory/2776-154-0x0000000000000000-mapping.dmp
-
memory/3612-157-0x0000000000000000-mapping.dmp
-
memory/3800-167-0x0000000006720000-0x00000000068E2000-memory.dmpFilesize
1.8MB
-
memory/3800-170-0x0000000006AF0000-0x0000000006B0E000-memory.dmpFilesize
120KB
-
memory/3800-173-0x0000000007B20000-0x0000000007B70000-memory.dmpFilesize
320KB
-
memory/3800-172-0x0000000007800000-0x000000000783C000-memory.dmpFilesize
240KB
-
memory/3800-163-0x0000000000000000-mapping.dmp
-
memory/3800-164-0x0000000000800000-0x00000000008A6000-memory.dmpFilesize
664KB
-
memory/3800-166-0x0000000004D90000-0x0000000004E22000-memory.dmpFilesize
584KB
-
memory/3800-171-0x00000000077A0000-0x00000000077B2000-memory.dmpFilesize
72KB
-
memory/3800-168-0x00000000065D0000-0x0000000006646000-memory.dmpFilesize
472KB
-
memory/3800-169-0x0000000006E20000-0x000000000734C000-memory.dmpFilesize
5.2MB
-
memory/4244-174-0x0000000000000000-mapping.dmp
-
memory/4468-136-0x0000000000400000-0x0000000000558000-memory.dmpFilesize
1.3MB
-
memory/4468-132-0x0000000000000000-mapping.dmp
-
memory/4468-162-0x0000000000400000-0x0000000000558000-memory.dmpFilesize
1.3MB
-
memory/4468-161-0x0000000000400000-0x0000000000558000-memory.dmpFilesize
1.3MB