3d505dd5081824da4517fbdc2a4da8c6133538b72171e260f59d10be5ed20acb

Analysis

max time kernel
117s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2023 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

360TS_Setup_Mini.exe
Size

1.5MB
MD5

858ee6ceb590822f57d2d98a32e3c5af
SHA1

0cd9e539e919dd0367c1d04e2644bc3e8ad109e5
SHA256

3d505dd5081824da4517fbdc2a4da8c6133538b72171e260f59d10be5ed20acb
SHA512

ad624bba251a6131471a662e31a676c6facb335aef433b0c2313adb57c2ca4701590845c3c237d190a1817fa43daeaaeb3731c91e19045691523cccf9cbbd198
SSDEEP

24576:AD1YS7FpyUxT3DC2O1zj1SqdAGFQZIxvC45UJoenm9x:TQ5xT3DDWzjYq+ZIxL5UJoew

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

360TS_Setup_Mini.exe360TS_Setup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	360TS_Setup_Mini.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	360TS_Setup.exe

Executes dropped EXE 2 IoCs

Processes:

360TS_Setup.exe360TS_Setup.exe

pid process

2548 360TS_Setup.exe
2720 360TS_Setup.exe
Loads dropped DLL 3 IoCs

Processes:

360TS_Setup_Mini.exe360TS_Setup.exe360TS_Setup.exe

pid process

3364 360TS_Setup_Mini.exe
2548 360TS_Setup.exe
2720 360TS_Setup.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

360TS_Setup_Mini.exe360TS_Setup.exe

description ioc process

File opened for modification \??\PhysicalDrive0 360TS_Setup_Mini.exe
File opened for modification \??\PhysicalDrive0 360TS_Setup.exe

pid	process
2548	360TS_Setup.exe
2720	360TS_Setup.exe

pid	process
3364	360TS_Setup_Mini.exe
2548	360TS_Setup.exe
2720	360TS_Setup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	360TS_Setup_Mini.exe
File opened for modification	\??\PhysicalDrive0	360TS_Setup.exe

Drops file in Program Files directory 2 IoCs

Processes:

360TS_Setup.exe

description	ioc	process
File created	C:\Program Files (x86)\1677183122_0\360TS_Setup.exe	360TS_Setup.exe
File opened for modification	C:\Program Files (x86)\1677183122_0\360TS_Setup.exe	360TS_Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

360TS_Setup_Mini.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	360TS_Setup_Mini.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	360TS_Setup_Mini.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

360TS_Setup_Mini.exe

description pid process

Token: SeManageVolumePrivilege 3364 360TS_Setup_Mini.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

360TS_Setup_Mini.exe

pid process

3364 360TS_Setup_Mini.exe
3364 360TS_Setup_Mini.exe
3364 360TS_Setup_Mini.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

360TS_Setup_Mini.exe

pid process

3364 360TS_Setup_Mini.exe
3364 360TS_Setup_Mini.exe
3364 360TS_Setup_Mini.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

360TS_Setup.exe360TS_Setup.exe

pid process

2548 360TS_Setup.exe
2720 360TS_Setup.exe

description	pid	process
Token: SeManageVolumePrivilege	3364	360TS_Setup_Mini.exe

pid	process
3364	360TS_Setup_Mini.exe
3364	360TS_Setup_Mini.exe
3364	360TS_Setup_Mini.exe

pid	process
3364	360TS_Setup_Mini.exe
3364	360TS_Setup_Mini.exe
3364	360TS_Setup_Mini.exe

pid	process
2548	360TS_Setup.exe
2720	360TS_Setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

360TS_Setup_Mini.exe360TS_Setup.exe

description	pid	process	target process
PID 3364 wrote to memory of 2548	3364	360TS_Setup_Mini.exe	360TS_Setup.exe
PID 3364 wrote to memory of 2548	3364	360TS_Setup_Mini.exe	360TS_Setup.exe
PID 3364 wrote to memory of 2548	3364	360TS_Setup_Mini.exe	360TS_Setup.exe
PID 2548 wrote to memory of 2720	2548	360TS_Setup.exe	360TS_Setup.exe
PID 2548 wrote to memory of 2720	2548	360TS_Setup.exe	360TS_Setup.exe
PID 2548 wrote to memory of 2720	2548	360TS_Setup.exe	360TS_Setup.exe

C:\Users\Admin\AppData\Local\Temp\360TS_Setup_Mini.exe
"C:\Users\Admin\AppData\Local\Temp\360TS_Setup_Mini.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364

C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe" /c:101 /pmode:2 /syncid0_1
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548

C:\Program Files (x86)\1677183122_0\360TS_Setup.exe
"C:\Program Files (x86)\1677183122_0\360TS_Setup.exe" /c:101 /pmode:2 /syncid0_1 /TSinstall
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\1677183122_0\360TS_Setup.exe
Filesize
89.4MB

MD5
b52a56cf7aace0e11e9a5030ccbf106f

SHA1
add631030daa94b4ddf086d7c1f9b03dec9fc83b

SHA256
f7ff39a631e2bdcf05d99366e645c40e120981146567c04ccd557e3139266eb4

SHA512
e2b152dcadab68d9ffeb7bfc604d1ea0d1c3c27dfc0bb16d85023a76befec7b484461fab0b4bd24ff59fc20ad643b8027a3e5633fd42eb2bef12f90a685b4832

Download Submit
C:\Program Files (x86)\1677183122_0\360TS_Setup.exe
Filesize
89.4MB

MD5
b52a56cf7aace0e11e9a5030ccbf106f

SHA1
add631030daa94b4ddf086d7c1f9b03dec9fc83b

SHA256
f7ff39a631e2bdcf05d99366e645c40e120981146567c04ccd557e3139266eb4

SHA512
e2b152dcadab68d9ffeb7bfc604d1ea0d1c3c27dfc0bb16d85023a76befec7b484461fab0b4bd24ff59fc20ad643b8027a3e5633fd42eb2bef12f90a685b4832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_90887DD7920637A743EF36CB9A88B5D8
Filesize
2KB

MD5
e2eb39b8eb4abbf9ef1d995bf4686247

SHA1
899a44ecf8b1102ebf66736eaee3b126ff9ca688

SHA256
398aab75624c6a9074fae85fd375ba98c3c48581f483e9d4f70c0ad4941bc891

SHA512
fd617f13a1d67482516fb7a3d65911422585b423bb0a358955e95f08a308b9d79c41b0f918e51d9642edaabc267416124dfde4b67e445aa3c110b2b1ad64c1da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9
Filesize
506B

MD5
703694b4614301e3284daa18c01586e0

SHA1
c3094ef0f76ef8a2e3caaa57ba819b0e507dd7a8

SHA256
7bdd7fb5bcd776812148363356d331f2a30aed1f1a001ee997d335ab59699db3

SHA512
6a734fd07a18c36b8e0c2f9ce4c0f005aa945786913799802e4a54f0070671a9cb430547d7cbbf6379e1961c01f75e7c14027873086c3ada0e5ddb6a476cb6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_90887DD7920637A743EF36CB9A88B5D8
Filesize
488B

MD5
f82d03e5898a3c95d9f5a07cc0f83051

SHA1
e70b05e2a357bd187a15ec9c90d9be1eace8a489

SHA256
a8673739b9328caf1901cdbd88d3b54c07f19f7b1114863df1950c7836b48dc4

SHA512
b3588539f4b54d7f31ea94b7c2c916258b2e104088a19ffb1c7bd6bc48100395ae15a516ee800a4547836a518f67e19608fdd15ca2b7d01254379bf1f29f1890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9
Filesize
248B

MD5
5d393c769dca4181830cc5d5f364c791

SHA1
bff4389166e50e76e3ede24a6370d2a9a8a3ddf4

SHA256
7f15cd323e80b23e52b5a4abce8283ece15e02878b3bfba4161c1f645c4ff43f

SHA512
475ffa33058354182527f40cfc4713ead06cc3e08519489002448d53cd908778fc585c664717ee7afe7c4e7b6eaa38836415e6c28d8714038230f5d73eaf54b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y624AVVJ\opera[1].json
Filesize
33B

MD5
665af392c92468674e12953c713ebc4e

SHA1
d6ae02d3cbd8c37073fe5217b65906664ed65b2c

SHA256
a76f0fd7691a91e4a1275b8ed8bff1d30e7f3018bcf3ed69f165d7e9eec52638

SHA512
c994bdefe2876bfb94cdd0ced7da7f78f70171741de7e84287440f7b4ea4ae682f3e1f81792e8a1888b7471b739167068da49cc1d895cc44c33e18458b137b25

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize
656B

MD5
44dbbbfbec84f14fcbb124c09993f48e

SHA1
ed8bc63069f280258debfa6fec31d02321ad91e9

SHA256
a4787cb9bc9bb318ee4df2927547c8e09505284c14551aeacebf16c4444ea061

SHA512
8e1f8def4b428452eb94b27384a46a457dcb7538e479dc5e3e8ab8bb3849c1dcd6dd92861d208f25e1712f633af1f3385ac683aa5e9640fbee88216bc502f684

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
Filesize
829B

MD5
38e6c5bd3cdefed1534310234d11ad23

SHA1
6904008bce2a72b8ff1cdb4e54c938db834b6a8d

SHA256
1816cdd248e16e80b77ccac34312c491c6b68161a99a6adfbbf2425f177946d0

SHA512
f7d2cdd74fe90fe7f4c09043253969e6694c422a391f35c0846d6cb707689209cd64dc52d129e0b4dd8c56922cb155b40d826a6ea612aee8da05db4af2499976

Download Submit
C:\Users\Admin\AppData\Local\Temp\1677183113_00000000_base\360base.dll
Filesize
884KB

MD5
8c42fc725106cf8276e625b4f97861bc

SHA1
9c4140730cb031c29fc63e17e1504693d0f21c13

SHA256
d1ca92aa0789ee87d45f9f3c63e0e46ad2997b09605cbc2c57da2be6b8488c22

SHA512
f3c33dfe8e482692d068bf2185bec7d0d2bb232e6828b0bc8dc867da9e7ca89f9356fde87244fe686e3830f957c052089a87ecff4e44842a1a7848246f0ba105

Download Submit
C:\Users\Admin\AppData\Local\Temp\1677183113_00000000_base\360base.dll
Filesize
884KB

MD5
8c42fc725106cf8276e625b4f97861bc

SHA1
9c4140730cb031c29fc63e17e1504693d0f21c13

SHA256
d1ca92aa0789ee87d45f9f3c63e0e46ad2997b09605cbc2c57da2be6b8488c22

SHA512
f3c33dfe8e482692d068bf2185bec7d0d2bb232e6828b0bc8dc867da9e7ca89f9356fde87244fe686e3830f957c052089a87ecff4e44842a1a7848246f0ba105

Download Submit
C:\Users\Admin\AppData\Local\Temp\1677183128_00000000_base\360base.dll
Filesize
884KB

MD5
8c42fc725106cf8276e625b4f97861bc

SHA1
9c4140730cb031c29fc63e17e1504693d0f21c13

SHA256
d1ca92aa0789ee87d45f9f3c63e0e46ad2997b09605cbc2c57da2be6b8488c22

SHA512
f3c33dfe8e482692d068bf2185bec7d0d2bb232e6828b0bc8dc867da9e7ca89f9356fde87244fe686e3830f957c052089a87ecff4e44842a1a7848246f0ba105

Download Submit
C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
Filesize
89.4MB

MD5
b52a56cf7aace0e11e9a5030ccbf106f

SHA1
add631030daa94b4ddf086d7c1f9b03dec9fc83b

SHA256
f7ff39a631e2bdcf05d99366e645c40e120981146567c04ccd557e3139266eb4

SHA512
e2b152dcadab68d9ffeb7bfc604d1ea0d1c3c27dfc0bb16d85023a76befec7b484461fab0b4bd24ff59fc20ad643b8027a3e5633fd42eb2bef12f90a685b4832

Download Submit
C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
Filesize
89.4MB

MD5
b52a56cf7aace0e11e9a5030ccbf106f

SHA1
add631030daa94b4ddf086d7c1f9b03dec9fc83b

SHA256
f7ff39a631e2bdcf05d99366e645c40e120981146567c04ccd557e3139266eb4

SHA512
e2b152dcadab68d9ffeb7bfc604d1ea0d1c3c27dfc0bb16d85023a76befec7b484461fab0b4bd24ff59fc20ad643b8027a3e5633fd42eb2bef12f90a685b4832

Download Submit
C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
Filesize
89.4MB

MD5
b52a56cf7aace0e11e9a5030ccbf106f

SHA1
add631030daa94b4ddf086d7c1f9b03dec9fc83b

SHA256
f7ff39a631e2bdcf05d99366e645c40e120981146567c04ccd557e3139266eb4

SHA512
e2b152dcadab68d9ffeb7bfc604d1ea0d1c3c27dfc0bb16d85023a76befec7b484461fab0b4bd24ff59fc20ad643b8027a3e5633fd42eb2bef12f90a685b4832

Download Submit
C:\Users\Admin\AppData\Local\Temp\{8807BEF3-1C42-4df7-8A53-7C8D1FC25762}.tmp
Filesize
3KB

MD5
b1ddd3b1895d9a3013b843b3702ac2bd

SHA1
71349f5c577a3ae8acb5fbce27b18a203bf04ede

SHA256
46cda5ad256bf373f5ed0b2a20efa5275c1ffd96864c33f3727e76a3973f4b3c

SHA512
93e6c10c4a8465bc2e58f4c7eb300860186ddc5734599bcdad130ff9c8fd324443045eac54bbc667b058ac1fa271e5b7645320c6e3fc2f28cc5f824096830de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BF64020D-01B9-4b27-9CF3-7F49367D7914}.tmp\360P2SP.dll
Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BF64020D-01B9-4b27-9CF3-7F49367D7914}.tmp\360P2SP.dll
Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
memory/2720-233-0x00000000082A0000-0x00000000082A1000-memory.dmp

Filesize
4KB

Download
memory/2720-235-0x00000000082A0000-0x00000000082A1000-memory.dmp

Filesize
4KB

Download
memory/3364-146-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download