Overview

overview

10

Static

static

1

client-build.exe

windows10-2004-x64

Analysis

  • max time kernel
    64s
  • max time network
    67s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-03-2023 15:29

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    client-build.exe

  • Size

    188KB

  • MD5

    dd4b8d7343f7b501e007d7a4a213f369

  • SHA1

    57a4dfee61da70e01440a830012a5aac504e1e67

  • SHA256

    35caa5bc493c105d3632410ec3dc5b26f85cb857dfd2f27248757d93adcde58e

  • SHA512

    4f53e26356ad4220e3ca0c9918e7daa8c3603a26f9d69c281938249783a0a727b67ccf7719eb76129c5df219028368cfba65cc9a995233a3ae0a4a38636b9548

  • SSDEEP

    3072:ob7oLMsF/yePO0m5IKOP1yr075XQODG4sp61V8F4Bp7r9QoSHtAYVoURdlIExQpv:obsLMRGOh2twrsDTspL4v7+NFBoH

Score
10/10
persistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\client-build.exe
    "C:\Users\Admin\AppData\Local\Temp\client-build.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client white-camcorders.at.ply.gg 13883 DNHUAF
      2⤵
        PID:4728
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client white-camcorders.at.ply.gg 13883 DNHUAF
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4744
        • C:\Windows\SysWOW64\shutdown.exe
          "C:\Windows\System32\shutdown.exe" /s /t 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1624
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3920
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2956
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3941855 /state1:0x41c64e6d
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:1256

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133225074103654732.txt
      Filesize

      75KB

      MD5

      65019a5db517d9fb830d8a57406a03ea

      SHA1

      817faf2ffe8461f653519e7bd96e7ee75021c891

      SHA256

      3ae88b3a99e6b785bdb44760790bc03ac722ef5b673ad5b3ca49b5cc5eecf84f

      SHA512

      bcc985d3fa48efcbb4a334b1a341a6686ef6c69f237d6d9bdcd9885696d148519ab824b9150194d783cb03189c1cc00a483f1b73ebce323f1f6a303a05b8ea62

      Download Submit

    • C:\Users\Admin\AppData\Roaming\temp0923
      Filesize

      10B

      MD5

      34157115c7276724fe7e3131f430ffd1

      SHA1

      8b0ea5e84f07a07ae426116b0d4c1b5538181d8e

      SHA256

      5c6f75d717be30545508f99ffb1f2bdc46fa1b07a4c71b6f77706a950f385946

      SHA512

      c10516d89361239cf6010c99f17ec0328ae5fff592d3065ae7cad2df02994cda6ad6c130a4aa61051ad7fdd6379aca93157f3fbc79f52a85808c2ab95d455fcc

      Download Submit

    • memory/2392-134-0x00000000056E0000-0x0000000005C84000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2392-136-0x00000000051D0000-0x000000000526C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/2392-133-0x00000000006F0000-0x0000000000726000-memory.dmp

      Filesize

      216KB

      Download

    • memory/2956-156-0x000001DA94D20000-0x000001DA94D40000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2956-163-0x000001DA950E0000-0x000001DA95100000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2956-159-0x000001DA949D0000-0x000001DA949F0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3500-150-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4744-137-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/4744-144-0x0000000006830000-0x0000000006880000-memory.dmp

      Filesize

      320KB

      Download

    • memory/4744-141-0x0000000005F70000-0x0000000005FD6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4744-140-0x00000000057B0000-0x00000000057C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4744-286-0x00000000057B0000-0x00000000057C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4744-139-0x0000000005860000-0x00000000058F2000-memory.dmp

      Filesize

      584KB

      Download