ff9c244cef030284f53f8fcd718410956061d095c562281b7b597af594d0909f

Analysis

max time kernel
121s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2023, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BetterVjoy/! Driver Uninstall (Run as Admin).bat
Size

375B
MD5

3f57d7460905eacb9f7c3296a1df618a
SHA1

8b86e83bba02268ebbb663dfffb3ae0d98825b8f
SHA256

64c58ddfda8075ab7a41c0e21250fc571b3a273b636b4d8f73ac76e18920bf65
SHA512

676a9e02a3821b952e36c7329e1e15eb11ea6fa31637c6fa0fe48459d61606230c9bfc106f9af8b72bb257696a988d3262550ef30a58c7e72f28c2373d8e9c98

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	devcon.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4360	4368	cmd.exe	85
PID 4368 wrote to memory of 4360	4368	cmd.exe	85
PID 4368 wrote to memory of 4648	4368	cmd.exe	86
PID 4368 wrote to memory of 4648	4368	cmd.exe	86
PID 4368 wrote to memory of 952	4368	cmd.exe	87
PID 4368 wrote to memory of 952	4368	cmd.exe	87
PID 4368 wrote to memory of 2612	4368	cmd.exe	88
PID 4368 wrote to memory of 2612	4368	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BetterVjoy\! Driver Uninstall (Run as Admin).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\BetterVjoy\Drivers\devcon.exe
  devcon.exe remove Root\ViGEmBus
  2⤵
  - Checks SCSI registry key(s)
  PID:4360
- C:\Users\Admin\AppData\Local\Temp\BetterVjoy\Drivers\HidCerberus.Srv\HidCerberus.Srv.exe
  HidCerberus.Srv.exe uninstall
  2⤵
  PID:4648
- C:\Users\Admin\AppData\Local\Temp\BetterVjoy\Drivers\devcon.exe
  devcon.exe remove Root\HidGuardian
  2⤵
  - Checks SCSI registry key(s)
  PID:952
- C:\Users\Admin\AppData\Local\Temp\BetterVjoy\Drivers\devcon.exe
  devcon.exe classfilter HIDClass upper !HidGuardian
  2⤵
  PID:2612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4648-133-0x0000027FF7A30000-0x0000027FF7AC8000-memory.dmp

Filesize
608KB

Download
memory/4648-134-0x0000027FF9FE0000-0x0000027FF9FF0000-memory.dmp

Filesize
64KB

Download