Overview

overview

7

Static

static

1

CCleaner P...or.cmd

windows7-x64

1

CCleaner P...or.cmd

windows10-2004-x64

1

CCleaner P...22.exe

windows7-x64

7

CCleaner P...22.exe

windows10-2004-x64

7

CCleaner P...ro.exe

windows7-x64

7

CCleaner P...ro.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CCleaner Professional 6.10.10347 (x64) Multilingual [FileCR].zip

  • Size

    46.4MB

  • Sample

    230316-avvrqagb23

  • MD5

    7af447f6774fe007bad6f9956cc000fe

  • SHA1

    c2527293575d31dd2d90568b4422d01199e8db5e

  • SHA256

    fdac24d79b525dc3c6d348e4be7b54f428de51c90dd8103d0bff7ba5ad38d9d1

  • SHA512

    a7a148fc9ad6705d0c84344fca6cf22a3e6146e8710bb98fc37af82cc665fe290a81b486b6243d1014dde8157888d168cff21df093324ca96ea7473fefeb77a4

  • SSDEEP

    786432:2PEh24gfY67mpN93WWBLXDVJLG6yT4dkehy6jqM/c6KSP1BFghKKmXEWVrH:2MA4xmQHL7yU3hyWVt932kHVT

Score
7/10
bootkitpersistence

Malware Config

Targets

    • Target

      CCleaner Professional 6.10.10347 (x64) Multilingual/Patch22/0 - Piriform-BlockerKeyVerificator_RunAsAdministrator.cmd

    • Size

      4KB

    • MD5

      6ba5c46261ff52e7438f21ccef5f8c7e

    • SHA1

      acdf309fbfebecb7a93b78068fc1498fae4d9e62

    • SHA256

      f7d87d0a3977d9ed4ed6eaa2da2fe2aea9564f58cf062f828dec0aa21d9ec11e

    • SHA512

      106b05fbeca31c78e5e5f33cbd62580aac1b4ef781a78ac2cbe80f92eb01f75beeaa480772dcf2f9f2bbea178e681aff2247dd3d08387b35ca507b90b4a5cc43

    • SSDEEP

      96:zGXTD6E4YsQlPtYyjZW0vQH5aROc37gC9r2of6:zeDn4YsQlPtYyjZW0vQH5aROc37gC9rA

    Score
    1/10
    behavioral1behavioral2

    • Target

      CCleaner Professional 6.10.10347 (x64) Multilingual/Patch22/CCleaner_Patch22.exe

    • Size

      129KB

    • MD5

      f3f183ba8a3c43dfcbef0396ad5d917b

    • SHA1

      8a6edcfa27a7f29cab0d6e2f0595eec2c8b2c123

    • SHA256

      849d56ebcfdc2cb97c4a7ab9c961c3b7b80700d43963b7db2b6934609de6104d

    • SHA512

      2b997fa759e206ac1576615e048f0f11665c2ae57abe55e780022796c02214aaf66fbe6d7ea37152908f833ab8c6ddbdf9a53fa96910f499aa9850e6e3170c77

    • SSDEEP

      3072:uNDCOSp3CvdHOcJn+UAQBRnLEH+JkMZOuYfc0WN:kSpwlrJiARO+jOVfl

    Score
    7/10

    • Loads dropped DLL

    behavioral3behavioral4

    • Target

      CCleaner Professional 6.10.10347 (x64) Multilingual/ccsetup610_pro.exe

    • Size

      46.3MB

    • MD5

      47fcf38aa648f075e1a872d35fcde7fd

    • SHA1

      aea441a1d9faa616ac053a5c6fd82241a469c861

    • SHA256

      355e3485eaff0c67e00ac23b344d3fe97ca0ab78a2a628ae18cbedcc3cf018a0

    • SHA512

      353e5dbdcf56f11b2ae6677dce0d5cf74e198100d125bf5a9a62340b392d50b58d87f912c14150598777a5fba0dd072a5943ac370fb560fed85b7f225c76e88b

    • SSDEEP

      786432:PXO1dzu3xcBO1hXHcKhQ2ok+ilNPnvfYzfUdh5DmjsE1qb9lY2/xFY7:PXAdG0EhMKhQ2Z5lN/XYzsdcscqb9js

    Score
    7/10
    bootkitpersistence

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks