Overview
overview
9Static
static
7Meta Unban...er.exe
windows7-x64
9Meta Unban...er.exe
windows10-2004-x64
9Meta Unban...EL.exe
windows7-x64
9Meta Unban...EL.exe
windows10-2004-x64
9Meta Unban...er.exe
windows7-x64
9Meta Unban...er.exe
windows10-2004-x64
9Meta Unban...er.exe
windows7-x64
8Meta Unban...er.exe
windows10-2004-x64
8Meta Unban...er.exe
windows7-x64
9Meta Unban...er.exe
windows10-2004-x64
9Meta Unban...er.bat
windows7-x64
8Meta Unban...er.bat
windows10-2004-x64
8Meta Unban...er.bat
windows7-x64
1Meta Unban...er.bat
windows10-2004-x64
1Meta Unban...er.exe
windows7-x64
7Meta Unban...er.exe
windows10-2004-x64
7Meta Unban...ol.bat
windows7-x64
8Meta Unban...ol.bat
windows10-2004-x64
8Meta Unban...an.exe
windows7-x64
1Meta Unban...an.exe
windows10-2004-x64
1Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-03-2023 04:50
Behavioral task
behavioral1
Sample
Meta Unban/Cleaners/AppleCleaner.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Meta Unban/Cleaners/AppleCleaner.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Meta Unban/Cleaners/AppleS5-DEL.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Meta Unban/Cleaners/AppleS5-DEL.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Meta Unban/Cleaners/BadwareCleaner.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Meta Unban/Cleaners/BadwareCleaner.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Meta Unban/Cleaners/BadwareDeepCleaner.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Meta Unban/Cleaners/BadwareDeepCleaner.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Meta Unban/Cleaners/EventCleaner.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Meta Unban/Cleaners/EventCleaner.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
Meta Unban/Cleaners/Fivem-Cleaner.bat
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Meta Unban/Cleaners/Fivem-Cleaner.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Meta Unban/Cleaners/FortniteCleaner.bat
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Meta Unban/Cleaners/FortniteCleaner.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Meta Unban/Cleaners/NXTcleaner.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Meta Unban/Cleaners/NXTcleaner.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Meta Unban/Cleaners/full deep cleaner by nigga mhatt lol.bat
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Meta Unban/Cleaners/full deep cleaner by nigga mhatt lol.bat
Resource
win10v2004-20230221-en
Behavioral task
behavioral19
Sample
Meta Unban/Meta Unban.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Meta Unban/Meta Unban.exe
Resource
win10v2004-20230220-en
General
-
Target
Meta Unban/Cleaners/Fivem-Cleaner.bat
-
Size
1KB
-
MD5
74e7b9574aea7d121519ceaa8f5cb522
-
SHA1
97b634ef75ce87383ec4d5344e84e7abda65a523
-
SHA256
2e4462f3d686ccfff602b779941ff385144ed683d638b2ed49d552f88df88639
-
SHA512
a7dec954de38bb44478c0cec51fdb111f98ecd02587dd25dfb46a641cdc3c95554985216d5dff8cc81a077c2d1808061e033a4a30084d948226917c4ed98913a
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe -
Stops running service(s) 3 TTPs
-
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 680 sc.exe 520 sc.exe 468 sc.exe 1344 sc.exe 1156 sc.exe 2040 sc.exe 1776 sc.exe 824 sc.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1848 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1756 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1756 powershell.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
cmd.exedescription pid process target process PID 1996 wrote to memory of 1756 1996 cmd.exe powershell.exe PID 1996 wrote to memory of 1756 1996 cmd.exe powershell.exe PID 1996 wrote to memory of 1756 1996 cmd.exe powershell.exe PID 1996 wrote to memory of 680 1996 cmd.exe sc.exe PID 1996 wrote to memory of 680 1996 cmd.exe sc.exe PID 1996 wrote to memory of 680 1996 cmd.exe sc.exe PID 1996 wrote to memory of 520 1996 cmd.exe sc.exe PID 1996 wrote to memory of 520 1996 cmd.exe sc.exe PID 1996 wrote to memory of 520 1996 cmd.exe sc.exe PID 1996 wrote to memory of 468 1996 cmd.exe sc.exe PID 1996 wrote to memory of 468 1996 cmd.exe sc.exe PID 1996 wrote to memory of 468 1996 cmd.exe sc.exe PID 1996 wrote to memory of 1344 1996 cmd.exe sc.exe PID 1996 wrote to memory of 1344 1996 cmd.exe sc.exe PID 1996 wrote to memory of 1344 1996 cmd.exe sc.exe PID 1996 wrote to memory of 1156 1996 cmd.exe sc.exe PID 1996 wrote to memory of 1156 1996 cmd.exe sc.exe PID 1996 wrote to memory of 1156 1996 cmd.exe sc.exe PID 1996 wrote to memory of 2040 1996 cmd.exe sc.exe PID 1996 wrote to memory of 2040 1996 cmd.exe sc.exe PID 1996 wrote to memory of 2040 1996 cmd.exe sc.exe PID 1996 wrote to memory of 1776 1996 cmd.exe sc.exe PID 1996 wrote to memory of 1776 1996 cmd.exe sc.exe PID 1996 wrote to memory of 1776 1996 cmd.exe sc.exe PID 1996 wrote to memory of 824 1996 cmd.exe sc.exe PID 1996 wrote to memory of 824 1996 cmd.exe sc.exe PID 1996 wrote to memory of 824 1996 cmd.exe sc.exe PID 1996 wrote to memory of 624 1996 cmd.exe reg.exe PID 1996 wrote to memory of 624 1996 cmd.exe reg.exe PID 1996 wrote to memory of 624 1996 cmd.exe reg.exe PID 1996 wrote to memory of 548 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 548 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 548 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 1608 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 1608 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 1608 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 872 1996 cmd.exe reg.exe PID 1996 wrote to memory of 872 1996 cmd.exe reg.exe PID 1996 wrote to memory of 872 1996 cmd.exe reg.exe PID 1996 wrote to memory of 1848 1996 cmd.exe timeout.exe PID 1996 wrote to memory of 1848 1996 cmd.exe timeout.exe PID 1996 wrote to memory of 1848 1996 cmd.exe timeout.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Meta Unban\Cleaners\Fivem-Cleaner.bat"1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {Get-AppxPackage -AllUsers xbox | Remove-AppxPackage}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exesc stop XblAuthManager2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop XblGameSave2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop XboxNetApiSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop XboxGipSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete XblAuthManager2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete XblGameSave2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete XboxNetApiSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete XboxGipSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\xbgm" /f2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /disable2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\XblGameSave\XblGameSaveTaskLogon" /disableL2⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\timeout.exetimeout /T 32⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1756-58-0x000000001B220000-0x000000001B502000-memory.dmpFilesize
2.9MB
-
memory/1756-59-0x00000000022A0000-0x00000000022A8000-memory.dmpFilesize
32KB
-
memory/1756-60-0x00000000026D0000-0x0000000002750000-memory.dmpFilesize
512KB
-
memory/1756-62-0x00000000026D0000-0x0000000002750000-memory.dmpFilesize
512KB
-
memory/1756-61-0x00000000026D0000-0x0000000002750000-memory.dmpFilesize
512KB
-
memory/1756-63-0x00000000026DB000-0x0000000002712000-memory.dmpFilesize
220KB