Overview
overview
9Static
static
7Meta Unban...er.exe
windows7-x64
9Meta Unban...er.exe
windows10-2004-x64
9Meta Unban...EL.exe
windows7-x64
9Meta Unban...EL.exe
windows10-2004-x64
9Meta Unban...er.exe
windows7-x64
9Meta Unban...er.exe
windows10-2004-x64
9Meta Unban...er.exe
windows7-x64
8Meta Unban...er.exe
windows10-2004-x64
8Meta Unban...er.exe
windows7-x64
9Meta Unban...er.exe
windows10-2004-x64
9Meta Unban...er.bat
windows7-x64
8Meta Unban...er.bat
windows10-2004-x64
8Meta Unban...er.bat
windows7-x64
1Meta Unban...er.bat
windows10-2004-x64
1Meta Unban...er.exe
windows7-x64
7Meta Unban...er.exe
windows10-2004-x64
7Meta Unban...ol.bat
windows7-x64
8Meta Unban...ol.bat
windows10-2004-x64
8Meta Unban...an.exe
windows7-x64
1Meta Unban...an.exe
windows10-2004-x64
1Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2023 04:50
Behavioral task
behavioral1
Sample
Meta Unban/Cleaners/AppleCleaner.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Meta Unban/Cleaners/AppleCleaner.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Meta Unban/Cleaners/AppleS5-DEL.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Meta Unban/Cleaners/AppleS5-DEL.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Meta Unban/Cleaners/BadwareCleaner.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Meta Unban/Cleaners/BadwareCleaner.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Meta Unban/Cleaners/BadwareDeepCleaner.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Meta Unban/Cleaners/BadwareDeepCleaner.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Meta Unban/Cleaners/EventCleaner.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Meta Unban/Cleaners/EventCleaner.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
Meta Unban/Cleaners/Fivem-Cleaner.bat
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Meta Unban/Cleaners/Fivem-Cleaner.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Meta Unban/Cleaners/FortniteCleaner.bat
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Meta Unban/Cleaners/FortniteCleaner.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Meta Unban/Cleaners/NXTcleaner.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Meta Unban/Cleaners/NXTcleaner.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Meta Unban/Cleaners/full deep cleaner by nigga mhatt lol.bat
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Meta Unban/Cleaners/full deep cleaner by nigga mhatt lol.bat
Resource
win10v2004-20230221-en
Behavioral task
behavioral19
Sample
Meta Unban/Meta Unban.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Meta Unban/Meta Unban.exe
Resource
win10v2004-20230220-en
General
-
Target
Meta Unban/Cleaners/Fivem-Cleaner.bat
-
Size
1KB
-
MD5
74e7b9574aea7d121519ceaa8f5cb522
-
SHA1
97b634ef75ce87383ec4d5344e84e7abda65a523
-
SHA256
2e4462f3d686ccfff602b779941ff385144ed683d638b2ed49d552f88df88639
-
SHA512
a7dec954de38bb44478c0cec51fdb111f98ecd02587dd25dfb46a641cdc3c95554985216d5dff8cc81a077c2d1808061e033a4a30084d948226917c4ed98913a
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe -
Stops running service(s) 3 TTPs
-
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1744 sc.exe 3780 sc.exe 448 sc.exe 4780 sc.exe 4604 sc.exe 4580 sc.exe 4696 sc.exe 4664 sc.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2288 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 460 powershell.exe 460 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 460 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
cmd.exedescription pid process target process PID 1240 wrote to memory of 460 1240 cmd.exe powershell.exe PID 1240 wrote to memory of 460 1240 cmd.exe powershell.exe PID 1240 wrote to memory of 1744 1240 cmd.exe sc.exe PID 1240 wrote to memory of 1744 1240 cmd.exe sc.exe PID 1240 wrote to memory of 3780 1240 cmd.exe sc.exe PID 1240 wrote to memory of 3780 1240 cmd.exe sc.exe PID 1240 wrote to memory of 448 1240 cmd.exe sc.exe PID 1240 wrote to memory of 448 1240 cmd.exe sc.exe PID 1240 wrote to memory of 4780 1240 cmd.exe sc.exe PID 1240 wrote to memory of 4780 1240 cmd.exe sc.exe PID 1240 wrote to memory of 4604 1240 cmd.exe sc.exe PID 1240 wrote to memory of 4604 1240 cmd.exe sc.exe PID 1240 wrote to memory of 4580 1240 cmd.exe sc.exe PID 1240 wrote to memory of 4580 1240 cmd.exe sc.exe PID 1240 wrote to memory of 4696 1240 cmd.exe sc.exe PID 1240 wrote to memory of 4696 1240 cmd.exe sc.exe PID 1240 wrote to memory of 4664 1240 cmd.exe sc.exe PID 1240 wrote to memory of 4664 1240 cmd.exe sc.exe PID 1240 wrote to memory of 2632 1240 cmd.exe reg.exe PID 1240 wrote to memory of 2632 1240 cmd.exe reg.exe PID 1240 wrote to memory of 4612 1240 cmd.exe schtasks.exe PID 1240 wrote to memory of 4612 1240 cmd.exe schtasks.exe PID 1240 wrote to memory of 4656 1240 cmd.exe schtasks.exe PID 1240 wrote to memory of 4656 1240 cmd.exe schtasks.exe PID 1240 wrote to memory of 4620 1240 cmd.exe reg.exe PID 1240 wrote to memory of 4620 1240 cmd.exe reg.exe PID 1240 wrote to memory of 2288 1240 cmd.exe timeout.exe PID 1240 wrote to memory of 2288 1240 cmd.exe timeout.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Meta Unban\Cleaners\Fivem-Cleaner.bat"1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {Get-AppxPackage -AllUsers xbox | Remove-AppxPackage}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exesc stop XblAuthManager2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop XblGameSave2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop XboxNetApiSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop XboxGipSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete XblAuthManager2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete XblGameSave2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete XboxNetApiSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete XboxGipSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\xbgm" /f2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /disable2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\XblGameSave\XblGameSaveTaskLogon" /disableL2⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\timeout.exetimeout /T 32⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pduiiuq3.zh3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/460-133-0x000001929BFB0000-0x000001929BFD2000-memory.dmpFilesize
136KB
-
memory/460-143-0x000001929BFA0000-0x000001929BFB0000-memory.dmpFilesize
64KB
-
memory/460-145-0x000001929BFA0000-0x000001929BFB0000-memory.dmpFilesize
64KB
-
memory/460-144-0x000001929BFA0000-0x000001929BFB0000-memory.dmpFilesize
64KB
-
memory/460-146-0x00000192B58C0000-0x00000192B58D6000-memory.dmpFilesize
88KB
-
memory/460-147-0x00000192B58E0000-0x00000192B58EA000-memory.dmpFilesize
40KB
-
memory/460-148-0x00000192B5B80000-0x00000192B5BA6000-memory.dmpFilesize
152KB