Analysis
-
max time kernel
30s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2023 22:51
Static task
static1
Behavioral task
behavioral1
Sample
Dox Tool V3 Cracked/Dox Tool V3 Cracked/Dox Tool V3 Cracked/Dox Tool V3 Cracked.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral2
Sample
Dox Tool V3 Cracked/Dox Tool V3 Cracked/Dox Tool V3 Cracked/data/Launcher.exe
Resource
win10v2004-20230220-en
General
-
Target
Dox Tool V3 Cracked/Dox Tool V3 Cracked/Dox Tool V3 Cracked/data/Launcher.exe
-
Size
53KB
-
MD5
c6d4c881112022eb30725978ecd7c6ec
-
SHA1
ba4f96dc374195d873b3eebdb28b633d9a1c5bf5
-
SHA256
0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32
-
SHA512
3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981
-
SSDEEP
768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Launcher.exeWindows Services.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation Windows Services.exe -
Drops startup file 1 IoCs
Processes:
Launcher.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk Launcher.exe -
Executes dropped EXE 3 IoCs
Processes:
Windows Services.exeSecure System Shell.exeRuntime Explorer.exepid process 452 Windows Services.exe 3916 Secure System Shell.exe 2144 Runtime Explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Launcher.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "C:\\Windows\\IMF\\\\Windows Services.exe" Launcher.exe -
Drops file in Windows directory 9 IoCs
Processes:
Launcher.exedescription ioc process File opened for modification C:\Windows\IMF\Runtime Explorer.exe Launcher.exe File created C:\Windows\IMF\Secure System Shell.exe.tmp Launcher.exe File created C:\Windows\IMF\Runtime Explorer.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Secure System Shell.exe Launcher.exe File created C:\Windows\IMF\Windows Services.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Windows Services.exe Launcher.exe File created C:\Windows\IMF\LICENCE.zip Launcher.exe File opened for modification C:\Windows\IMF\LICENCE.zip Launcher.exe File created C:\Windows\IMF\LICENCE.dat Launcher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Launcher.exepowershell.exeWindows Services.exeSecure System Shell.exepid process 560 Launcher.exe 3944 powershell.exe 3944 powershell.exe 452 Windows Services.exe 452 Windows Services.exe 452 Windows Services.exe 452 Windows Services.exe 3916 Secure System Shell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Launcher.exepowershell.exeWindows Services.exeSecure System Shell.exedescription pid process Token: SeDebugPrivilege 560 Launcher.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeDebugPrivilege 452 Windows Services.exe Token: SeDebugPrivilege 3916 Secure System Shell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Runtime Explorer.exepid process 2144 Runtime Explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Launcher.exeWindows Services.exedescription pid process target process PID 560 wrote to memory of 3944 560 Launcher.exe powershell.exe PID 560 wrote to memory of 3944 560 Launcher.exe powershell.exe PID 560 wrote to memory of 3944 560 Launcher.exe powershell.exe PID 560 wrote to memory of 452 560 Launcher.exe Windows Services.exe PID 560 wrote to memory of 452 560 Launcher.exe Windows Services.exe PID 560 wrote to memory of 452 560 Launcher.exe Windows Services.exe PID 452 wrote to memory of 3916 452 Windows Services.exe Secure System Shell.exe PID 452 wrote to memory of 3916 452 Windows Services.exe Secure System Shell.exe PID 452 wrote to memory of 3916 452 Windows Services.exe Secure System Shell.exe PID 452 wrote to memory of 2144 452 Windows Services.exe Runtime Explorer.exe PID 452 wrote to memory of 2144 452 Windows Services.exe Runtime Explorer.exe PID 452 wrote to memory of 2144 452 Windows Services.exe Runtime Explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dox Tool V3 Cracked\Dox Tool V3 Cracked\Dox Tool V3 Cracked\data\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Dox Tool V3 Cracked\Dox Tool V3 Cracked\Dox Tool V3 Cracked\data\Launcher.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\IMF\Windows Services.exe"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\IMF\Secure System Shell.exe"C:\Windows\IMF\Secure System Shell.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ehc0f4c0.shd.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\IMF\Runtime Explorer.exeFilesize
144KB
MD54ba07be2ec317b44d19a4f6174d7a62a
SHA16d428270ee7d27781321d68387e2b6490fd1b59c
SHA256d012c4325f27ad7d13fdb4f29a023e4a32f1105c6e5028ea3fbb1e91279e0be6
SHA512e0b38cc32421b64721dc2968fa8499837822bb77523c51e253b1c49131d6b3efdddda604db83c81c44d7b3528b2afed0bdc7ceeceeff738d21a7d041ed5410ce
-
C:\Windows\IMF\Runtime Explorer.exeFilesize
144KB
MD54ba07be2ec317b44d19a4f6174d7a62a
SHA16d428270ee7d27781321d68387e2b6490fd1b59c
SHA256d012c4325f27ad7d13fdb4f29a023e4a32f1105c6e5028ea3fbb1e91279e0be6
SHA512e0b38cc32421b64721dc2968fa8499837822bb77523c51e253b1c49131d6b3efdddda604db83c81c44d7b3528b2afed0bdc7ceeceeff738d21a7d041ed5410ce
-
C:\Windows\IMF\Runtime Explorer.exeFilesize
144KB
MD54ba07be2ec317b44d19a4f6174d7a62a
SHA16d428270ee7d27781321d68387e2b6490fd1b59c
SHA256d012c4325f27ad7d13fdb4f29a023e4a32f1105c6e5028ea3fbb1e91279e0be6
SHA512e0b38cc32421b64721dc2968fa8499837822bb77523c51e253b1c49131d6b3efdddda604db83c81c44d7b3528b2afed0bdc7ceeceeff738d21a7d041ed5410ce
-
C:\Windows\IMF\Secure System Shell.exeFilesize
45KB
MD57d0c7359e5b2daa5665d01afdc98cc00
SHA1c3cc830c8ffd0f53f28d89dcd9f3426be87085cb
SHA256f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809
SHA512a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407
-
C:\Windows\IMF\Secure System Shell.exeFilesize
45KB
MD57d0c7359e5b2daa5665d01afdc98cc00
SHA1c3cc830c8ffd0f53f28d89dcd9f3426be87085cb
SHA256f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809
SHA512a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407
-
C:\Windows\IMF\Secure System Shell.exeFilesize
45KB
MD57d0c7359e5b2daa5665d01afdc98cc00
SHA1c3cc830c8ffd0f53f28d89dcd9f3426be87085cb
SHA256f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809
SHA512a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407
-
C:\Windows\IMF\Windows Services.exeFilesize
46KB
MD5ad0ce1302147fbdfecaec58480eb9cf9
SHA1874efbc76e5f91bc1425a43ea19400340f98d42b
SHA2562c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3
SHA512adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53
-
C:\Windows\IMF\Windows Services.exeFilesize
46KB
MD5ad0ce1302147fbdfecaec58480eb9cf9
SHA1874efbc76e5f91bc1425a43ea19400340f98d42b
SHA2562c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3
SHA512adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53
-
C:\Windows\IMF\Windows Services.exeFilesize
46KB
MD5ad0ce1302147fbdfecaec58480eb9cf9
SHA1874efbc76e5f91bc1425a43ea19400340f98d42b
SHA2562c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3
SHA512adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53
-
memory/452-227-0x0000000003180000-0x0000000003190000-memory.dmpFilesize
64KB
-
memory/452-217-0x0000000003180000-0x0000000003190000-memory.dmpFilesize
64KB
-
memory/452-195-0x0000000000F30000-0x0000000000F42000-memory.dmpFilesize
72KB
-
memory/560-133-0x0000000000960000-0x0000000000974000-memory.dmpFilesize
80KB
-
memory/560-134-0x00000000058A0000-0x0000000005E44000-memory.dmpFilesize
5.6MB
-
memory/560-135-0x00000000051F0000-0x0000000005282000-memory.dmpFilesize
584KB
-
memory/560-136-0x00000000052B0000-0x00000000052BA000-memory.dmpFilesize
40KB
-
memory/560-137-0x0000000006840000-0x00000000068BE000-memory.dmpFilesize
504KB
-
memory/560-139-0x0000000002AB0000-0x0000000002AC0000-memory.dmpFilesize
64KB
-
memory/560-178-0x0000000006420000-0x0000000006496000-memory.dmpFilesize
472KB
-
memory/560-179-0x0000000006400000-0x000000000641E000-memory.dmpFilesize
120KB
-
memory/560-138-0x0000000002AB0000-0x0000000002AC0000-memory.dmpFilesize
64KB
-
memory/3916-213-0x0000000000100000-0x0000000000112000-memory.dmpFilesize
72KB
-
memory/3916-220-0x0000000004930000-0x0000000004940000-memory.dmpFilesize
64KB
-
memory/3916-228-0x0000000004930000-0x0000000004940000-memory.dmpFilesize
64KB
-
memory/3944-208-0x0000000007FE0000-0x000000000865A000-memory.dmpFilesize
6.5MB
-
memory/3944-143-0x0000000002E10000-0x0000000002E20000-memory.dmpFilesize
64KB
-
memory/3944-207-0x0000000006C30000-0x0000000006C4E000-memory.dmpFilesize
120KB
-
memory/3944-193-0x0000000002E10000-0x0000000002E20000-memory.dmpFilesize
64KB
-
memory/3944-210-0x00000000079A0000-0x00000000079BA000-memory.dmpFilesize
104KB
-
memory/3944-142-0x00000000058E0000-0x0000000005F08000-memory.dmpFilesize
6.2MB
-
memory/3944-156-0x00000000066A0000-0x00000000066BE000-memory.dmpFilesize
120KB
-
memory/3944-141-0x0000000002E10000-0x0000000002E20000-memory.dmpFilesize
64KB
-
memory/3944-146-0x0000000005F10000-0x0000000005F76000-memory.dmpFilesize
408KB
-
memory/3944-197-0x000000006FF80000-0x000000006FFCC000-memory.dmpFilesize
304KB
-
memory/3944-215-0x0000000007A10000-0x0000000007A1A000-memory.dmpFilesize
40KB
-
memory/3944-145-0x0000000005770000-0x00000000057D6000-memory.dmpFilesize
408KB
-
memory/3944-219-0x000000007FBF0000-0x000000007FC00000-memory.dmpFilesize
64KB
-
memory/3944-196-0x0000000006C50000-0x0000000006C82000-memory.dmpFilesize
200KB
-
memory/3944-221-0x0000000007C20000-0x0000000007CB6000-memory.dmpFilesize
600KB
-
memory/3944-222-0x0000000007BD0000-0x0000000007BDE000-memory.dmpFilesize
56KB
-
memory/3944-223-0x0000000007CE0000-0x0000000007CFA000-memory.dmpFilesize
104KB
-
memory/3944-224-0x0000000007CC0000-0x0000000007CC8000-memory.dmpFilesize
32KB
-
memory/3944-144-0x00000000056D0000-0x00000000056F2000-memory.dmpFilesize
136KB
-
memory/3944-140-0x0000000002D80000-0x0000000002DB6000-memory.dmpFilesize
216KB