18a900e972aff001241d8e676c52c94156e3b8d68e0f82d8cd07607f1664bdf1

Resubmissions

21/08/2023, 17:42

230821-v96gzseg78 5

21/08/2023, 17:39

230821-v8b7ragd6v 5

Analysis

max time kernel
119s
max time network
151s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/08/2023, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mindshb.exe
Size

6.6MB
MD5

03a0f731d1fda4521dc912a2cd4f7d04
SHA1

e1e8fa96208ebe91a6259d9f51249098c4d6897e
SHA256

18a900e972aff001241d8e676c52c94156e3b8d68e0f82d8cd07607f1664bdf1
SHA512

2e29551ce0951fe2cc7c6aeb4bff7ff5233634dda12c8d4d36b13caaa7113188d2e6adb07a4d236d16ff783c40f7c7cf886bcb5542cbb43267d01c164c350abd
SSDEEP

98304:n6NB1lxxHcTX+6DxiYmpDl2yK1ERMKdY/RPl+qqKem89lh0vvi9QPyyMxoFpr:631lxx8TO6DxbmhUEh+4KefJOMU

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2096	Mindshb.exe
2096	Mindshb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	2096	WerFault.exe	27

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2444	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2096	Mindshb.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2536	2096	Mindshb.exe	29
PID 2096 wrote to memory of 2536	2096	Mindshb.exe	29
PID 2096 wrote to memory of 2536	2096	Mindshb.exe	29
PID 2536 wrote to memory of 2656	2536	cmd.exe	30
PID 2536 wrote to memory of 2656	2536	cmd.exe	30
PID 2536 wrote to memory of 2656	2536	cmd.exe	30
PID 2536 wrote to memory of 2464	2536	cmd.exe	31
PID 2536 wrote to memory of 2464	2536	cmd.exe	31
PID 2536 wrote to memory of 2464	2536	cmd.exe	31
PID 2536 wrote to memory of 2488	2536	cmd.exe	32
PID 2536 wrote to memory of 2488	2536	cmd.exe	32
PID 2536 wrote to memory of 2488	2536	cmd.exe	32
PID 2096 wrote to memory of 2612	2096	Mindshb.exe	33
PID 2096 wrote to memory of 2612	2096	Mindshb.exe	33
PID 2096 wrote to memory of 2612	2096	Mindshb.exe	33
PID 2612 wrote to memory of 2180	2612	cmd.exe	34
PID 2612 wrote to memory of 2180	2612	cmd.exe	34
PID 2612 wrote to memory of 2180	2612	cmd.exe	34
PID 2096 wrote to memory of 2184	2096	Mindshb.exe	36
PID 2096 wrote to memory of 2184	2096	Mindshb.exe	36
PID 2096 wrote to memory of 2184	2096	Mindshb.exe	36
PID 2180 wrote to memory of 2444	2180	cmd.exe	37
PID 2180 wrote to memory of 2444	2180	cmd.exe	37
PID 2180 wrote to memory of 2444	2180	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\Mindshb.exe
"C:\Users\Admin\AppData\Local\Temp\Mindshb.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mindshb.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mindshb.exe" MD5
    3⤵
    PID:2656
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2464
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: HWID doesn't match. Ask for a HWID reset && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: HWID doesn't match. Ask for a HWID reset && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2096 -s 1228
  2⤵
  - Program crash
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-53-0x0000000077510000-0x0000000077512000-memory.dmp

Filesize
8KB

Download
memory/2096-55-0x000000013FDA0000-0x00000001408D8000-memory.dmp

Filesize
11.2MB

Download
memory/2096-56-0x0000000077510000-0x0000000077512000-memory.dmp

Filesize
8KB

Download
memory/2096-59-0x000000013FDA0000-0x00000001408D8000-memory.dmp

Filesize
11.2MB

Download
memory/2096-61-0x0000000077360000-0x0000000077509000-memory.dmp

Filesize
1.7MB

Download
memory/2096-60-0x0000000077540000-0x0000000077542000-memory.dmp

Filesize
8KB

Download
memory/2096-58-0x0000000077510000-0x0000000077512000-memory.dmp

Filesize
8KB

Download
memory/2096-63-0x0000000077540000-0x0000000077542000-memory.dmp

Filesize
8KB

Download
memory/2096-65-0x0000000077540000-0x0000000077542000-memory.dmp

Filesize
8KB

Download
memory/2096-70-0x000000013FDA0000-0x00000001408D8000-memory.dmp

Filesize
11.2MB

Download
memory/2096-71-0x0000000077360000-0x0000000077509000-memory.dmp

Filesize
1.7MB

Download
memory/2096-72-0x0000000077360000-0x0000000077509000-memory.dmp

Filesize
1.7MB

Download
memory/2096-73-0x000000013FDA0000-0x00000001408D8000-memory.dmp

Filesize
11.2MB

Download