Overview
overview
3Static
static
3Config/Plu...64.dll
windows7-x64
1Config/Plu...64.dll
windows10-2004-x64
1Config/Plu...64.dll
windows7-x64
1Config/Plu...64.dll
windows10-2004-x64
1Config/Plu...86.dll
windows7-x64
1Config/Plu...86.dll
windows10-2004-x64
1Config/Plu...es.dll
windows7-x64
1Config/Plu...es.dll
windows10-2004-x64
1Config/amd...st.dll
windows7-x64
3Config/amd...st.dll
windows10-2004-x64
3Config/amd...er.dll
windows7-x64
1Config/amd...er.dll
windows10-2004-x64
1Config/amd...ot.exe
windows7-x64
1Config/amd...ot.exe
windows10-2004-x64
1Config/amd...pi.dll
windows7-x64
1Config/amd...pi.dll
windows10-2004-x64
1Config/amd...dk.exe
windows7-x64
Config/amd...dk.exe
windows10-2004-x64
Config/arm...st.dll
windows7-x64
1Config/arm...st.dll
windows10-2004-x64
1Config/arm...er.dll
windows7-x64
1Config/arm...er.dll
windows10-2004-x64
1Config/x86...st.dll
windows7-x64
3Config/x86...st.dll
windows10-2004-x64
3Config/x86...er.dll
windows7-x64
1Config/x86...er.dll
windows10-2004-x64
1Config/x86...ot.exe
windows7-x64
1Config/x86...ot.exe
windows10-2004-x64
1Config/x86...pi.dll
windows7-x64
1Config/x86...pi.dll
windows10-2004-x64
1Config/x86/wofadk.exe
windows7-x64
Config/x86/wofadk.exe
windows10-2004-x64
Analysis
-
max time kernel
139s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2023 01:32
Static task
static1
Behavioral task
behavioral1
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.amd64.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.amd64.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral3
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.arm64.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.arm64.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral5
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.x86.dll
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/Plugin.x86.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral7
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/PluginRes.dll
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
Config/Plugins/FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw/PluginRes.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral9
Sample
Config/amd64/CBSHost.dll
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
Config/amd64/CBSHost.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral11
Sample
Config/amd64/NCleaner.dll
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
Config/amd64/NCleaner.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral13
Sample
Config/amd64/bcdboot.exe
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
Config/amd64/bcdboot.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral15
Sample
Config/amd64/wimgapi.dll
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
Config/amd64/wimgapi.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral17
Sample
Config/amd64/wofadk.exe
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
Config/amd64/wofadk.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral19
Sample
Config/arm64/CBSHost.dll
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
Config/arm64/CBSHost.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral21
Sample
Config/arm64/NCleaner.dll
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
Config/arm64/NCleaner.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral23
Sample
Config/x86/CBSHost.dll
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
Config/x86/CBSHost.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral25
Sample
Config/x86/NCleaner.dll
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
Config/x86/NCleaner.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral27
Sample
Config/x86/bcdboot.exe
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
Config/x86/bcdboot.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral29
Sample
Config/x86/wimgapi.dll
Resource
win7-20230831-en
Behavioral task
behavioral30
Sample
Config/x86/wimgapi.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral31
Sample
Config/x86/wofadk.exe
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
Config/x86/wofadk.exe
Resource
win10v2004-20230831-en
General
-
Target
Config/amd64/CBSHost.dll
-
Size
175KB
-
MD5
dd139df87a896b894335e03ece2973bf
-
SHA1
c6eb8a276897acc4e1f34dc25df138b2c30f7918
-
SHA256
6a1075f4fab4acd2722e8946cba7b23508d120367c84aae3e83284124227013a
-
SHA512
1a6296ab7411771e1fd8147086cbcade6f761e10b44975086fc03a0f058faaa0acef692b97a56f2ddad3f66241c0fb1b7d6d7e897888cb53f86a9734ceed5874
-
SSDEEP
3072:OyghxXQLWyjBcbo9EIb7TX4VkUihhwWP/pdrgeDyv3M5xmimkqq6S8PdG6QqKWO+:k4L3dio7LcW7/p1geDyfgmimkqq6zQqI
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3236 216 WerFault.exe 67 -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeSecurityPrivilege 216 rundll32.exe Token: 35 216 rundll32.exe Token: SeLoadDriverPrivilege 216 rundll32.exe Token: SeBackupPrivilege 216 rundll32.exe Token: SeRestorePrivilege 216 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\amd64\CBSHost.dll,#11⤵
- Suspicious use of AdjustPrivilegeToken
PID:216 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 216 -s 5242⤵
- Program crash
PID:3236
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 412 -p 216 -ip 2161⤵PID:1744