a33443c6603faec9d3bd8d8afd97259308fa4cf7c52332746eca9399c1b97194

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20/09/2023, 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

隔離區文件/RtkNGUI64.exe
Size

7.6MB
MD5

03c0b46be0adcbcf985fef74217c4a05
SHA1

50bd1694fa049ca256be9fc529c772b6a2a3ebe6
SHA256

6181ed9db7cc07f058ba518bcbae3095526b914c927f297a7d6d04060aa3da1e
SHA512

df20d364e52a7137fe7501dfd465e0a2361a215ba9a691aa736cd5f5508f6734a8ffcb710ef9a2e161d5c51034441ece8161e237b23bae6ed9669ca3782b22be
SSDEEP

49152:snsHyjtk2MYC5GDmv4AZRMjRiy2CU0cLw9W2/qfzaxUtaS3xDKMsbRDjRv4iSEAr:snsmtk2a5iUfTtagxDqR5wiSH

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\lsass.exe	._cache_RtkNGUI64.exe
File created	C:\Windows\SysWOW64\drivers\lsass.exe	lsass.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.pif	lsass.exe

Executes dropped EXE 3 IoCs

pid	Process
2320	._cache_RtkNGUI64.exe
1444	lsass.exe
2780	._cache_RtkNGUI64.~tmp

Loads dropped DLL 5 IoCs

pid	Process
1260	RtkNGUI64.exe
1260	RtkNGUI64.exe
2320	._cache_RtkNGUI64.exe
2320	._cache_RtkNGUI64.exe
2320	._cache_RtkNGUI64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	RtkNGUI64.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Control Panel\don't load	._cache_RtkNGUI64.~tmp

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2320	._cache_RtkNGUI64.exe
2320	._cache_RtkNGUI64.exe
1444	lsass.exe
1444	lsass.exe
2780	._cache_RtkNGUI64.~tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2320	1260	RtkNGUI64.exe	28
PID 1260 wrote to memory of 2320	1260	RtkNGUI64.exe	28
PID 1260 wrote to memory of 2320	1260	RtkNGUI64.exe	28
PID 1260 wrote to memory of 2320	1260	RtkNGUI64.exe	28
PID 2320 wrote to memory of 1444	2320	._cache_RtkNGUI64.exe	29
PID 2320 wrote to memory of 1444	2320	._cache_RtkNGUI64.exe	29
PID 2320 wrote to memory of 1444	2320	._cache_RtkNGUI64.exe	29
PID 2320 wrote to memory of 1444	2320	._cache_RtkNGUI64.exe	29
PID 2320 wrote to memory of 2780	2320	._cache_RtkNGUI64.exe	30
PID 2320 wrote to memory of 2780	2320	._cache_RtkNGUI64.exe	30
PID 2320 wrote to memory of 2780	2320	._cache_RtkNGUI64.exe	30
PID 2320 wrote to memory of 2780	2320	._cache_RtkNGUI64.exe	30

C:\Users\Admin\AppData\Local\Temp\隔離區文件\RtkNGUI64.exe
"C:\Users\Admin\AppData\Local\Temp\隔離區文件\RtkNGUI64.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\drivers\lsass.exe
    "C:\Windows\system32\drivers\lsass.exe"
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of SetWindowsHookEx
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.~tmp
    "C:\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.~tmp"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Suspicious use of SetWindowsHookEx
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.exe

Filesize
6.9MB

MD5
853e467b7ff243e6f2932a0c731f72f7

SHA1
bb70e5c3e5b6cde27ae7ca9df8a90f0822e89b38

SHA256
a9674026805ffe64f958cc1f278d8286ada70ba2b3031f0e3400b660b0cfd75a

SHA512
b664e2ab370428f92d4de4440d06d686027ebc845338254820079a0ba2e921ef8d8ff69a8a04914f34d85a08d768fad55449c661717c929f86b84f056a070f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.exe

Filesize
6.9MB

MD5
853e467b7ff243e6f2932a0c731f72f7

SHA1
bb70e5c3e5b6cde27ae7ca9df8a90f0822e89b38

SHA256
a9674026805ffe64f958cc1f278d8286ada70ba2b3031f0e3400b660b0cfd75a

SHA512
b664e2ab370428f92d4de4440d06d686027ebc845338254820079a0ba2e921ef8d8ff69a8a04914f34d85a08d768fad55449c661717c929f86b84f056a070f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.exe

Filesize
6.9MB

MD5
853e467b7ff243e6f2932a0c731f72f7

SHA1
bb70e5c3e5b6cde27ae7ca9df8a90f0822e89b38

SHA256
a9674026805ffe64f958cc1f278d8286ada70ba2b3031f0e3400b660b0cfd75a

SHA512
b664e2ab370428f92d4de4440d06d686027ebc845338254820079a0ba2e921ef8d8ff69a8a04914f34d85a08d768fad55449c661717c929f86b84f056a070f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.~tmp

Filesize
6.8MB

MD5
2082fc3bdb02bab6a97bf467589be040

SHA1
a657b13e2e4d625e9f6b699cb37e7dcbe6ed3231

SHA256
87b43c2dd22299e87a138f09234bed8a84e9869600244ecce5761873f9b8e124

SHA512
97b916f133a0e6262a60bc3c01e45387f9006ff88389c61ddad766f302c63381bfc1d8dd7dd2b6affdfaf8c680fadcdd57649aa7e83342b280c1e5d9ad9a9ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.~tmp

Filesize
6.8MB

MD5
2082fc3bdb02bab6a97bf467589be040

SHA1
a657b13e2e4d625e9f6b699cb37e7dcbe6ed3231

SHA256
87b43c2dd22299e87a138f09234bed8a84e9869600244ecce5761873f9b8e124

SHA512
97b916f133a0e6262a60bc3c01e45387f9006ff88389c61ddad766f302c63381bfc1d8dd7dd2b6affdfaf8c680fadcdd57649aa7e83342b280c1e5d9ad9a9ef0

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
007b4d557984229bdc98e9f3a6fcae05

SHA1
d7bdbb4f3ba427d1362429645efd242e2a7e1448

SHA256
9c503850af6ce9e4598007e1581694f389e9ad1b4fb78ca1b96170555dafb532

SHA512
18b3ab76d5e421fbcaf12dfbc74ad717823ca57adfc663e615a3862d05e276177683e89916003cca849666f1cb84869a7773ebf775abb969d26776997114dd88

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
007b4d557984229bdc98e9f3a6fcae05

SHA1
d7bdbb4f3ba427d1362429645efd242e2a7e1448

SHA256
9c503850af6ce9e4598007e1581694f389e9ad1b4fb78ca1b96170555dafb532

SHA512
18b3ab76d5e421fbcaf12dfbc74ad717823ca57adfc663e615a3862d05e276177683e89916003cca849666f1cb84869a7773ebf775abb969d26776997114dd88

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.exe

Filesize
6.9MB

MD5
853e467b7ff243e6f2932a0c731f72f7

SHA1
bb70e5c3e5b6cde27ae7ca9df8a90f0822e89b38

SHA256
a9674026805ffe64f958cc1f278d8286ada70ba2b3031f0e3400b660b0cfd75a

SHA512
b664e2ab370428f92d4de4440d06d686027ebc845338254820079a0ba2e921ef8d8ff69a8a04914f34d85a08d768fad55449c661717c929f86b84f056a070f8e

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.exe

Filesize
6.9MB

MD5
853e467b7ff243e6f2932a0c731f72f7

SHA1
bb70e5c3e5b6cde27ae7ca9df8a90f0822e89b38

SHA256
a9674026805ffe64f958cc1f278d8286ada70ba2b3031f0e3400b660b0cfd75a

SHA512
b664e2ab370428f92d4de4440d06d686027ebc845338254820079a0ba2e921ef8d8ff69a8a04914f34d85a08d768fad55449c661717c929f86b84f056a070f8e

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_RtkNGUI64.~tmp

Filesize
6.8MB

MD5
2082fc3bdb02bab6a97bf467589be040

SHA1
a657b13e2e4d625e9f6b699cb37e7dcbe6ed3231

SHA256
87b43c2dd22299e87a138f09234bed8a84e9869600244ecce5761873f9b8e124

SHA512
97b916f133a0e6262a60bc3c01e45387f9006ff88389c61ddad766f302c63381bfc1d8dd7dd2b6affdfaf8c680fadcdd57649aa7e83342b280c1e5d9ad9a9ef0

Download Submit
\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
007b4d557984229bdc98e9f3a6fcae05

SHA1
d7bdbb4f3ba427d1362429645efd242e2a7e1448

SHA256
9c503850af6ce9e4598007e1581694f389e9ad1b4fb78ca1b96170555dafb532

SHA512
18b3ab76d5e421fbcaf12dfbc74ad717823ca57adfc663e615a3862d05e276177683e89916003cca849666f1cb84869a7773ebf775abb969d26776997114dd88

Download Submit
\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
007b4d557984229bdc98e9f3a6fcae05

SHA1
d7bdbb4f3ba427d1362429645efd242e2a7e1448

SHA256
9c503850af6ce9e4598007e1581694f389e9ad1b4fb78ca1b96170555dafb532

SHA512
18b3ab76d5e421fbcaf12dfbc74ad717823ca57adfc663e615a3862d05e276177683e89916003cca849666f1cb84869a7773ebf775abb969d26776997114dd88

Download Submit
memory/1260-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1260-28-0x0000000000400000-0x0000000000BAA000-memory.dmp

Filesize
7.7MB

Download
memory/1260-29-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads