99a6966aea833fa53e11681cb19b336abd176eb1e477fdde957ec11954e7086d

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MultiExploitBuilderV1.exe
Size

2.2MB
MD5

b9fa659bd0b2b103521c686ecf3da2c7
SHA1

21427801d6d99aff543964fe8f685faa196cf8f2
SHA256

99a6966aea833fa53e11681cb19b336abd176eb1e477fdde957ec11954e7086d
SHA512

c25bd26b8e9aba2df095e1a964a8a92c25b800a7604330ca6ee1ece89e6b680897af216905ecb40b4a4d7228a1fe857c11707248590839e7ecd2ef6c431a05d4
SSDEEP

49152:bqe3f6lnC3KqopqB8YwuJQ9iEpWHGG2J/:WSi1qKqBOSwTCwR

Score

8^/10

discovery persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Executes dropped EXE 3 IoCs

pid	Process
1660	MultiExploitBuilderV1.tmp
4484	SearchOptimizer.exe
4216	SearchUI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchUI.exe	MultiExploitBuilderV1.tmp
File opened for modification	C:\Windows\system32\SearchOptimizer.exe	MultiExploitBuilderV1.tmp
File created	C:\Windows\system32\is-2E65N.tmp	MultiExploitBuilderV1.tmp
File created	C:\Windows\system32\is-C87VA.tmp	MultiExploitBuilderV1.tmp
File created	C:\Windows\system32\is-KHSJA.tmp	MultiExploitBuilderV1.tmp

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Reduce Memory\is-0ULEU.tmp	MultiExploitBuilderV1.tmp
File created	C:\Program Files\Reduce Memory\is-5RC63.tmp	MultiExploitBuilderV1.tmp
File opened for modification	C:\Program Files\Reduce Memory\unins000.dat	MultiExploitBuilderV1.tmp
File opened for modification	C:\Program Files\Reduce Memory\ReduceMemory.exe	MultiExploitBuilderV1.tmp
File created	C:\Program Files\Reduce Memory\unins000.dat	MultiExploitBuilderV1.tmp
File created	C:\Program Files\Reduce Memory\is-3NNDO.tmp	MultiExploitBuilderV1.tmp
File created	C:\Program Files\Reduce Memory\is-JJIQI.tmp	MultiExploitBuilderV1.tmp

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3792	sc.exe
2236	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1660	MultiExploitBuilderV1.tmp
1660	MultiExploitBuilderV1.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	MultiExploitBuilderV1.tmp

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1660	1412	MultiExploitBuilderV1.exe	85
PID 1412 wrote to memory of 1660	1412	MultiExploitBuilderV1.exe	85
PID 1412 wrote to memory of 1660	1412	MultiExploitBuilderV1.exe	85
PID 1660 wrote to memory of 2720	1660	MultiExploitBuilderV1.tmp	88
PID 1660 wrote to memory of 2720	1660	MultiExploitBuilderV1.tmp	88
PID 2720 wrote to memory of 3792	2720	cmd.exe	90
PID 2720 wrote to memory of 3792	2720	cmd.exe	90
PID 2720 wrote to memory of 2236	2720	cmd.exe	91
PID 2720 wrote to memory of 2236	2720	cmd.exe	91
PID 4484 wrote to memory of 4216	4484	SearchOptimizer.exe	93
PID 4484 wrote to memory of 4216	4484	SearchOptimizer.exe	93

C:\Users\Admin\AppData\Local\Temp\MultiExploitBuilderV1.exe
"C:\Users\Admin\AppData\Local\Temp\MultiExploitBuilderV1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\is-1GDJP.tmp\MultiExploitBuilderV1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1GDJP.tmp\MultiExploitBuilderV1.tmp" /SL5="$D0028,1485076,837632,C:\Users\Admin\AppData\Local\Temp\MultiExploitBuilderV1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-GA4DB.tmp\env.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\system32\sc.exe
      sc create SearchOptimizer binpath= "C:\Windows\System32\SearchOptimizer.exe" start=auto
      4⤵
      Launches sc.exe
      PID:3792
  - - C:\Windows\system32\sc.exe
      sc start SearchOptimizer
      4⤵
      Launches sc.exe
      PID:2236

C:\Windows\System32\SearchOptimizer.exe
C:\Windows\System32\SearchOptimizer.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\System32\SearchUI.exe
  "C:\Windows\System32\SearchUI.exe"
  2⤵
  - Executes dropped EXE
  PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SearchUI\ver.txt

Filesize
75B

MD5
3e9b283396ce48fe6410ffaa5b3a7ef7

SHA1
08ce48281fc5fb2dcb69034120ace5d02233d4c8

SHA256
bea122a004eb8d1dc88a38636f77cf73ccf20c5cbf39061b967e7d23cc995158

SHA512
27dce7901a94f2dc163e2c8b35ced9bc63d1737ac87df9b385aec6b662d04df8a7b472c31458dd67109014a18be4150e4eecdfc661c44f44c0d4764d3175f6c5

Download Submit
C:\Users\Admin\AppData\Local\SearchUI\ver.txt

Filesize
75B

MD5
3e9b283396ce48fe6410ffaa5b3a7ef7

SHA1
08ce48281fc5fb2dcb69034120ace5d02233d4c8

SHA256
bea122a004eb8d1dc88a38636f77cf73ccf20c5cbf39061b967e7d23cc995158

SHA512
27dce7901a94f2dc163e2c8b35ced9bc63d1737ac87df9b385aec6b662d04df8a7b472c31458dd67109014a18be4150e4eecdfc661c44f44c0d4764d3175f6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1GDJP.tmp\MultiExploitBuilderV1.tmp

Filesize
2.9MB

MD5
1f4bdf4d6f2b4fd5f8e60e8be2e86c5b

SHA1
5da410b4f14949b46cc7995f4f8f480a2de25a70

SHA256
711308c01e6c633293062aca47ba61df0baadc980ebf2ff66e0fb39e5e537477

SHA512
2436d25866cf93a53116038f715919c82e21a8171fe0a68ffefa5283fb07824d74ec4c89f870e018fc2326beab89d6bdfd0249d6fc9f078859427bc351b837e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1GDJP.tmp\MultiExploitBuilderV1.tmp

Filesize
2.9MB

MD5
1f4bdf4d6f2b4fd5f8e60e8be2e86c5b

SHA1
5da410b4f14949b46cc7995f4f8f480a2de25a70

SHA256
711308c01e6c633293062aca47ba61df0baadc980ebf2ff66e0fb39e5e537477

SHA512
2436d25866cf93a53116038f715919c82e21a8171fe0a68ffefa5283fb07824d74ec4c89f870e018fc2326beab89d6bdfd0249d6fc9f078859427bc351b837e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GA4DB.tmp\env.bat

Filesize
126B

MD5
7af82eba781e242f1d31d84426fe6d46

SHA1
8922e100cbbefe0bea303350fec65ad9e7d2c6bf

SHA256
e542c65b51318d3b6308e6f9cddf56cfb9e5702c688b089739a8087677acbbfe

SHA512
22a5ee800cd4c0e1e2e57ec1818631a8d94641023b282b05df754ca6cbbae08d7b935de879780c3170ec8cc0c6897fa1be5d868e7cf04ce35af39d5adde69a13

Download Submit
C:\Windows\System32\SearchOptimizer.exe

Filesize
254KB

MD5
5c7b8fa5b82728b1337e7e35ac235a06

SHA1
a9d662a387f9d320a67f91e6c0600c7638d67000

SHA256
6a24df52c56aaffa2770fc20dbb64b14f54e69b543a31fe5d51d364ec4e17ec4

SHA512
9aee5e0aad93600d8c2d7ab91297f20ae3f9d0da5590a3534bec48a2e72f637461bce0ebb18bce35687b88397b1398c0197d5e36e313c1cb03b490264596e433

Download Submit
C:\Windows\System32\SearchOptimizer.exe

Filesize
254KB

MD5
5c7b8fa5b82728b1337e7e35ac235a06

SHA1
a9d662a387f9d320a67f91e6c0600c7638d67000

SHA256
6a24df52c56aaffa2770fc20dbb64b14f54e69b543a31fe5d51d364ec4e17ec4

SHA512
9aee5e0aad93600d8c2d7ab91297f20ae3f9d0da5590a3534bec48a2e72f637461bce0ebb18bce35687b88397b1398c0197d5e36e313c1cb03b490264596e433

Download Submit
C:\Windows\System32\SearchUI.exe

Filesize
306KB

MD5
49e95b7a1ebf031fd9ad67adf8769a19

SHA1
5913dd59612ee712e23f33496ac3994a2f846b39

SHA256
d791577ccb6b6d288e06c9e6a9dbe7f0563144fb5025b17ee8435df04a8c1811

SHA512
969b113c360ab188c1ae0c0419997ab67e34ab742488a16625c295e8d273ebf11a32e596190996addcc3aa55475df0f152ed5af66305ba56ad0908d657186fad

Download Submit
C:\Windows\System32\SearchUI.exe

Filesize
306KB

MD5
49e95b7a1ebf031fd9ad67adf8769a19

SHA1
5913dd59612ee712e23f33496ac3994a2f846b39

SHA256
d791577ccb6b6d288e06c9e6a9dbe7f0563144fb5025b17ee8435df04a8c1811

SHA512
969b113c360ab188c1ae0c0419997ab67e34ab742488a16625c295e8d273ebf11a32e596190996addcc3aa55475df0f152ed5af66305ba56ad0908d657186fad

Download Submit
C:\Windows\System32\op.config.xml

Filesize
75B

MD5
3e9b283396ce48fe6410ffaa5b3a7ef7

SHA1
08ce48281fc5fb2dcb69034120ace5d02233d4c8

SHA256
bea122a004eb8d1dc88a38636f77cf73ccf20c5cbf39061b967e7d23cc995158

SHA512
27dce7901a94f2dc163e2c8b35ced9bc63d1737ac87df9b385aec6b662d04df8a7b472c31458dd67109014a18be4150e4eecdfc661c44f44c0d4764d3175f6c5

Download Submit
memory/1412-1-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/1412-47-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/1660-11-0x0000000002490000-0x00000000025D0000-memory.dmp

Filesize
1.2MB

Download
memory/1660-10-0x0000000002490000-0x00000000025D0000-memory.dmp

Filesize
1.2MB

Download
memory/1660-6-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/1660-49-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/1660-50-0x0000000000400000-0x00000000006FC000-memory.dmp

Filesize
3.0MB

Download
memory/1660-51-0x0000000002490000-0x00000000025D0000-memory.dmp

Filesize
1.2MB

Download