Analysis
-
max time kernel
162s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 02:12
Behavioral task
behavioral1
Sample
550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe
Resource
win10v2004-20230915-en
General
-
Target
550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe
-
Size
536KB
-
MD5
2ce85454b5510213632ea6e62301018b
-
SHA1
e2e59047d530c0cea71b3609245e635f8f9823e5
-
SHA256
550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b
-
SHA512
dfaa09683348ad553ea6b3f8cf7a20ff3fa6094b088cc17b6237e291c861323866d988541d4363e832ecc5231a83c4802304929c4b38d78fd9429c08dbcbec61
-
SSDEEP
12288:gOreCbJ6z1GZnCbPLwY5ZhUXy4Okx2LIa:8CKTYrOkx2LF
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\ThJEUhOon.sys cleanmgr.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe -
Executes dropped EXE 1 IoCs
pid Process 788 cleanmgr.exe -
resource yara_rule behavioral2/memory/5056-0-0x0000000000B00000-0x0000000000C02000-memory.dmp upx behavioral2/memory/5056-11-0x0000000000B00000-0x0000000000C02000-memory.dmp upx behavioral2/memory/5056-49-0x0000000000B00000-0x0000000000C02000-memory.dmp upx -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\ \Windows\System32\BWd1fCM.sys cleanmgr.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Fonts\cleanmgr.exe Explorer.EXE File opened for modification C:\Windows\Fonts\cleanmgr.exe Explorer.EXE File created C:\Windows\MxpWtPjB0.sys cleanmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName cleanmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4716 timeout.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\New Windows\Allow cleanmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\www.hao774.com cleanmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe 2568 Explorer.EXE 2568 Explorer.EXE 2568 Explorer.EXE 2568 Explorer.EXE 2568 Explorer.EXE 2568 Explorer.EXE 2568 Explorer.EXE 2568 Explorer.EXE 2568 Explorer.EXE 2568 Explorer.EXE 2568 Explorer.EXE 2568 Explorer.EXE 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2568 Explorer.EXE -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe Token: SeTcbPrivilege 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe Token: SeDebugPrivilege 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe Token: SeDebugPrivilege 2568 Explorer.EXE Token: SeTcbPrivilege 2568 Explorer.EXE Token: SeDebugPrivilege 2568 Explorer.EXE Token: SeDebugPrivilege 2568 Explorer.EXE Token: SeDebugPrivilege 2568 Explorer.EXE Token: SeIncBasePriorityPrivilege 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe Token: SeDebugPrivilege 2568 Explorer.EXE Token: SeDebugPrivilege 788 cleanmgr.exe Token: SeDebugPrivilege 788 cleanmgr.exe Token: SeDebugPrivilege 788 cleanmgr.exe Token: SeShutdownPrivilege 2568 Explorer.EXE Token: SeCreatePagefilePrivilege 2568 Explorer.EXE Token: SeDebugPrivilege 788 cleanmgr.exe Token: SeShutdownPrivilege 2568 Explorer.EXE Token: SeCreatePagefilePrivilege 2568 Explorer.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe 788 cleanmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 788 cleanmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 2568 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe 46 PID 5056 wrote to memory of 2568 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe 46 PID 5056 wrote to memory of 2568 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe 46 PID 2568 wrote to memory of 788 2568 Explorer.EXE 87 PID 2568 wrote to memory of 788 2568 Explorer.EXE 87 PID 2568 wrote to memory of 788 2568 Explorer.EXE 87 PID 2568 wrote to memory of 788 2568 Explorer.EXE 87 PID 2568 wrote to memory of 788 2568 Explorer.EXE 87 PID 2568 wrote to memory of 788 2568 Explorer.EXE 87 PID 2568 wrote to memory of 788 2568 Explorer.EXE 87 PID 2568 wrote to memory of 616 2568 Explorer.EXE 5 PID 2568 wrote to memory of 616 2568 Explorer.EXE 5 PID 2568 wrote to memory of 616 2568 Explorer.EXE 5 PID 2568 wrote to memory of 616 2568 Explorer.EXE 5 PID 2568 wrote to memory of 616 2568 Explorer.EXE 5 PID 5056 wrote to memory of 4764 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe 90 PID 5056 wrote to memory of 4764 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe 90 PID 5056 wrote to memory of 4764 5056 550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe 90 PID 4764 wrote to memory of 4716 4764 cmd.exe 92 PID 4764 wrote to memory of 4716 4764 cmd.exe 92 PID 4764 wrote to memory of 4716 4764 cmd.exe 92 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46 PID 788 wrote to memory of 2568 788 cleanmgr.exe 46
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe"C:\Users\Admin\AppData\Local\Temp\550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\550f9765ec1f54c7bb6841c4cb6f6ed0d7c6cd7898d7a2bc83362d7e3335349b.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
PID:4716
-
-
-
-
C:\Windows\Fonts\cleanmgr.exe"C:\Windows\Fonts\cleanmgr.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
292KB
MD5cd0d99ebe88d11f55136eae39ccf8f6e
SHA1d0782098cbf41490ea1e54db5d21a679f332a113
SHA256acd2cbfb4c9fb8fe20c21a7ec99445d1426cee90ff3091115eb4c9484b69ea9d
SHA512376f8f078b2922ba7400c265dce243bc561560fbdf7d36c7e2b497d1ccb523d540c650baade4b15c4d061dc41634349a5e5d0ecd3305c44e790dc9df3f4289bb