6bfb6cc367163788d1f1af479187b55a222150af3edc427718dddb8172c4f757

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spooky-cleaner.exe
Size

15KB
MD5

c79ca8ddd76c54108754dca6fb880a00
SHA1

00065504f411c7a51d115058d38735fe204cf672
SHA256

6bfb6cc367163788d1f1af479187b55a222150af3edc427718dddb8172c4f757
SHA512

f5c9cdd128b581c9ddea4d6fe978df77d47f37aabb8a870146e85707cf8276b5f608f65886c6547551529f516d23fd25ea682e1667cac1aa5bcaa6339039294d
SSDEEP

192:5Zif8PLRDBalCNcdV4tmefZaNSNBtNplnhUvopB9/Zz8Q7cBtYiaAws681E3Q5tE:3DBaINcdVsmmZawNXz8Mcy3NT

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4464	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1320	tasklist.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3848	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	tasklist.exe
Token: SeDebugPrivilege	3848	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3292	2172	spooky-cleaner.exe	83
PID 2172 wrote to memory of 3292	2172	spooky-cleaner.exe	83
PID 3292 wrote to memory of 1320	3292	cmd.exe	84
PID 3292 wrote to memory of 1320	3292	cmd.exe	84
PID 3292 wrote to memory of 3172	3292	cmd.exe	85
PID 3292 wrote to memory of 3172	3292	cmd.exe	85
PID 2172 wrote to memory of 3344	2172	spooky-cleaner.exe	87
PID 2172 wrote to memory of 3344	2172	spooky-cleaner.exe	87
PID 2172 wrote to memory of 732	2172	spooky-cleaner.exe	88
PID 2172 wrote to memory of 732	2172	spooky-cleaner.exe	88
PID 2172 wrote to memory of 2756	2172	spooky-cleaner.exe	89
PID 2172 wrote to memory of 2756	2172	spooky-cleaner.exe	89
PID 2172 wrote to memory of 3288	2172	spooky-cleaner.exe	90
PID 2172 wrote to memory of 3288	2172	spooky-cleaner.exe	90
PID 2172 wrote to memory of 4448	2172	spooky-cleaner.exe	91
PID 2172 wrote to memory of 4448	2172	spooky-cleaner.exe	91
PID 2172 wrote to memory of 4444	2172	spooky-cleaner.exe	92
PID 2172 wrote to memory of 4444	2172	spooky-cleaner.exe	92
PID 4444 wrote to memory of 4464	4444	cmd.exe	93
PID 4444 wrote to memory of 4464	4444	cmd.exe	93
PID 2172 wrote to memory of 2244	2172	spooky-cleaner.exe	98
PID 2172 wrote to memory of 2244	2172	spooky-cleaner.exe	98
PID 2244 wrote to memory of 3064	2244	cmd.exe	99
PID 2244 wrote to memory of 3064	2244	cmd.exe	99
PID 2172 wrote to memory of 4484	2172	spooky-cleaner.exe	100
PID 2172 wrote to memory of 4484	2172	spooky-cleaner.exe	100
PID 2172 wrote to memory of 3480	2172	spooky-cleaner.exe	101
PID 2172 wrote to memory of 3480	2172	spooky-cleaner.exe	101
PID 2172 wrote to memory of 4568	2172	spooky-cleaner.exe	102
PID 2172 wrote to memory of 4568	2172	spooky-cleaner.exe	102
PID 2172 wrote to memory of 648	2172	spooky-cleaner.exe	103
PID 2172 wrote to memory of 648	2172	spooky-cleaner.exe	103
PID 2172 wrote to memory of 4060	2172	spooky-cleaner.exe	104
PID 2172 wrote to memory of 4060	2172	spooky-cleaner.exe	104
PID 2172 wrote to memory of 4956	2172	spooky-cleaner.exe	106
PID 2172 wrote to memory of 4956	2172	spooky-cleaner.exe	106
PID 2172 wrote to memory of 2308	2172	spooky-cleaner.exe	107
PID 2172 wrote to memory of 2308	2172	spooky-cleaner.exe	107
PID 2172 wrote to memory of 3452	2172	spooky-cleaner.exe	108
PID 2172 wrote to memory of 3452	2172	spooky-cleaner.exe	108
PID 2172 wrote to memory of 1536	2172	spooky-cleaner.exe	109
PID 2172 wrote to memory of 1536	2172	spooky-cleaner.exe	109
PID 2172 wrote to memory of 3760	2172	spooky-cleaner.exe	110
PID 2172 wrote to memory of 3760	2172	spooky-cleaner.exe	110
PID 2172 wrote to memory of 2204	2172	spooky-cleaner.exe	111
PID 2172 wrote to memory of 2204	2172	spooky-cleaner.exe	111
PID 2172 wrote to memory of 3804	2172	spooky-cleaner.exe	112
PID 2172 wrote to memory of 3804	2172	spooky-cleaner.exe	112
PID 3804 wrote to memory of 3848	3804	cmd.exe	113
PID 3804 wrote to memory of 3848	3804	cmd.exe	113
PID 2172 wrote to memory of 2996	2172	spooky-cleaner.exe	114
PID 2172 wrote to memory of 2996	2172	spooky-cleaner.exe	114
PID 2172 wrote to memory of 468	2172	spooky-cleaner.exe	115
PID 2172 wrote to memory of 468	2172	spooky-cleaner.exe	115
PID 2172 wrote to memory of 548	2172	spooky-cleaner.exe	116
PID 2172 wrote to memory of 548	2172	spooky-cleaner.exe	116
PID 2172 wrote to memory of 4136	2172	spooky-cleaner.exe	117
PID 2172 wrote to memory of 4136	2172	spooky-cleaner.exe	117
PID 2172 wrote to memory of 4624	2172	spooky-cleaner.exe	118
PID 2172 wrote to memory of 4624	2172	spooky-cleaner.exe	118
PID 2172 wrote to memory of 1980	2172	spooky-cleaner.exe	119
PID 2172 wrote to memory of 1980	2172	spooky-cleaner.exe	119
PID 2172 wrote to memory of 2612	2172	spooky-cleaner.exe	120
PID 2172 wrote to memory of 2612	2172	spooky-cleaner.exe	120

C:\Users\Admin\AppData\Local\Temp\spooky-cleaner.exe
"C:\Users\Admin\AppData\Local\Temp\spooky-cleaner.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Steam.exe" 2>NUL | find /I /N "Steam.exe" > NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Steam.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- - C:\Windows\system32\find.exe
    find /I /N "Steam.exe"
    3⤵
    PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /S /Q "C:\Program Files (x86)\Steam\userdata\*"
  2⤵
  PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /S /Q "C:\Program Files (x86)\Steam\dumps\*"
  2⤵
  PID:732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /S /Q "C:\Program Files (x86)\Steam\logs\*"
  2⤵
  PID:2756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /S /Q "C:\Program Files (x86)\Steam\config\*"
  2⤵
  PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /S /Q "C:\Program Files (x86)\Steam\steamapps\*.acf"
  2⤵
  PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c timeout /t 4 /nobreak > NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\timeout.exe
    timeout /t 4 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKCU\Software\Valve\Steam\Users" /va /f > NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Valve\Steam\Users" /va /f
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd C:\
  2⤵
  PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del *.log /a /s /q /f
  2⤵
  PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del *.temp /a /s /q /f
  2⤵
  PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del *.tmp /a /s /q /f
  2⤵
  PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del *.bak /a /s /q /f
  2⤵
  PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del *.old /a /s /q /f
  2⤵
  PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del *.chk /a /s /q /f
  2⤵
  PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del *.mkd /a /s /q /f
  2⤵
  PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del *.pf /a /s /q /f
  2⤵
  PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del *.dlf /a /s /q /f
  2⤵
  PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM steam*
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM steam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd "C:\Program Files (x86)\Steam"
  2⤵
  PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q userdata
  2⤵
  PID:468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q config
  2⤵
  PID:548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q logs
  2⤵
  PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q dumps
  2⤵
  PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q appcache
  2⤵
  PID:1980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /A:H ssfn*
  2⤵
  PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd %localappdata%
  2⤵
  PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q EasyAntiCheat
  2⤵
  PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q "Facepunch Studios LTD"
  2⤵
  PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd %appdata%
  2⤵
  PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q EasyAntiCheat
  2⤵
  PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q "Facepunch Studios LTD"
  2⤵
  PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd ..
  2⤵
  PID:448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd LocalLow
  2⤵
  PID:2180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q EasyAntiCheat
  2⤵
  PID:1264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q "Facepunch Studios LTD"
  2⤵
  PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd %UserProfile%
  2⤵
  PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q EasyAntiCheat
  2⤵
  PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q "Facepunch Studios LTD"
  2⤵
  PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...