Analysis
-
max time kernel
133s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
07/11/2023, 14:09
General
-
Target
CCIS/CCleaner/CCleaner.exe
-
Size
17.6MB
-
MD5
63c29cf31a568b2d8087d524b58f92fd
-
SHA1
8028b1578b25881374c5788e530a3b45449db935
-
SHA256
01076f684915e79d957fa2ba8aafeda761111ab3cd8cbff17cf89a69bafa81c4
-
SHA512
db5fbc1ea660fdddc8f3c7fdd16b3c016762d5c092a56b4ec8e3a0ff4b2bdb2751e4edf22d84b6dc1df010bdf06d3471b06a5ec2b0a75aa55080c8308b980d11
-
SSDEEP
196608:w0PW9ihCz6wl2QG5PC39EBERPI9qvlfgw0rqNMwlxA9ORd3Y9mj:wCW9bvl2faPT4w0rqNuG3Y9e
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 6 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CCIS\CCleaner\CCleaner.exe"C:\Users\Admin\AppData\Local\Temp\CCIS\CCleaner\CCleaner.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CCIS\CCleaner\CCleaner64.exe"C:\Users\Admin\AppData\Local\Temp\CCIS\CCleaner\CCleaner.exe"2⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5dbc6e3c030ade9bcf9c64fa2636331ef
SHA1704ff7394a9414d2b42717d7593a26d75c1a8022
SHA256cbd8f8f772d965729f78eed608f0acaf94c0d945e2e7b7361985ad40dde74f9a
SHA5128b3ae4df52465dc8042899131987c41e09bc0a9c7a5a5fb4f6f5bcf83ce9671878eed99dc80f575d5513beae902a1d7cf3a6634fc042a502eb3aeecf9153fd85
-
Filesize
14.0MB
MD5a12ad2cd3b5ae5749f93283fb9132403
SHA1bd38dce696fc1d91ac8003289858260dfffe8fe0
SHA2560d1422764f265816ae0b1cbfaa79678084872bdcf5cc746cb31eb14a5dc458d6
SHA512e54e9b77479ea708f8283c255b94ff7d1b2a3e6637675b081b01b7323968707eee7354bc43cd1d1c6899c26b3996e26b0dbff24d284ad7c198d625681d7f3af1
-
Filesize
16KB
MD5855e5d90dc57595f5181f088938bd0b7
SHA119cae86a749b8e22701324c0fc2857c7a31a48b8
SHA256ae538217da427b6f0d1b60a0dd666ba72318a2b1d4ac764e3c8b18d728423fbc
SHA512cc39cae909927180f3cc276a490bec580ff0e79f4ea16ff863cd044e5dc0bb734005e319e0b35c8c3f37d8872c000a2d1cc504db51d8fec1446eeac4de09c713
-
Filesize
16KB
MD5c9004bdd27ed994afefee2d748a0a833
SHA144a3ac7e9961d5e098501824057ad9c82df578ad
SHA256ab0a2d838247f338fe45c3f5dfc2a64f06cb89efdcc5f5937681efa6ec57d6dc
SHA5121d7c6d08dc59ea71ada152f78da7d7cec50e52fbc5ce113a66091419b96b6a7021a7b95c8664e8a3387a80839874903e3fd9c4889331bdac1662f563e2e26080
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB