Overview

overview

8

Static

static

1

360TS_Setu...mx.exe

windows7-x64

8

360TS_Setu...mx.exe

windows10-2004-x64

8

Resubmissions

13/11/2023, 12:06

231113-n9rv9sda25 8

13/11/2023, 10:23

231113-mey6esce75 8

13/11/2023, 09:41

231113-ln4ltsbh7s 8

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2023, 09:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    360TS_Setup_Mini.ZvbyhDOD.h1.YWZmaS5hZGl0bWVkaWEuUEI.Z3FSamMybGtzRGt6TUY4NE9UZ3dNRFZrWVY4MU1ET2pZMmx.exe

  • Size

    1.4MB

  • MD5

    31fee2c73b8d2a8ec979775cd5f5ced7

  • SHA1

    39182a68bc0c1c07d3ddc47cd69fe3692dbac834

  • SHA256

    d26a7f2d4f3521827201e6cdcd296f132c7d18c3a1ce70c24b423300cff326fe

  • SHA512

    db51b602a8675641bc3a0a980a197243787ed12f5e0619cb1d390c91193d7e3447e3e86e2321c3ea273c6732b356003a249241d7d8a5699931810e5a35d5c650

  • SSDEEP

    24576:kL/7n6lbcC8oblv1zj1SqdAGFQZIxvC45UJoe1Z:E6+C8o5tzjYq+ZIxL5UJoeL

Score
8/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\360TS_Setup_Mini.ZvbyhDOD.h1.YWZmaS5hZGl0bWVkaWEuUEI.Z3FSamMybGtzRGt6TUY4NE9UZ3dNRFZrWVY4MU1ET2pZMmx.exe
    "C:\Users\Admin\AppData\Local\Temp\360TS_Setup_Mini.ZvbyhDOD.h1.YWZmaS5hZGl0bWVkaWEuUEI.Z3FSamMybGtzRGt6TUY4NE9UZ3dNRFZrWVY4MU1ET2pZMmx.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe" /c:101 /pmode:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Program Files (x86)\1699868617_0\360TS_Setup.exe
        "C:\Program Files (x86)\1699868617_0\360TS_Setup.exe" /c:101 /pmode:2 /TSinstall
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of SetWindowsHookEx
        PID:4004

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\1699868617_0\360TS_Setup.exe
          Filesize

          94.5MB

          MD5

          4c5d0e781b7c7cb54d72fcb94a08d297

          SHA1

          e0cb018b213a02dca399b4dbeaa493d6c55b25e3

          SHA256

          1a437bec0a4f32636fafde2151a57128a3735c3ced65a45750a1b34a67645dc8

          SHA512

          34b9b29a67fa8e79770702df835284c1533b79f61c755feff6477a93a0eef9a0aa2aca162945da9045aaaa71c5755a5dd76dd97afe10f3d5b541eb282d725926

          Download Submit

        • C:\Program Files (x86)\1699868617_0\360TS_Setup.exe
          Filesize

          94.5MB

          MD5

          4c5d0e781b7c7cb54d72fcb94a08d297

          SHA1

          e0cb018b213a02dca399b4dbeaa493d6c55b25e3

          SHA256

          1a437bec0a4f32636fafde2151a57128a3735c3ced65a45750a1b34a67645dc8

          SHA512

          34b9b29a67fa8e79770702df835284c1533b79f61c755feff6477a93a0eef9a0aa2aca162945da9045aaaa71c5755a5dd76dd97afe10f3d5b541eb282d725926

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\[email protected]
          Filesize

          655B

          MD5

          5ed78a4c632dcaf6e1204dc7b07d30ca

          SHA1

          7abdb6c0da46f395b7c36b96eb2bc40a8c9309e6

          SHA256

          a474606683858e8db91a960efce486d01cfca32459563c525dc767057fb20a3b

          SHA512

          5af0f93cc7e1a961db1aada0fe968c6497b4f7a23b75a76b064a45a86287588cd76777111272083c58dbc37c9ed41946d9260875c5e2527d5f29e4573d0c5209

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
          Filesize

          829B

          MD5

          1ba7ca1ad3aa2da1aa01b3e0d1ea8043

          SHA1

          70d9553fb02e2409905398b7e17aadeba1dff5f1

          SHA256

          a62d34b4112007d79f5b4c6e56f8b0522a0d17f010709d32498e66dcd519ea0f

          SHA512

          92b727e19ab7495360136bf61e6b1dc7d2d44b3ec40acdffc8b58ff43ec78b4a461cf9a53c6772763a6a89519cf1da5970c11c645914b1af873a34a0717de457

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1699868617_00000000_base\360base.dll
          Filesize

          884KB

          MD5

          8c42fc725106cf8276e625b4f97861bc

          SHA1

          9c4140730cb031c29fc63e17e1504693d0f21c13

          SHA256

          d1ca92aa0789ee87d45f9f3c63e0e46ad2997b09605cbc2c57da2be6b8488c22

          SHA512

          f3c33dfe8e482692d068bf2185bec7d0d2bb232e6828b0bc8dc867da9e7ca89f9356fde87244fe686e3830f957c052089a87ecff4e44842a1a7848246f0ba105

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1699868617_00000000_base\360base.dll
          Filesize

          884KB

          MD5

          8c42fc725106cf8276e625b4f97861bc

          SHA1

          9c4140730cb031c29fc63e17e1504693d0f21c13

          SHA256

          d1ca92aa0789ee87d45f9f3c63e0e46ad2997b09605cbc2c57da2be6b8488c22

          SHA512

          f3c33dfe8e482692d068bf2185bec7d0d2bb232e6828b0bc8dc867da9e7ca89f9356fde87244fe686e3830f957c052089a87ecff4e44842a1a7848246f0ba105

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1699868629_00000000_base\360base.dll
          Filesize

          884KB

          MD5

          8c42fc725106cf8276e625b4f97861bc

          SHA1

          9c4140730cb031c29fc63e17e1504693d0f21c13

          SHA256

          d1ca92aa0789ee87d45f9f3c63e0e46ad2997b09605cbc2c57da2be6b8488c22

          SHA512

          f3c33dfe8e482692d068bf2185bec7d0d2bb232e6828b0bc8dc867da9e7ca89f9356fde87244fe686e3830f957c052089a87ecff4e44842a1a7848246f0ba105

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
          Filesize

          94.5MB

          MD5

          4c5d0e781b7c7cb54d72fcb94a08d297

          SHA1

          e0cb018b213a02dca399b4dbeaa493d6c55b25e3

          SHA256

          1a437bec0a4f32636fafde2151a57128a3735c3ced65a45750a1b34a67645dc8

          SHA512

          34b9b29a67fa8e79770702df835284c1533b79f61c755feff6477a93a0eef9a0aa2aca162945da9045aaaa71c5755a5dd76dd97afe10f3d5b541eb282d725926

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
          Filesize

          94.5MB

          MD5

          4c5d0e781b7c7cb54d72fcb94a08d297

          SHA1

          e0cb018b213a02dca399b4dbeaa493d6c55b25e3

          SHA256

          1a437bec0a4f32636fafde2151a57128a3735c3ced65a45750a1b34a67645dc8

          SHA512

          34b9b29a67fa8e79770702df835284c1533b79f61c755feff6477a93a0eef9a0aa2aca162945da9045aaaa71c5755a5dd76dd97afe10f3d5b541eb282d725926

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
          Filesize

          94.5MB

          MD5

          4c5d0e781b7c7cb54d72fcb94a08d297

          SHA1

          e0cb018b213a02dca399b4dbeaa493d6c55b25e3

          SHA256

          1a437bec0a4f32636fafde2151a57128a3735c3ced65a45750a1b34a67645dc8

          SHA512

          34b9b29a67fa8e79770702df835284c1533b79f61c755feff6477a93a0eef9a0aa2aca162945da9045aaaa71c5755a5dd76dd97afe10f3d5b541eb282d725926

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\{30F6D6E0-6BA4-4fbf-8E94-6C3CD75C6EE5}.tmp\360P2SP.dll
          Filesize

          824KB

          MD5

          fc1796add9491ee757e74e65cedd6ae7

          SHA1

          603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

          SHA256

          bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

          SHA512

          8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\{30F6D6E0-6BA4-4fbf-8E94-6C3CD75C6EE5}.tmp\360P2SP.dll
          Filesize

          824KB

          MD5

          fc1796add9491ee757e74e65cedd6ae7

          SHA1

          603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

          SHA256

          bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

          SHA512

          8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\{F8E38BF2-30E6-4160-AE7B-FA828029440F}.tmp
          Filesize

          3KB

          MD5

          b1ddd3b1895d9a3013b843b3702ac2bd

          SHA1

          71349f5c577a3ae8acb5fbce27b18a203bf04ede

          SHA256

          46cda5ad256bf373f5ed0b2a20efa5275c1ffd96864c33f3727e76a3973f4b3c

          SHA512

          93e6c10c4a8465bc2e58f4c7eb300860186ddc5734599bcdad130ff9c8fd324443045eac54bbc667b058ac1fa271e5b7645320c6e3fc2f28cc5f824096830de1

          Download Submit

        • memory/1432-37-0x0000000003D60000-0x0000000003D61000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1432-9-0x0000000003D60000-0x0000000003D61000-memory.dmp

          Filesize

          4KB

          Download