Overview
overview
10Static
static
774fa76f32b...6e.exe
windows7-x64
774fa76f32b...6e.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
10$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
10ConfigTsXP.exe
windows7-x64
7ConfigTsXP.exe
windows10-2004-x64
10TaskSwitchXP.chm
windows7-x64
1TaskSwitchXP.chm
windows10-2004-x64
10TaskSwitchXP.exe
windows7-x64
7TaskSwitchXP.exe
windows10-2004-x64
10scripts/ShowDelay.js
windows7-x64
1scripts/ShowDelay.js
windows10-2004-x64
10scripts/UnlockQ.js
windows7-x64
1scripts/UnlockQ.js
windows10-2004-x64
10scripts/WheelTab.js
windows7-x64
1scripts/WheelTab.js
windows10-2004-x64
10wa_ldr.exe
windows7-x64
1wa_ldr.exe
windows10-2004-x64
10uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
10$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
10Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:33
Behavioral task
behavioral1
Sample
74fa76f32b4cc3c485ad7169f8d9336e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
74fa76f32b4cc3c485ad7169f8d9336e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
ConfigTsXP.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
ConfigTsXP.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
TaskSwitchXP.chm
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
TaskSwitchXP.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
TaskSwitchXP.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
TaskSwitchXP.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
scripts/ShowDelay.js
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
scripts/ShowDelay.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
scripts/UnlockQ.js
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
scripts/UnlockQ.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
scripts/WheelTab.js
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
scripts/WheelTab.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
wa_ldr.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
wa_ldr.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
uninst.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
uninst.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20231215-en
General
-
Target
ConfigTsXP.exe
-
Size
109KB
-
MD5
0814c4c6fcb7c4a6ffc792467ca71dac
-
SHA1
42839bc929d21b0c2549cb099b4eded038f29dcc
-
SHA256
9155f0ad63805ba201b3b3efe4708466aff97105e9a5fe7c0fbc52549620f76e
-
SHA512
81ce1ad8f3cc113f7c38a9f62681f1694cd1089279beaf9d402a7be6685e85e1a2d37b4e9200df9a1d41352c300e9e2a8bc32fcdc07aac51e129049c0e54f972
-
SSDEEP
1536:Hng4S6g1S6qIqGmsOASZbCEogeNTEnwbws2c+xoPf3t3MV3S8bhnrsKnK:HrKU6v3O3bC3g2Tbb68Pf35OxdK
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral7/memory/2132-0-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral7/memory/1724-3-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral7/memory/2132-4-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral7/memory/1724-5-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral7/memory/1724-7-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral7/memory/2132-8-0x0000000002C00000-0x0000000002C26000-memory.dmp upx behavioral7/memory/2132-11-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral7/memory/1724-12-0x0000000000400000-0x0000000000426000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
TaskSwitchXP.exedescription pid process Token: 33 1724 TaskSwitchXP.exe Token: SeIncBasePriorityPrivilege 1724 TaskSwitchXP.exe Token: 33 1724 TaskSwitchXP.exe Token: SeIncBasePriorityPrivilege 1724 TaskSwitchXP.exe Token: 33 1724 TaskSwitchXP.exe Token: SeIncBasePriorityPrivilege 1724 TaskSwitchXP.exe Token: 33 1724 TaskSwitchXP.exe Token: SeIncBasePriorityPrivilege 1724 TaskSwitchXP.exe Token: 33 1724 TaskSwitchXP.exe Token: SeIncBasePriorityPrivilege 1724 TaskSwitchXP.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
TaskSwitchXP.exepid process 1724 TaskSwitchXP.exe 1724 TaskSwitchXP.exe 1724 TaskSwitchXP.exe 1724 TaskSwitchXP.exe 1724 TaskSwitchXP.exe 1724 TaskSwitchXP.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
TaskSwitchXP.exepid process 1724 TaskSwitchXP.exe 1724 TaskSwitchXP.exe 1724 TaskSwitchXP.exe 1724 TaskSwitchXP.exe 1724 TaskSwitchXP.exe 1724 TaskSwitchXP.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ConfigTsXP.exedescription pid process target process PID 2132 wrote to memory of 1724 2132 ConfigTsXP.exe TaskSwitchXP.exe PID 2132 wrote to memory of 1724 2132 ConfigTsXP.exe TaskSwitchXP.exe PID 2132 wrote to memory of 1724 2132 ConfigTsXP.exe TaskSwitchXP.exe PID 2132 wrote to memory of 1724 2132 ConfigTsXP.exe TaskSwitchXP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ConfigTsXP.exe"C:\Users\Admin\AppData\Local\Temp\ConfigTsXP.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\TaskSwitchXP.exeC:\Users\Admin\AppData\Local\Temp\TaskSwitchXP.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1724
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1724-3-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1724-5-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1724-7-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1724-12-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2132-0-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2132-1-0x0000000002C00000-0x0000000002C26000-memory.dmpFilesize
152KB
-
memory/2132-2-0x0000000002C00000-0x0000000002C26000-memory.dmpFilesize
152KB
-
memory/2132-4-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2132-8-0x0000000002C00000-0x0000000002C26000-memory.dmpFilesize
152KB
-
memory/2132-11-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB