raccoon | 5961d0a8ebdc116b674d3231b5c8b01b35d3c7a191b0bb8ab5bb7b14352cc065

Resubmissions

24/02/2024, 23:32

240224-3jlc5agg36 10

19/02/2024, 20:03

240219-ys4tlscg37 10

19/02/2024, 20:01

240219-yrrsnacb2z 10

Analysis

max time kernel
141s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Driver Booster 11 PRO.rar
Size

658KB
MD5

6d3ca847c423d6819dd364bd333572b6
SHA1

bfc6115fe0c41245f247d038737730fcd23c706d
SHA256

5961d0a8ebdc116b674d3231b5c8b01b35d3c7a191b0bb8ab5bb7b14352cc065
SHA512

eafe0185411812ea8ac561b2bf34a4f2551979252e1b42b1d045e523318c0de964c12c48aef7e8d91d667e836f3d3f2b7a3a62477a57440df25486cf9d92f102
SSDEEP

12288:vtSkbZjfeGDXtsLrWe6S4OqhECnTjRDMzNK0IFJWZZYbWhTkUuo:vzbgGDds+e74R7BAzPoUZqbW9kU7

Score

10^/10

raccoon ccf92b7fb8bdc5b3c5b2cea72a452ab2 stealer

Malware Config

Extracted

Family

raccoon

Botnet

ccf92b7fb8bdc5b3c5b2cea72a452ab2

http://46.151.31.26:80/

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/1708-184-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/1708-185-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 2144 created 1140	2144	Rosa.pif	7
PID 1264 created 1140	1264	Rosa.pif	7
PID 1216 created 1140	1216	Rosa.pif	7
PID 1996 created 1140	1996	Rosa.pif	7
PID 1652 created 1140	1652	Rosa.pif	7
PID 2976 created 1140	2976	Rosa.pif	7
PID 800 created 1140	800	Rosa.pif	7

Executes dropped EXE 21 IoCs

pid	Process
2380	Driver Booster 11 PRO License.exe
2144	Rosa.pif
2388	Driver Booster 11 PRO License.exe
1264	Rosa.pif
748	Driver Booster 11 PRO License.exe
1216	Rosa.pif
1668	Driver Booster 11 PRO License.exe
1996	Rosa.pif
2244	Driver Booster 11 PRO License.exe
1636	Rosa.pif
1652	Rosa.pif
2476	Rosa.pif
1708	Rosa.pif
2196	Rosa.pif
1812	Rosa.pif
932	Driver Booster 11 PRO License.exe
1520	Driver Booster 11 PRO License.exe
2976	Rosa.pif
800	Rosa.pif
2904	Rosa.pif
2016	Rosa.pif

Loads dropped DLL 14 IoCs

pid	Process
1584	cmd.exe
1520	cmd.exe
1868	cmd.exe
1476	cmd.exe
2144	Rosa.pif
1264	Rosa.pif
1216	Rosa.pif
2500	cmd.exe
1996	Rosa.pif
1652	Rosa.pif
2784	cmd.exe
1808	cmd.exe
2976	Rosa.pif
800	Rosa.pif

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2144 set thread context of 1636	2144	Rosa.pif	84
PID 1264 set thread context of 2476	1264	Rosa.pif	87
PID 1216 set thread context of 1708	1216	Rosa.pif	97
PID 1996 set thread context of 2196	1996	Rosa.pif	106
PID 1652 set thread context of 1812	1652	Rosa.pif	107
PID 2976 set thread context of 2904	2976	Rosa.pif	135
PID 800 set thread context of 2016	800	Rosa.pif	136

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 14 IoCs

Process Discovery

T1057

pid	Process
2644	tasklist.exe
2892	tasklist.exe
1628	tasklist.exe
2284	tasklist.exe
2392	tasklist.exe
2044	tasklist.exe
2084	tasklist.exe
528	tasklist.exe
2220	tasklist.exe
2152	tasklist.exe
1604	tasklist.exe
1460	tasklist.exe
2960	tasklist.exe
2924	tasklist.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2236	NOTEPAD.EXE

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
536	PING.EXE
1312	PING.EXE
2124	PING.EXE
2664	PING.EXE
1152	PING.EXE
2136	PING.EXE
288	PING.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2144	Rosa.pif
2144	Rosa.pif
2144	Rosa.pif
1264	Rosa.pif
1264	Rosa.pif
1264	Rosa.pif
1216	Rosa.pif
1216	Rosa.pif
1216	Rosa.pif
1996	Rosa.pif
1996	Rosa.pif
1996	Rosa.pif
2144	Rosa.pif
1264	Rosa.pif
1216	Rosa.pif
1652	Rosa.pif
1652	Rosa.pif
1652	Rosa.pif
1996	Rosa.pif
1652	Rosa.pif
2976	Rosa.pif
2976	Rosa.pif
2976	Rosa.pif
800	Rosa.pif
800	Rosa.pif
800	Rosa.pif
2524	7zFM.exe
2976	Rosa.pif
800	Rosa.pif

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	7zFM.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeRestorePrivilege	2524	7zFM.exe
Token: 35	2524	7zFM.exe
Token: SeSecurityPrivilege	2524	7zFM.exe
Token: SeDebugPrivilege	2644	tasklist.exe
Token: SeDebugPrivilege	2220	tasklist.exe
Token: SeDebugPrivilege	2044	tasklist.exe
Token: SeDebugPrivilege	2892	tasklist.exe
Token: SeDebugPrivilege	1628	tasklist.exe
Token: SeDebugPrivilege	2152	tasklist.exe
Token: SeDebugPrivilege	2084	tasklist.exe
Token: SeDebugPrivilege	2284	tasklist.exe
Token: SeDebugPrivilege	2392	tasklist.exe
Token: SeDebugPrivilege	1604	tasklist.exe
Token: SeDebugPrivilege	1460	tasklist.exe
Token: SeDebugPrivilege	528	tasklist.exe
Token: SeDebugPrivilege	2960	tasklist.exe
Token: SeDebugPrivilege	2924	tasklist.exe
Token: SeSecurityPrivilege	2524	7zFM.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
2524	7zFM.exe
2524	7zFM.exe
2144	Rosa.pif
2144	Rosa.pif
2144	Rosa.pif
1264	Rosa.pif
1264	Rosa.pif
1264	Rosa.pif
1216	Rosa.pif
1216	Rosa.pif
1216	Rosa.pif
1996	Rosa.pif
1996	Rosa.pif
1996	Rosa.pif
1652	Rosa.pif
1652	Rosa.pif
1652	Rosa.pif
2976	Rosa.pif
2976	Rosa.pif
2976	Rosa.pif
800	Rosa.pif
800	Rosa.pif
800	Rosa.pif
2524	7zFM.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
2144	Rosa.pif
2144	Rosa.pif
2144	Rosa.pif
1264	Rosa.pif
1264	Rosa.pif
1264	Rosa.pif
1216	Rosa.pif
1216	Rosa.pif
1216	Rosa.pif
1996	Rosa.pif
1996	Rosa.pif
1996	Rosa.pif
1652	Rosa.pif
1652	Rosa.pif
1652	Rosa.pif
2976	Rosa.pif
2976	Rosa.pif
2976	Rosa.pif
800	Rosa.pif
800	Rosa.pif
800	Rosa.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2524	2900	cmd.exe	29
PID 2900 wrote to memory of 2524	2900	cmd.exe	29
PID 2900 wrote to memory of 2524	2900	cmd.exe	29
PID 2380 wrote to memory of 1584	2380	Driver Booster 11 PRO License.exe	33
PID 2380 wrote to memory of 1584	2380	Driver Booster 11 PRO License.exe	33
PID 2380 wrote to memory of 1584	2380	Driver Booster 11 PRO License.exe	33
PID 2380 wrote to memory of 1584	2380	Driver Booster 11 PRO License.exe	33
PID 1584 wrote to memory of 2644	1584	cmd.exe	35
PID 1584 wrote to memory of 2644	1584	cmd.exe	35
PID 1584 wrote to memory of 2644	1584	cmd.exe	35
PID 1584 wrote to memory of 2644	1584	cmd.exe	35
PID 1584 wrote to memory of 2668	1584	cmd.exe	36
PID 1584 wrote to memory of 2668	1584	cmd.exe	36
PID 1584 wrote to memory of 2668	1584	cmd.exe	36
PID 1584 wrote to memory of 2668	1584	cmd.exe	36
PID 1584 wrote to memory of 2220	1584	cmd.exe	38
PID 1584 wrote to memory of 2220	1584	cmd.exe	38
PID 1584 wrote to memory of 2220	1584	cmd.exe	38
PID 1584 wrote to memory of 2220	1584	cmd.exe	38
PID 1584 wrote to memory of 2604	1584	cmd.exe	39
PID 1584 wrote to memory of 2604	1584	cmd.exe	39
PID 1584 wrote to memory of 2604	1584	cmd.exe	39
PID 1584 wrote to memory of 2604	1584	cmd.exe	39
PID 1584 wrote to memory of 1708	1584	cmd.exe	40
PID 1584 wrote to memory of 1708	1584	cmd.exe	40
PID 1584 wrote to memory of 1708	1584	cmd.exe	40
PID 1584 wrote to memory of 1708	1584	cmd.exe	40
PID 1584 wrote to memory of 352	1584	cmd.exe	41
PID 1584 wrote to memory of 352	1584	cmd.exe	41
PID 1584 wrote to memory of 352	1584	cmd.exe	41
PID 1584 wrote to memory of 352	1584	cmd.exe	41
PID 1584 wrote to memory of 1268	1584	cmd.exe	42
PID 1584 wrote to memory of 1268	1584	cmd.exe	42
PID 1584 wrote to memory of 1268	1584	cmd.exe	42
PID 1584 wrote to memory of 1268	1584	cmd.exe	42
PID 1584 wrote to memory of 2144	1584	cmd.exe	43
PID 1584 wrote to memory of 2144	1584	cmd.exe	43
PID 1584 wrote to memory of 2144	1584	cmd.exe	43
PID 1584 wrote to memory of 2144	1584	cmd.exe	43
PID 1584 wrote to memory of 288	1584	cmd.exe	44
PID 1584 wrote to memory of 288	1584	cmd.exe	44
PID 1584 wrote to memory of 288	1584	cmd.exe	44
PID 1584 wrote to memory of 288	1584	cmd.exe	44
PID 2388 wrote to memory of 1520	2388	Driver Booster 11 PRO License.exe	47
PID 2388 wrote to memory of 1520	2388	Driver Booster 11 PRO License.exe	47
PID 2388 wrote to memory of 1520	2388	Driver Booster 11 PRO License.exe	47
PID 2388 wrote to memory of 1520	2388	Driver Booster 11 PRO License.exe	47
PID 1520 wrote to memory of 2044	1520	cmd.exe	49
PID 1520 wrote to memory of 2044	1520	cmd.exe	49
PID 1520 wrote to memory of 2044	1520	cmd.exe	49
PID 1520 wrote to memory of 2044	1520	cmd.exe	49
PID 1520 wrote to memory of 2424	1520	cmd.exe	50
PID 1520 wrote to memory of 2424	1520	cmd.exe	50
PID 1520 wrote to memory of 2424	1520	cmd.exe	50
PID 1520 wrote to memory of 2424	1520	cmd.exe	50
PID 1520 wrote to memory of 2892	1520	cmd.exe	51
PID 1520 wrote to memory of 2892	1520	cmd.exe	51
PID 1520 wrote to memory of 2892	1520	cmd.exe	51
PID 1520 wrote to memory of 2892	1520	cmd.exe	51
PID 1520 wrote to memory of 2828	1520	cmd.exe	52
PID 1520 wrote to memory of 2828	1520	cmd.exe	52
PID 1520 wrote to memory of 2828	1520	cmd.exe	52
PID 1520 wrote to memory of 2828	1520	cmd.exe	52
PID 1520 wrote to memory of 2156	1520	cmd.exe	53

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1140
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\Driver Booster 11 PRO.rar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Driver Booster 11 PRO.rar"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2524
  - - C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOCD9F0C47\Instructions.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:2236
- C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe
  "C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Assume Assume.bat & Assume.bat & exit
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2644
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2220
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:2604
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 10122
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Fields + Bronze + Pressing + Extending + Administrator 10122\Rosa.pif
      4⤵
      PID:352
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Processing 10122\e
      4⤵
      PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10122\Rosa.pif
      10122\Rosa.pif 10122\e
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2144
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:288
- C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe
  "C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Assume Assume.bat & Assume.bat & exit
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2044
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2892
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:2828
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 10138
      4⤵
      PID:2156
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Fields + Bronze + Pressing + Extending + Administrator 10138\Rosa.pif
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Processing 10138\e
      4⤵
      PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\10138\Rosa.pif
      10138\Rosa.pif 10138\e
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1264
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:536
- C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe
  "C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe"
  2⤵
  - Executes dropped EXE
  PID:748
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Assume Assume.bat & Assume.bat & exit
    3⤵
    - Loads dropped DLL
    PID:1868
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1628
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:2996
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2152
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:412
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 10148
      4⤵
      PID:2060
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Fields + Bronze + Pressing + Extending + Administrator 10148\Rosa.pif
      4⤵
      PID:2784
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Processing 10148\e
      4⤵
      PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\10148\Rosa.pif
      10148\Rosa.pif 10148\e
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1216
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:1312
- C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe
  "C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe"
  2⤵
  - Executes dropped EXE
  PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Assume Assume.bat & Assume.bat & exit
    3⤵
    - Loads dropped DLL
    PID:1476
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2084
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2284
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:1756
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 10168
      4⤵
      PID:2240
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Fields + Bronze + Pressing + Extending + Administrator 10168\Rosa.pif
      4⤵
      PID:892
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Processing 10168\e
      4⤵
      PID:2136
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.003\10168\Rosa.pif
      10168\Rosa.pif 10168\e
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1996
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10122\Rosa.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10122\Rosa.pif
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\10138\Rosa.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\10138\Rosa.pif
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe
  "C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe"
  2⤵
  - Executes dropped EXE
  PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Assume Assume.bat & Assume.bat & exit
    3⤵
    - Loads dropped DLL
    PID:2500
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:2400
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2392
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1604
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 10200
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Fields + Bronze + Pressing + Extending + Administrator 10200\Rosa.pif
      4⤵
      PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Processing 10200\e
      4⤵
      PID:548
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.004\10200\Rosa.pif
      10200\Rosa.pif 10200\e
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1652
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:2664
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\10148\Rosa.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\10148\Rosa.pif
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.003\10168\Rosa.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.003\10168\Rosa.pif
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.004\10200\Rosa.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.004\10200\Rosa.pif
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe
  "C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe"
  2⤵
  - Executes dropped EXE
  PID:932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Assume Assume.bat & Assume.bat & exit
    3⤵
    - Loads dropped DLL
    PID:2784
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1460
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:1004
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:528
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 10302
      4⤵
      PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Fields + Bronze + Pressing + Extending + Administrator 10302\Rosa.pif
      4⤵
      PID:1764
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Processing 10302\e
      4⤵
      PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.005\10302\Rosa.pif
      10302\Rosa.pif 10302\e
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2976
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:1152
- C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe
  "C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe"
  2⤵
  - Executes dropped EXE
  PID:1520
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Assume Assume.bat & Assume.bat & exit
    3⤵
    - Loads dropped DLL
    PID:1808
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2960
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:1696
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2924
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:356
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 10305
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Fields + Bronze + Pressing + Extending + Administrator 10305\Rosa.pif
      4⤵
      PID:880
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Processing 10305\e
      4⤵
      PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.006\10305\Rosa.pif
      10305\Rosa.pif 10305\e
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:800
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:2136
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.005\10302\Rosa.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.005\10302\Rosa.pif
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.006\10305\Rosa.pif
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.006\10305\Rosa.pif
  2⤵
  - Executes dropped EXE
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Administrator

Filesize
178KB

MD5
d8f9dd4003de34471d0797f274ebe7bc

SHA1
393aceab75a29520961e52cd0756e8971f02f72a

SHA256
db576bf9cae0e2ec38f1efbcaad5e7941b3456bc7b9ab5d3570d281937ef007c

SHA512
bc34e3ee19055353eab85ef420a8ccbba81bc8ade7f745c7e7ca6fab6ebded5ffbce01bd2fec78bc8db661e89c62f021ff375d547670eb08050ac49e07ea657e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Assume

Filesize
10KB

MD5
8c4c658f59e7e8626cf7f8a382cbe005

SHA1
7ca0681bab8878b032d2f084275a487fea690bcc

SHA256
462506a044d309cde8677030483e35b4ad323f7f93b4f82c667aa0426017bb1a

SHA512
d2077ef00c1f8753d7cd27b56aa2bcd266b046c3fe25eca58265ff0cc0e990234889eafb38cf55c16c98105cbaa785f66c4575b977958a26a0a1919069413f27

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bronze

Filesize
115KB

MD5
7dea798d8550a7eb8c0dac613d328119

SHA1
3c2a6577e063b7371c52108393c8637f338c70cc

SHA256
7c418482ec85689387802871cc2bc4a031b68328a60b90122d4e3d84cea306cf

SHA512
7750be47bcdd5225dd73eb7e06c500d50b43fe961424cc6f4c09f78648848e10175b137d032d73fecd7b9cc5e6469889d98ab39735c183c3b05447e7237ca7f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Extending

Filesize
118KB

MD5
f2a6a75f93068cb427350af64f2b98a7

SHA1
e11e41958a8a3b68ff6a8a4bd126b9aff9849d0c

SHA256
28f253d9592bc6badf74dd1dbadda2d65a47e812cb2d75435b25f650cf06a9e5

SHA512
584bdb2eb53eaf86b85eff99c5f8253783421964e9ccc1d9226394b2135d75ef13d8d35369ebf569d5955fab5ba6acb98e6bf68a82a7b51a287470ac3816eefd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Fields

Filesize
293KB

MD5
b38a37e518db3dd0646287e647da2791

SHA1
80ec5fed671f51a07cc6f30a411bf91056e0e4e3

SHA256
f938df0350470599eda1c3359637627f8cc261038eb6d7438b883ce4c0722580

SHA512
5aaacfe5a3a033b9b07601b1ec1be3079d3244a2a42238cd498ff32f165bcb128a2442a84954fa92dfa3ef7bb32fd4f1013e51ff13deb222d97759c09af332db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pressing

Filesize
220KB

MD5
96b80b99cf941e0851f2d4c6c739563f

SHA1
7cb29861f9e3c81241558eb558f7b6766b9601c2

SHA256
348fcc34733289fb855961990e9c8a7fd0d0b6841fa915b11fea3f354666cbde

SHA512
7d64d6ddfb54beb647f56dc4bcd8f71b8477046c325e5bb35d88149c55a998f69822a6572945e12a4416ea2985d73da7235cc754beddb007c36fbc96a977c35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Processing

Filesize
401KB

MD5
f8a1fc75b3bb6e1cac4cfaa82e25b698

SHA1
ebd7573bdcbfc9ac51742d198cc3287689417cb2

SHA256
07760b8ddfaa45d173d7565e35147019b204cfa4d9009d90755f33062c8b4741

SHA512
cae5ea4f51058cb6bbb4aa70e50eec87be028a607f824ac80ee13b94dbc67489dad831900c4b45f45b79891aa9ab7b78e92748385547ebe7ac44c92f07c1013b

Download Submit
C:\Users\Admin\Desktop\Driver Booster 11 PRO License.exe

Filesize
770KB

MD5
27cf0c7d37e5ffbab9b1a163544f3321

SHA1
3ed7493f213a01f7c99a4d11f56cfa7f79f90d0a

SHA256
4f6eba5f100a37005509d15782ca2991de72d027be766ba779f20e956555c29b

SHA512
f9ac54ee39c7192406a51a6e506b420387b2314facc31656b1acd3a69fdcb3060553b42122c5a6f5092083d71c20d4304b1ed067e9b1e481951c1a4798e0fa2d

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10122\Rosa.pif

Filesize
924KB

MD5
848164d084384c49937f99d5b894253e

SHA1
3055ef803eeec4f175ebf120f94125717ee12444

SHA256
f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

SHA512
aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

Download Submit
memory/1708-181-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1708-184-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1708-185-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2144-56-0x0000000077D00000-0x0000000077DD6000-memory.dmp

Filesize
856KB

Download
memory/2144-145-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download