Analysis
- max time kernel
23s - max time network
27s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system - submitted
23/02/2024, 14:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0219830219301290321012notas.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0219830219301290321012notas.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
14 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target 0219830219301290321012notas.exe
- Size 2.0MB
- Sample240223-rw1g2abb25
- SHA256 21340c04b12af92f3bd3dd076e5a4f20c0fe5558461b5ff3f848e5d5b7183322
- MD5 a548469585481a1b7f98c9b09d271349
- SHA1 677eabeb661d965c7d3d5ff6f6b9336e27b80b91
- SHA512 b40102429700b056c01953414b3a8f4c86242ee3d98478a834cb49fcaeca0e668e9d297af67c48733eeaa5bda7f6d3962b2248ce1adadf5969ffea997ecfffc1
- SSDEEP 49152:UMBQcZoX44p0k4icOpl048bBIaPeF/BXoG05ChlszkSJl:UMBQWo7pZuOplcSas/poG0Cvs3
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Creates new service(s) 1 TTPs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation Update.exe Key value queried \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation BumpFiles.exe - Executes dropped EXE 2 IoCs
pid Process 4464 Update.exe 1452 BumpFiles.exe - Loads dropped DLL 2 IoCs
pid Process 1452 BumpFiles.exe 1452 BumpFiles.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft.NET\MpClient.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\fuge.zip1 BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\DefenderCSP.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\MpDlpCmd.exe BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\MpOAV.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\OfflineScannerShell.exe BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\endpointdlp.dll BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\MpAsDesc.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\pt-BR\MsMpRes.dll.mui BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\pt-BR\ProtectionManagement.mfl BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\MpClient.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\AmStatusInstall.mof BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\AmStatusInstall.mof BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\MpCommu.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\en-US\MpAsDesc.dll.mui BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\MpCmdRun.exe BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\AMMonitoringProvider.dll BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\NisSrv.exe BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\bin01.zip BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\EppManifest.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\en-US\ProtectionManagement.mfl BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\en-US\ProtectionManagement.mfl BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\MpCmdRun.dll BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\MpProvider.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\FepUnregister.mof BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\MsMpRes.dll BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\en-US\OfflineScannerShell.exe.mui BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\en-US\ProtectionManagement_Uninstall.mfl BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\en-US\shellext.dll.mui BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\MpCmdRun.exe BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\en-US\MsMpRes.dll.mui BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\OfflineScannerShell.exe BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\ClientWMIInstall.mof BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\MpAzSubmit.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\MpDetoursCopyAccelerator.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\ThirdPartyNotices.txt BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\en-US\shellext.dll.mui BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\NisSrv.exe BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\MsMpLics.dll BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\AMMonitoringProvider.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\ProtectionManagement.mof BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\ProtectionManagement_Uninstall.mof BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\pt-BR\OfflineScannerShell.exe.mui BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\pt-BR\ProtectionManagement.dll.mui BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\MsMpCom.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\en-US\EppManifest.dll.mui BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\en-US\ProtectionManagement_Uninstall.mfl BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\pt-BR\OfflineScannerShell.exe.mui BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\AmMonitoringInstall.mof BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\ClientWMIInstall.mof BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\EppManifest.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\MpAsDesc.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\MpRtp.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\MsMpEng.exe BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\MpProvider.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\pt-BR\ProtectionManagement.dll.mui BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\pt-BR\shellext.dll.mui BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\MpDetoursCopyAccelerator.dll BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\MsMpLics.dll BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\MpEvMsg.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\MsMpCom.dll BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\ProtectionManagement_Uninstall.mof BumpFiles.exe File created C:\Program Files (x86)\Microsoft.NET\pt-BR\EppManifest.dll.mui BumpFiles.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\EppManifest.dll BumpFiles.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4712 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "70" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4464 Update.exe 4464 Update.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2400 shutdown.exe Token: SeRemoteShutdownPrivilege 2400 shutdown.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4464 Update.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1304 LogonUI.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4912 wrote to memory of 4464 4912 0219830219301290321012notas.exe 88 PID 4912 wrote to memory of 4464 4912 0219830219301290321012notas.exe 88 PID 4464 wrote to memory of 1452 4464 Update.exe 92 PID 4464 wrote to memory of 1452 4464 Update.exe 92 PID 4464 wrote to memory of 1452 4464 Update.exe 92 PID 1452 wrote to memory of 704 1452 BumpFiles.exe 96 PID 1452 wrote to memory of 704 1452 BumpFiles.exe 96 PID 1452 wrote to memory of 704 1452 BumpFiles.exe 96 PID 704 wrote to memory of 4712 704 cmd.exe 98 PID 704 wrote to memory of 4712 704 cmd.exe 98 PID 704 wrote to memory of 4712 704 cmd.exe 98 PID 1452 wrote to memory of 2400 1452 BumpFiles.exe 99 PID 1452 wrote to memory of 2400 1452 BumpFiles.exe 99 PID 1452 wrote to memory of 2400 1452 BumpFiles.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\0219830219301290321012notas.exe"C:\Users\Admin\AppData\Local\Temp\0219830219301290321012notas.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\ContentPack\app-1.0.0\BumpFiles.exe"C:\Users\Admin\AppData\Local\ContentPack\app-1.0.0\BumpFiles.exe" --squirrel-firstrun3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc create WdCmdSvc binPath= "C:\Program Files (x86)\Microsoft.NET\MpCmdRun.exe" start= auto4⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\sc.exesc create WdCmdSvc binPath= "C:\Program Files (x86)\Microsoft.NET\MpCmdRun.exe" start= auto5⤵
- Launches sc.exe
PID:4712
-
-
-
C:\WINDOWS\SysWOW64\shutdown.exeC:\WINDOWS\system32\shutdown.exe -r -t 1 -f4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3955855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft.NET\fuge.zip
- Size 1.2MB
- SHA256 8c7e4033a798b5eb174848fbc59c448c1fbccb511dfc1f706c3af464d3eda509
- MD5 fa668565029950749e6c7f4f1083c993
- SHA1 5723bc9e2f60dd7dabd21c4a84f00b38e95a8f54
- SHA512 f5810a9b3c9ace3224fef1e13779c36838a5963c9cf16e4d57740dedebe1272d2d79945a4cac48af352031b10af6e62fae4a1295620c6fa9ec2dabb496044696
- SSDEEP 24576:UGe8MBua0XYx0u3Z7BVOk30Xztakxn7XX/V9rlmsUgx1QfhDX3ihK:Hevuu0uopokd99rDUIYDyhK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ContentPack\BumpFiles.exe
- Size 191KB
- SHA256 77d6c8e668f33dfda787cbf82bdf8d88f9b66b36f3631becae2ae92e9c9e9229
- MD5 4490642c30f86355647a3154d5a25d7a
- SHA1 fd368f63a66c554b8e3a493d8b7bc2b834cd17a5
- SHA512 6563482f84b9fbfc4d14c677ed4e605bd1f1d0976dfa2b7d0d08cba850814a5006b314224e9017e6a653cba61d0b4a4f51ff83af19824f00aa39ddfafa6cc81b
- SSDEEP 3072:GZzaqLh5m21b4n86fZHi8c62bdq32BsWtEGwF4JOAg0FuDTT6E675MU:GZzvhs2Z4n1E7g34XtVYAOfTd0uU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ContentPack\app-1.0.0\BumpFiles.exe
- Size 21KB
- SHA256 f8f00900edba2f64bf136dd0b6c83caf07c72f24f3d49c78b7ea24757fdbc6d0
- MD5 cc09bb7fdefc5763ccb3cf7dae2d76cf
- SHA1 8610d07f27a961066134d728c82eb8e5f22e7e8f
- SHA512 0c518487aa5bad357bd19ad09c6cfe0b8bb522d74a916d36cf01f1bd194b59cd8457784b199dc953570ad7ef8ce67464d066bda51e31b055c9d4d5ca060d45c5
- SSDEEP 384:fC8JWIqWCL7oJ0GftpBjpdanCZkscHRN7js7ll7PCDG/7:VFQo6in8CCs4j877
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ContentPack\app-1.0.0\mpsvc.dll
- Size 2.6MB
- SHA256 ee471a3847795729bd73d097d74aba45400a291dd4da08a9e3c77052aac08884
- MD5 86e884477a0160a0915da06649371e5f
- SHA1 1c6ea93f1288891a2552982d69a8343189de80b7
- SHA512 7a38792efe388ed7b1ca53f6960758d7deb99ad0d4d08c12f3ba0e68d8cd902624b1a1eefe31073f8a86fb56ca3122ee15f405b99b99edc68b2814952fccc724
- SSDEEP 24576:fx7mODrQkzw50Ri82xXPIBa3dNcH4Jd2J7zJdB1SKW/V9YXFp+59MxFYz3sjD8T0:fEcz2x7UDd/SKKApKMxFYzXTw7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\SquirrelTemp\ContentPack-1.0.0-full.nupkg
- Size 1.1MB
- SHA256 bc4d61be88a05e537ccb5e85b6517a73b7c7a191f18aa6b815e7349129568f09
- MD5 7bdbde71a61ee412cb77156199eedc46
- SHA1 652938a112187aee90fad5c30c9d7575c3783552
- SHA512 dd9f580d439eedae81c24a78edf5b5a831d60cf6fffe3bd10209f889cca2f78916682450d7b089d56c6c6d762278f0384310db2ca4040edd37e33d8a0c31ae68
- SSDEEP 24576:CWQzq+aGgkz0SrQy75OYpk7LmMHseMOWsxam8p4/HND7mxcKizFWyT9IdgPSFBC:CJ9zey75OYpk7nMeMOBGulqCJ9I+PSFQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
- Size 80B
- SHA256 3c4cf29d3fada3ad626d0fbcc5c6087d206876b14cdc658947f02a058106e6ba
- MD5 2974bfb739b24b645f7958aba97741c4
- SHA1 7c874b7a39f81575653a4c11897de01a7735406a
- SHA512 6c59bb4f2b8d33b8fb9f8e3b3edcaa5d972565464525b34ba405630d449201d13e0ae373a67bf5275dabf34c7f6287e56f1b932bd4242b00b330e828e8aecdc6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
- Size 1.8MB
- SHA256 76359cd4b0349a83337b941332ad042c90351c2bb0a4628307740324c97984cc
- MD5 a560bad9e373ea5223792d60bede2b13
- SHA1 82a0da9b52741d8994f28ad9ed6cbd3e6d3538fa
- SHA512 58a1b4e1580273e1e5021dd2309b1841767d2a4be76ab4a7d4ff11b53fa9de068f6da67bf0dccfb19b4c91351387c0e6e200a2a864ec3fa737a1cb0970c8242c
- SSDEEP 24576:pWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:0t3UCiag6CKM2zCyZuOjJaxSS5qh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Keys\bin01.zip
- Size 142B
- SHA256 e2b2371f95d8d9cbfca301aff3441466e30453bbd37a42fa17daf4d85aa7e627
- MD5 57a37bd0840d0745a9481bcc25b5a792
- SHA1 e8b7c744981c0713de5ebb308897efcbd374fd11
- SHA512 08afa751874b49fb20adbec0c824609dae0decd6e747471ef8cb19fae299a65d21acc02185560669ed9e36cd74e2e4372b61e52eef34d5785e9bba3dc8fd431b
- MD5 SHA1 SHA512