Analysis
-
max time kernel
28s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 13:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
abf08f07efa8db5654e709426160725d.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
abf08f07efa8db5654e709426160725d.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
abf08f07efa8db5654e709426160725d.exe
-
Size
60KB
-
MD5
abf08f07efa8db5654e709426160725d
-
SHA1
8318d4b8d669de17574ea4d593b3dfaf900eb6c4
-
SHA256
d4d6f89b7199b007643cd661ce2674353bda468adb9a306e1acfd1240238a5cc
-
SHA512
9f18d87ca29f1a64349d2a0e5fe18150c4625775c79f01c71e04113618bb108ffacea28fbe434eb6802e35c7e0d169548925d145f841ed46e3a07f6eed714728
-
SSDEEP
768:vXKKOM9rPeD0nD+iWHTiOHTZbO0lBoBadfouomqiD7bcYq6oW1GOUqyhpQQuIXj3:/gM9T0SD+iW+4Y4kjp2lKw
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\.exe.exe.exe init" abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\cricket.exe" abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\.exe.exe.exe init" .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\cricket.exe" .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\.exe.exe.exe init" cricket.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\cricket.exe" cricket.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" abf08f07efa8db5654e709426160725d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" .exe.exe.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cricket.exe -
Disables RegEdit via registry modification 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cricket.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" abf08f07efa8db5654e709426160725d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" .exe.exe.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 2 IoCs
pid Process 4312 .exe.exe.exe 2456 cricket.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cricket = "C:\\Windows\\cricket.exe" .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\.exe.exe = "C:\\Windows\\.exe.exe.exe init" cricket.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cricket = "C:\\Windows\\cricket.exe" cricket.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\.exe.exe = "C:\\Windows\\.exe.exe.exe init" abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cricket = "C:\\Windows\\cricket.exe" abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\.exe.exe = "C:\\Windows\\.exe.exe.exe init" .exe.exe.exe -
Drops autorun.inf file 1 TTPs 11 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf abf08f07efa8db5654e709426160725d.exe File opened for modification F:\autorun.inf abf08f07efa8db5654e709426160725d.exe File opened for modification C:\autorun.inf .exe.exe.exe File opened for modification F:\autorun.inf .exe.exe.exe File created F:\autorun.inf cricket.exe File created C:\autorun.inf .exe.exe.exe File created C:\autorun.inf abf08f07efa8db5654e709426160725d.exe File created F:\autorun.inf abf08f07efa8db5654e709426160725d.exe File opened for modification C:\autorun.inf cricket.exe File opened for modification F:\autorun.inf cricket.exe File created F:\autorun.inf .exe.exe.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\userinit.exe abf08f07efa8db5654e709426160725d.exe File opened for modification C:\Windows\SysWOW64\userinit.exe .exe.exe.exe File opened for modification C:\Windows\SysWOW64\userinit.exe cricket.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\.exe.exe.exe abf08f07efa8db5654e709426160725d.exe File opened for modification C:\Windows\.exe.exe.exe abf08f07efa8db5654e709426160725d.exe File created C:\Windows\cricket.exe .exe.exe.exe File opened for modification C:\Windows\cricket.exe .exe.exe.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.JSE\ .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs cricket.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.jse cricket.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.scr\ abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pif .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg cricket.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat cricket.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hta cricket.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\ cricket.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.scr\ .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key abf08f07efa8db5654e709426160725d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs abf08f07efa8db5654e709426160725d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.msi abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.msi\ .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.com cricket.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.msi\ cricket.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.com\ abf08f07efa8db5654e709426160725d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ abf08f07efa8db5654e709426160725d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.scr abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile" abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hta .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.JSE\ cricket.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pif\ cricket.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\ abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ cricket.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ cricket.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pif\ abf08f07efa8db5654e709426160725d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pif\ .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js cricket.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf cricket.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe abf08f07efa8db5654e709426160725d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.msi .exe.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ cricket.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ abf08f07efa8db5654e709426160725d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh abf08f07efa8db5654e709426160725d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hta abf08f07efa8db5654e709426160725d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.jse .exe.exe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.jse abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ cricket.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg abf08f07efa8db5654e709426160725d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ abf08f07efa8db5654e709426160725d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2068 abf08f07efa8db5654e709426160725d.exe 2068 abf08f07efa8db5654e709426160725d.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe 4312 .exe.exe.exe 4312 .exe.exe.exe 2456 cricket.exe 2456 cricket.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2068 abf08f07efa8db5654e709426160725d.exe 4312 .exe.exe.exe 2456 cricket.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2068 wrote to memory of 4312 2068 abf08f07efa8db5654e709426160725d.exe 99 PID 2068 wrote to memory of 4312 2068 abf08f07efa8db5654e709426160725d.exe 99 PID 2068 wrote to memory of 4312 2068 abf08f07efa8db5654e709426160725d.exe 99 PID 4312 wrote to memory of 2456 4312 .exe.exe.exe 100 PID 4312 wrote to memory of 2456 4312 .exe.exe.exe 100 PID 4312 wrote to memory of 2456 4312 .exe.exe.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\abf08f07efa8db5654e709426160725d.exe"C:\Users\Admin\AppData\Local\Temp\abf08f07efa8db5654e709426160725d.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\.exe.exe.exeC:\Windows\.exe.exe.exe f2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\cricket.exeC:\Windows\cricket.exe f3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2456
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵PID:3108
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5abf08f07efa8db5654e709426160725d
SHA18318d4b8d669de17574ea4d593b3dfaf900eb6c4
SHA256d4d6f89b7199b007643cd661ce2674353bda468adb9a306e1acfd1240238a5cc
SHA5129f18d87ca29f1a64349d2a0e5fe18150c4625775c79f01c71e04113618bb108ffacea28fbe434eb6802e35c7e0d169548925d145f841ed46e3a07f6eed714728
-
Filesize
184B
MD5599cba5fbdb1def6653322fad350bbe6
SHA1b288d1df3e8b8c9aea6903b74c65c66e63340b0b
SHA256409c5ef56533bf6cbe403e5493c81dd4d7ba97a8c210247f488681ff767e35fe
SHA51208fcb2ff0ef17cb432fc167ecbe3c0f517aa9907142247468c3f156c0dcf32c4030e13d2701d38a1303bbc814d847f981faeb11ba43bc7f1475d23cbdbe1249f