Analysis

  • max time kernel
    117s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01-03-2024 18:08

General

  • Target

    Checkm8.info Software.exe

  • Size

    152.7MB

  • MD5

    a5b6acf1acb70f2cdf0539d0701d103c

  • SHA1

    269ef4e0f732bc5f0d2ee3fc28fa6351ee0cc901

  • SHA256

    df8bc2dfd6961766452c508d84917c40c109b8920d9c617b08cb62dc7c6668da

  • SHA512

    6404e5329e59062bbb650d74e6b9545dfc509748dd253096255372c0f25714b03201a1eab8270cbdcfbe20ea3ca8f0cdfd83fd74dafef15029384dec7dc32b55

  • SSDEEP

    3145728:D9CQPQmwzUK+vcNuD/AA8sSC23nLxtEvw7cftKUX1bDXADDe0/wDe0/0XUme:DjPpvAOSJ3nL7Evw7cVdRADDe04De0S4

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Checkm8.info Software.exe
    "C:\Users\Admin\AppData\Local\Temp\Checkm8.info Software.exe"
    1⤵
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1888
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 71A833C905DB1BF3890FA4155E5F99F5 C
      2⤵
      • Loads dropped DLL
      PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\Local\Temp\Cab8133.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\MSI89E6.tmp

    Filesize

    374KB

    MD5

    5e33a5224c4d523a2517ba8a96aaff42

    SHA1

    12e41a9380cc890053b5c7e19769c76bfa1608d4

    SHA256

    d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c

    SHA512

    bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1

  • C:\Users\Admin\AppData\Local\Temp\MSI8BAC.tmp

    Filesize

    831KB

    MD5

    0cca4ccd0c4a2712301f4488180404b7

    SHA1

    ee44cd435225b02709bb4b904e97d630d4ebe7df

    SHA256

    fbae7c3613e76953e08e58b4c48c9eb9cb2bcbca977cf4a04d614016d9b73cb6

    SHA512

    362e20be4d993111a6b469c8bd5cf8aeb167ed4e3bb1f0685f4dc81cb906b60d77f38a34fb2a0734484a424e8d550bcfd70170b40fda950e44b131713a2b2553

  • C:\Users\Admin\AppData\Local\Temp\Tar8165.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\Tar843A.tmp

    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

  • C:\Users\Admin\AppData\Roaming\Checkm8.info\Checkm8.info Software 4.7.1\install\Checkm8.info Software.msi

    Filesize

    2.8MB

    MD5

    30c152f87f12ab86a690f12d6c426fbb

    SHA1

    7672e0681df44cd40370d5bc9dbc3a787df829a6

    SHA256

    8eb7d687c3f364b997dceb9a88238baf9f9d4222994df7988513fba6b9ddda7a

    SHA512

    db7642ee854a4ee4f9d738ff85ea726ab0d097157f6aa4c9731a54a89caab34293b4955c7705a863efe467bc38fe2e6084166e44aa87e92f700810a57725cccf

  • \Users\Admin\AppData\Local\Temp\MSI8BAC.tmp

    Filesize

    263KB

    MD5

    d290b64225bb549c184d9d27b25a7fe3

    SHA1

    daadb33a3c7b4a8be8d67ab06bcc7f0f3fcbfd46

    SHA256

    c34c67ed246aaf47d9875239efd07c6269c4384b482de775f50d0890d3b320b3

    SHA512

    d462730e60655b12efa41336d1f4db8a0c587fa8fb26c01bb427e45e3bcdd06e47f7a0ebb17cf1e3479945108f80102a5d31986d1b4cfaa910a5f04bf1cbb614

  • memory/1888-0-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB