Overview

overview

7

Static

static

1

prolink-tools

windows7-x64

1

prolink-tools

windows10-2004-x64

7

Analysis

  • max time kernel
    77s
  • max time network
    84s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2024, 15:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    prolink-tools
  • Size 309KB
  • Sample240302-spz4cseh39
  • SHA256 0713d00a52406b8fe16b215042f51fc5debfddd981cb8a655ecc13612939d593
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
persistence

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\prolink-tools
    1⤵
      PID:1600
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3172
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:3404
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
          1⤵
          • Modifies system executable filetype association
          • Registers COM server for autorun
          • Checks processor information in registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1624

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              PreSignInSettingsConfig.json
              • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
              • Size 63KB
              • SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              update100[1].xml
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\update100[1].xml
              • Size 726B
              • SHA256 36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
              • MD5 SHA1 SHA512
              Submit Download