Overview
overview
10Static
static
10@_136 @828...SM.exe
windows7-x64
7@_136 @828...SM.exe
windows10-2004-x64
7TrashMalwa...in.exe
windows7-x64
8TrashMalwa...in.exe
windows10-2004-x64
8AdStRkJ.exe
windows7-x64
8AdStRkJ.exe
windows10-2004-x64
8Anatralier.exe
windows7-x64
7Anatralier.exe
windows10-2004-x64
7TrashMalwa...er.exe
windows7-x64
3TrashMalwa...er.exe
windows10-2004-x64
8TrashMalwa...nk.exe
windows7-x64
8TrashMalwa...nk.exe
windows10-2004-x64
8TrashMalwa...oN.bat
windows7-x64
8TrashMalwa...oN.bat
windows10-2004-x64
8TrashMalwa...zz.exe
windows7-x64
6TrashMalwa...zz.exe
windows10-2004-x64
6TrashMalwa...de.exe
windows7-x64
7TrashMalwa...de.exe
windows10-2004-x64
7TrashMalwa...20.exe
windows7-x64
4TrashMalwa...20.exe
windows10-2004-x64
7TrashMalwa...ll.exe
windows7-x64
7TrashMalwa...ll.exe
windows10-2004-x64
7TrashMalwa...le.exe
windows7-x64
8TrashMalwa...le.exe
windows10-2004-x64
8TrashMalwa...oe.bat
windows7-x64
8TrashMalwa...oe.bat
windows10-2004-x64
8TrashMalwa....0.exe
windows7-x64
6TrashMalwa....0.exe
windows10-2004-x64
7TrashMalwa....0.exe
windows7-x64
8TrashMalwa....0.exe
windows10-2004-x64
7TrashMalwa....0.exe
windows7-x64
7TrashMalwa....0.exe
windows10-2004-x64
7Analysis
-
max time kernel
148s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02-03-2024 20:26
Behavioral task
behavioral1
Sample
@_136 @828#-138389J-SJFJDSM.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
@_136 @828#-138389J-SJFJDSM.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
TrashMalwares-main/AcidRain.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
TrashMalwares-main/AcidRain.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
AdStRkJ.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
AdStRkJ.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Anatralier.exe
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
Anatralier.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
TrashMalwares-main/Antivirus_Installer.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
TrashMalwares-main/Antivirus_Installer.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
TrashMalwares-main/Dro trojan. Virus prank.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
TrashMalwares-main/Dro trojan. Virus prank.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
TrashMalwares-main/FaZoN.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
TrashMalwares-main/FaZoN.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
TrashMalwares-main/Fizz.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
TrashMalwares-main/Fizz.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
TrashMalwares-main/Ginxide.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
TrashMalwares-main/Ginxide.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
TrashMalwares-main/Install Windows20.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
TrashMalwares-main/Install Windows20.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
TrashMalwares-main/MS-RickRoll.exe
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
TrashMalwares-main/MS-RickRoll.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
TrashMalwares-main/MercuryXhoffle.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
TrashMalwares-main/MercuryXhoffle.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
TrashMalwares-main/NetPakoe.bat
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
TrashMalwares-main/NetPakoe.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
TrashMalwares-main/NetPakoe3.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
TrashMalwares-main/NetPakoe3.0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
TrashMalwares-main/NoEscape8.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
TrashMalwares-main/NoEscape8.0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
TrashMalwares-main/PC shaking v4.0.exe
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
TrashMalwares-main/PC shaking v4.0.exe
Resource
win10v2004-20240226-en
General
-
Target
TrashMalwares-main/MS-RickRoll.exe
-
Size
19.6MB
-
MD5
f2ac7d7d538e97ffb162fe63ca395a05
-
SHA1
a283014d55873fba0f00fc4b030581254610639a
-
SHA256
ccbb3d3838216d5a5881fc256c10d5d560885cc18a14a76461c9fe872af3bf0f
-
SHA512
50784fb9705733e45541eeb9df83e73d8f530bffd87ad99ae37c23c8a9c216d583a193f58046ea49e5c727d5aa9154d583911706feda56531ea45f3438194e96
-
SSDEEP
393216:+rl0rPQCLXuOSk2+t7DPQCLXuOSk2+t7Vl01:w6dLrNJtvdLrNJtJ
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
mbr.exe._cache_mbr.exeSynaptics.exe._cache_Synaptics.exepid process 2972 mbr.exe 2556 ._cache_mbr.exe 2536 Synaptics.exe 1628 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
Processes:
mbr.exeSynaptics.exepid process 2972 mbr.exe 2972 mbr.exe 2972 mbr.exe 2972 mbr.exe 2536 Synaptics.exe 2536 Synaptics.exe 2536 Synaptics.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
._cache_mbr.exe._cache_Synaptics.exembr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TrashMalwares-main\\._cache_mbr.exe" ._cache_mbr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TrashMalwares-main\\._cache_Synaptics.exe" ._cache_Synaptics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" mbr.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
._cache_mbr.exe._cache_Synaptics.exedescription ioc process File opened for modification \??\PhysicalDrive0 ._cache_mbr.exe File opened for modification \??\PhysicalDrive0 ._cache_Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2452 schtasks.exe 2008 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MS-RickRoll.exedescription pid process Token: SeDebugPrivilege 1508 MS-RickRoll.exe Token: SeDebugPrivilege 1508 MS-RickRoll.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
MS-RickRoll.exembr.exe._cache_mbr.exeSynaptics.exe._cache_Synaptics.exedescription pid process target process PID 1508 wrote to memory of 2972 1508 MS-RickRoll.exe mbr.exe PID 1508 wrote to memory of 2972 1508 MS-RickRoll.exe mbr.exe PID 1508 wrote to memory of 2972 1508 MS-RickRoll.exe mbr.exe PID 1508 wrote to memory of 2972 1508 MS-RickRoll.exe mbr.exe PID 2972 wrote to memory of 2556 2972 mbr.exe ._cache_mbr.exe PID 2972 wrote to memory of 2556 2972 mbr.exe ._cache_mbr.exe PID 2972 wrote to memory of 2556 2972 mbr.exe ._cache_mbr.exe PID 2972 wrote to memory of 2556 2972 mbr.exe ._cache_mbr.exe PID 2556 wrote to memory of 2452 2556 ._cache_mbr.exe schtasks.exe PID 2556 wrote to memory of 2452 2556 ._cache_mbr.exe schtasks.exe PID 2556 wrote to memory of 2452 2556 ._cache_mbr.exe schtasks.exe PID 2556 wrote to memory of 2452 2556 ._cache_mbr.exe schtasks.exe PID 2972 wrote to memory of 2536 2972 mbr.exe Synaptics.exe PID 2972 wrote to memory of 2536 2972 mbr.exe Synaptics.exe PID 2972 wrote to memory of 2536 2972 mbr.exe Synaptics.exe PID 2972 wrote to memory of 2536 2972 mbr.exe Synaptics.exe PID 2536 wrote to memory of 1628 2536 Synaptics.exe ._cache_Synaptics.exe PID 2536 wrote to memory of 1628 2536 Synaptics.exe ._cache_Synaptics.exe PID 2536 wrote to memory of 1628 2536 Synaptics.exe ._cache_Synaptics.exe PID 2536 wrote to memory of 1628 2536 Synaptics.exe ._cache_Synaptics.exe PID 1628 wrote to memory of 2008 1628 ._cache_Synaptics.exe schtasks.exe PID 1628 wrote to memory of 2008 1628 ._cache_Synaptics.exe schtasks.exe PID 1628 wrote to memory of 2008 1628 ._cache_Synaptics.exe schtasks.exe PID 1628 wrote to memory of 2008 1628 ._cache_Synaptics.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\MS-RickRoll.exe"C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\MS-RickRoll.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\mbr.exe"C:\mbr.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe"C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe"4⤵
- Creates scheduled task(s)
PID:2452
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe"5⤵
- Creates scheduled task(s)
PID:2008
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
904KB
MD5c85aa1da29f23a5a711e2793d0630b5a
SHA1e079ef1963a710db2e35380e508eef86ff371fb1
SHA256a19c688c6bebe44cc77ecf6bd998bb4f1799cefc91c5bd32cc8d6381e0177139
SHA512162e75f513518d5979f3c4a0e7ca6bf4b4333646bebee73a703c43c67c735f6ed244db25674f786881061418600123e92265e51e9ee5b6d34669ef71b72038cc
-
Filesize
1.6MB
MD52634c1ac24432e18601bcd8171b8248e
SHA101135b2ace7d4437dd8d57a4dd88b0fd45c5bf35
SHA25666f05a63cc9ae2c641a0fe82ea6ada8142464853dd83b749a562235090adb20d
SHA5129fc42b412c9aebb29cf6f0e2969b2c5515086114e44f3d4e259a51ee08824d4f1d25ac2f586d5e8915261191399dc7d53f91a6b897d2d5a756ce2ccabddd7cd3
-
Filesize
150KB
MD5578650d2b82375bb0f6be3a9108585b0
SHA18f25b9a24254c2ec99ee5625c70a0ae7067dc68b
SHA2565ee16b324a60878ccef849bec862a4fa551cb304d8ce4056d49df10fb8ec9f2f
SHA5124c46d53bab8df399a63b33ac4c4bba2c99663b31fcd3ebb6bd01a9ccf1648a61a7034879fafced99adb9c60388590efb4462e404b9d5da7d8e2e60b480ffc657