Analysis

  • max time kernel
    148s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    02-03-2024 20:26

General

  • Target

    TrashMalwares-main/MS-RickRoll.exe

  • Size

    19.6MB

  • MD5

    f2ac7d7d538e97ffb162fe63ca395a05

  • SHA1

    a283014d55873fba0f00fc4b030581254610639a

  • SHA256

    ccbb3d3838216d5a5881fc256c10d5d560885cc18a14a76461c9fe872af3bf0f

  • SHA512

    50784fb9705733e45541eeb9df83e73d8f530bffd87ad99ae37c23c8a9c216d583a193f58046ea49e5c727d5aa9154d583911706feda56531ea45f3438194e96

  • SSDEEP

    393216:+rl0rPQCLXuOSk2+t7DPQCLXuOSk2+t7Vl01:w6dLrNJtvdLrNJtJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\MS-RickRoll.exe
    "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\MS-RickRoll.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\mbr.exe
      "C:\mbr.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe
        "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe"
          4⤵
          • Creates scheduled task(s)
          PID:2452
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of WriteProcessMemory
          PID:1628
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe"
            5⤵
            • Creates scheduled task(s)
            PID:2008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\mbr.exe

    Filesize

    904KB

    MD5

    c85aa1da29f23a5a711e2793d0630b5a

    SHA1

    e079ef1963a710db2e35380e508eef86ff371fb1

    SHA256

    a19c688c6bebe44cc77ecf6bd998bb4f1799cefc91c5bd32cc8d6381e0177139

    SHA512

    162e75f513518d5979f3c4a0e7ca6bf4b4333646bebee73a703c43c67c735f6ed244db25674f786881061418600123e92265e51e9ee5b6d34669ef71b72038cc

  • C:\rick.wav

    Filesize

    1.6MB

    MD5

    2634c1ac24432e18601bcd8171b8248e

    SHA1

    01135b2ace7d4437dd8d57a4dd88b0fd45c5bf35

    SHA256

    66f05a63cc9ae2c641a0fe82ea6ada8142464853dd83b749a562235090adb20d

    SHA512

    9fc42b412c9aebb29cf6f0e2969b2c5515086114e44f3d4e259a51ee08824d4f1d25ac2f586d5e8915261191399dc7d53f91a6b897d2d5a756ce2ccabddd7cd3

  • \Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe

    Filesize

    150KB

    MD5

    578650d2b82375bb0f6be3a9108585b0

    SHA1

    8f25b9a24254c2ec99ee5625c70a0ae7067dc68b

    SHA256

    5ee16b324a60878ccef849bec862a4fa551cb304d8ce4056d49df10fb8ec9f2f

    SHA512

    4c46d53bab8df399a63b33ac4c4bba2c99663b31fcd3ebb6bd01a9ccf1648a61a7034879fafced99adb9c60388590efb4462e404b9d5da7d8e2e60b480ffc657

  • memory/1508-75-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-68-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-2-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-147-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-144-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-140-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-139-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-62-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-80-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-64-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-65-0x000007FEF5ED0000-0x000007FEF68BC000-memory.dmp

    Filesize

    9.9MB

  • memory/1508-66-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-76-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-1-0x0000000000BA0000-0x0000000001F42000-memory.dmp

    Filesize

    19.6MB

  • memory/1508-69-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-70-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1508-0-0x000007FEF5ED0000-0x000007FEF68BC000-memory.dmp

    Filesize

    9.9MB

  • memory/1508-74-0x000000001C480000-0x000000001C500000-memory.dmp

    Filesize

    512KB

  • memory/1628-56-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2536-67-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2536-60-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

  • memory/2536-90-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

  • memory/2536-121-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

  • memory/2536-45-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2556-33-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2972-12-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2972-42-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB