Analysis

  • max time kernel
    149s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2024 20:26

General

  • Target

    TrashMalwares-main/MS-RickRoll.exe

  • Size

    19.6MB

  • MD5

    f2ac7d7d538e97ffb162fe63ca395a05

  • SHA1

    a283014d55873fba0f00fc4b030581254610639a

  • SHA256

    ccbb3d3838216d5a5881fc256c10d5d560885cc18a14a76461c9fe872af3bf0f

  • SHA512

    50784fb9705733e45541eeb9df83e73d8f530bffd87ad99ae37c23c8a9c216d583a193f58046ea49e5c727d5aa9154d583911706feda56531ea45f3438194e96

  • SSDEEP

    393216:+rl0rPQCLXuOSk2+t7DPQCLXuOSk2+t7Vl01:w6dLrNJtvdLrNJtJ

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\MS-RickRoll.exe
    "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\MS-RickRoll.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\mbr.exe
      "C:\mbr.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe
        "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe"
          4⤵
          • Creates scheduled task(s)
          PID:3988
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:932
        • C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of WriteProcessMemory
          PID:436
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe"
            5⤵
            • Creates scheduled task(s)
            PID:4732
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:5016
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x320 0x478
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1a3cimMa.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe

    Filesize

    150KB

    MD5

    578650d2b82375bb0f6be3a9108585b0

    SHA1

    8f25b9a24254c2ec99ee5625c70a0ae7067dc68b

    SHA256

    5ee16b324a60878ccef849bec862a4fa551cb304d8ce4056d49df10fb8ec9f2f

    SHA512

    4c46d53bab8df399a63b33ac4c4bba2c99663b31fcd3ebb6bd01a9ccf1648a61a7034879fafced99adb9c60388590efb4462e404b9d5da7d8e2e60b480ffc657

  • C:\mbr.exe

    Filesize

    904KB

    MD5

    c85aa1da29f23a5a711e2793d0630b5a

    SHA1

    e079ef1963a710db2e35380e508eef86ff371fb1

    SHA256

    a19c688c6bebe44cc77ecf6bd998bb4f1799cefc91c5bd32cc8d6381e0177139

    SHA512

    162e75f513518d5979f3c4a0e7ca6bf4b4333646bebee73a703c43c67c735f6ed244db25674f786881061418600123e92265e51e9ee5b6d34669ef71b72038cc

  • C:\rick.wav

    Filesize

    1.6MB

    MD5

    2634c1ac24432e18601bcd8171b8248e

    SHA1

    01135b2ace7d4437dd8d57a4dd88b0fd45c5bf35

    SHA256

    66f05a63cc9ae2c641a0fe82ea6ada8142464853dd83b749a562235090adb20d

    SHA512

    9fc42b412c9aebb29cf6f0e2969b2c5515086114e44f3d4e259a51ee08824d4f1d25ac2f586d5e8915261191399dc7d53f91a6b897d2d5a756ce2ccabddd7cd3

  • memory/436-153-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/932-201-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

  • memory/932-206-0x0000000002040000-0x0000000002041000-memory.dmp

    Filesize

    4KB

  • memory/932-259-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

  • memory/932-121-0x0000000002040000-0x0000000002041000-memory.dmp

    Filesize

    4KB

  • memory/3740-235-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-219-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-276-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-271-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-267-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-264-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-260-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-0-0x0000000000010000-0x00000000013B2000-memory.dmp

    Filesize

    19.6MB

  • memory/3740-284-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-200-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-234-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-226-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-225-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-221-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-220-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-280-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-216-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-214-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-213-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-212-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-199-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-291-0x0000000022100000-0x0000000022200000-memory.dmp

    Filesize

    1024KB

  • memory/3740-203-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-202-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-2-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-1-0x00007FFDE5750000-0x00007FFDE6211000-memory.dmp

    Filesize

    10.8MB

  • memory/3740-195-0x00000000035A0000-0x00000000035B0000-memory.dmp

    Filesize

    64KB

  • memory/3740-198-0x00007FFDE5750000-0x00007FFDE6211000-memory.dmp

    Filesize

    10.8MB

  • memory/4084-59-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/5016-161-0x00007FFDC3C30000-0x00007FFDC3C40000-memory.dmp

    Filesize

    64KB

  • memory/5016-177-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-176-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-174-0x00007FFDC12D0000-0x00007FFDC12E0000-memory.dmp

    Filesize

    64KB

  • memory/5016-175-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-173-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-208-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-211-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-172-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-171-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-170-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-169-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-168-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-167-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-165-0x00007FFDC12D0000-0x00007FFDC12E0000-memory.dmp

    Filesize

    64KB

  • memory/5016-166-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-164-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-163-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-162-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-160-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-158-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-159-0x00007FFDC3C30000-0x00007FFDC3C40000-memory.dmp

    Filesize

    64KB

  • memory/5016-157-0x00007FFE03BB0000-0x00007FFE03DA5000-memory.dmp

    Filesize

    2.0MB

  • memory/5016-155-0x00007FFDC3C30000-0x00007FFDC3C40000-memory.dmp

    Filesize

    64KB

  • memory/5016-156-0x00007FFDC3C30000-0x00007FFDC3C40000-memory.dmp

    Filesize

    64KB

  • memory/5016-154-0x00007FFDC3C30000-0x00007FFDC3C40000-memory.dmp

    Filesize

    64KB

  • memory/5060-118-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

  • memory/5060-16-0x0000000002490000-0x0000000002491000-memory.dmp

    Filesize

    4KB