Overview
overview
10Static
static
10@_136 @828...SM.exe
windows7-x64
7@_136 @828...SM.exe
windows10-2004-x64
7TrashMalwa...in.exe
windows7-x64
8TrashMalwa...in.exe
windows10-2004-x64
8AdStRkJ.exe
windows7-x64
8AdStRkJ.exe
windows10-2004-x64
8Anatralier.exe
windows7-x64
7Anatralier.exe
windows10-2004-x64
7TrashMalwa...er.exe
windows7-x64
3TrashMalwa...er.exe
windows10-2004-x64
8TrashMalwa...nk.exe
windows7-x64
8TrashMalwa...nk.exe
windows10-2004-x64
8TrashMalwa...oN.bat
windows7-x64
8TrashMalwa...oN.bat
windows10-2004-x64
8TrashMalwa...zz.exe
windows7-x64
6TrashMalwa...zz.exe
windows10-2004-x64
6TrashMalwa...de.exe
windows7-x64
7TrashMalwa...de.exe
windows10-2004-x64
7TrashMalwa...20.exe
windows7-x64
4TrashMalwa...20.exe
windows10-2004-x64
7TrashMalwa...ll.exe
windows7-x64
7TrashMalwa...ll.exe
windows10-2004-x64
7TrashMalwa...le.exe
windows7-x64
8TrashMalwa...le.exe
windows10-2004-x64
8TrashMalwa...oe.bat
windows7-x64
8TrashMalwa...oe.bat
windows10-2004-x64
8TrashMalwa....0.exe
windows7-x64
6TrashMalwa....0.exe
windows10-2004-x64
7TrashMalwa....0.exe
windows7-x64
8TrashMalwa....0.exe
windows10-2004-x64
7TrashMalwa....0.exe
windows7-x64
7TrashMalwa....0.exe
windows10-2004-x64
7Analysis
-
max time kernel
149s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 20:26
Behavioral task
behavioral1
Sample
@_136 @828#-138389J-SJFJDSM.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
@_136 @828#-138389J-SJFJDSM.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
TrashMalwares-main/AcidRain.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
TrashMalwares-main/AcidRain.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
AdStRkJ.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
AdStRkJ.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Anatralier.exe
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
Anatralier.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
TrashMalwares-main/Antivirus_Installer.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
TrashMalwares-main/Antivirus_Installer.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
TrashMalwares-main/Dro trojan. Virus prank.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
TrashMalwares-main/Dro trojan. Virus prank.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
TrashMalwares-main/FaZoN.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
TrashMalwares-main/FaZoN.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
TrashMalwares-main/Fizz.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
TrashMalwares-main/Fizz.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
TrashMalwares-main/Ginxide.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
TrashMalwares-main/Ginxide.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
TrashMalwares-main/Install Windows20.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
TrashMalwares-main/Install Windows20.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
TrashMalwares-main/MS-RickRoll.exe
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
TrashMalwares-main/MS-RickRoll.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
TrashMalwares-main/MercuryXhoffle.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
TrashMalwares-main/MercuryXhoffle.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
TrashMalwares-main/NetPakoe.bat
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
TrashMalwares-main/NetPakoe.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
TrashMalwares-main/NetPakoe3.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
TrashMalwares-main/NetPakoe3.0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
TrashMalwares-main/NoEscape8.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
TrashMalwares-main/NoEscape8.0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
TrashMalwares-main/PC shaking v4.0.exe
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
TrashMalwares-main/PC shaking v4.0.exe
Resource
win10v2004-20240226-en
General
-
Target
TrashMalwares-main/MS-RickRoll.exe
-
Size
19.6MB
-
MD5
f2ac7d7d538e97ffb162fe63ca395a05
-
SHA1
a283014d55873fba0f00fc4b030581254610639a
-
SHA256
ccbb3d3838216d5a5881fc256c10d5d560885cc18a14a76461c9fe872af3bf0f
-
SHA512
50784fb9705733e45541eeb9df83e73d8f530bffd87ad99ae37c23c8a9c216d583a193f58046ea49e5c727d5aa9154d583911706feda56531ea45f3438194e96
-
SSDEEP
393216:+rl0rPQCLXuOSk2+t7DPQCLXuOSk2+t7Vl01:w6dLrNJtvdLrNJtJ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MS-RickRoll.exembr.exeSynaptics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation MS-RickRoll.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation mbr.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 4 IoCs
Processes:
mbr.exe._cache_mbr.exeSynaptics.exe._cache_Synaptics.exepid process 5060 mbr.exe 4084 ._cache_mbr.exe 932 Synaptics.exe 436 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
._cache_mbr.exembr.exe._cache_Synaptics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TrashMalwares-main\\._cache_mbr.exe" ._cache_mbr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" mbr.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TrashMalwares-main\\._cache_Synaptics.exe" ._cache_Synaptics.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
._cache_mbr.exe._cache_Synaptics.exedescription ioc process File opened for modification \??\PhysicalDrive0 ._cache_mbr.exe File opened for modification \??\PhysicalDrive0 ._cache_Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3988 schtasks.exe 4732 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
Processes:
mbr.exeSynaptics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ mbr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 5016 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
MS-RickRoll.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 3740 MS-RickRoll.exe Token: SeDebugPrivilege 3740 MS-RickRoll.exe Token: 33 2924 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2924 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 5016 EXCEL.EXE 5016 EXCEL.EXE 5016 EXCEL.EXE 5016 EXCEL.EXE 5016 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
MS-RickRoll.exembr.exe._cache_mbr.exeSynaptics.exe._cache_Synaptics.exedescription pid process target process PID 3740 wrote to memory of 5060 3740 MS-RickRoll.exe mbr.exe PID 3740 wrote to memory of 5060 3740 MS-RickRoll.exe mbr.exe PID 3740 wrote to memory of 5060 3740 MS-RickRoll.exe mbr.exe PID 5060 wrote to memory of 4084 5060 mbr.exe ._cache_mbr.exe PID 5060 wrote to memory of 4084 5060 mbr.exe ._cache_mbr.exe PID 5060 wrote to memory of 4084 5060 mbr.exe ._cache_mbr.exe PID 4084 wrote to memory of 3988 4084 ._cache_mbr.exe schtasks.exe PID 4084 wrote to memory of 3988 4084 ._cache_mbr.exe schtasks.exe PID 4084 wrote to memory of 3988 4084 ._cache_mbr.exe schtasks.exe PID 5060 wrote to memory of 932 5060 mbr.exe Synaptics.exe PID 5060 wrote to memory of 932 5060 mbr.exe Synaptics.exe PID 5060 wrote to memory of 932 5060 mbr.exe Synaptics.exe PID 932 wrote to memory of 436 932 Synaptics.exe ._cache_Synaptics.exe PID 932 wrote to memory of 436 932 Synaptics.exe ._cache_Synaptics.exe PID 932 wrote to memory of 436 932 Synaptics.exe ._cache_Synaptics.exe PID 436 wrote to memory of 4732 436 ._cache_Synaptics.exe schtasks.exe PID 436 wrote to memory of 4732 436 ._cache_Synaptics.exe schtasks.exe PID 436 wrote to memory of 4732 436 ._cache_Synaptics.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\MS-RickRoll.exe"C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\MS-RickRoll.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\mbr.exe"C:\mbr.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe"C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_mbr.exe"4⤵
- Creates scheduled task(s)
PID:3988
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\._cache_Synaptics.exe"5⤵
- Creates scheduled task(s)
PID:4732
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5016
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x320 0x4781⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
150KB
MD5578650d2b82375bb0f6be3a9108585b0
SHA18f25b9a24254c2ec99ee5625c70a0ae7067dc68b
SHA2565ee16b324a60878ccef849bec862a4fa551cb304d8ce4056d49df10fb8ec9f2f
SHA5124c46d53bab8df399a63b33ac4c4bba2c99663b31fcd3ebb6bd01a9ccf1648a61a7034879fafced99adb9c60388590efb4462e404b9d5da7d8e2e60b480ffc657
-
Filesize
904KB
MD5c85aa1da29f23a5a711e2793d0630b5a
SHA1e079ef1963a710db2e35380e508eef86ff371fb1
SHA256a19c688c6bebe44cc77ecf6bd998bb4f1799cefc91c5bd32cc8d6381e0177139
SHA512162e75f513518d5979f3c4a0e7ca6bf4b4333646bebee73a703c43c67c735f6ed244db25674f786881061418600123e92265e51e9ee5b6d34669ef71b72038cc
-
Filesize
1.6MB
MD52634c1ac24432e18601bcd8171b8248e
SHA101135b2ace7d4437dd8d57a4dd88b0fd45c5bf35
SHA25666f05a63cc9ae2c641a0fe82ea6ada8142464853dd83b749a562235090adb20d
SHA5129fc42b412c9aebb29cf6f0e2969b2c5515086114e44f3d4e259a51ee08824d4f1d25ac2f586d5e8915261191399dc7d53f91a6b897d2d5a756ce2ccabddd7cd3