Analysis

  • max time kernel
    145s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-03-2024 20:26

General

  • Target

    TrashMalwares-main/NoEscape8.0.exe

  • Size

    15.0MB

  • MD5

    1c18f75dafd667fb5559cf9b7cb5868e

  • SHA1

    deab3392cf25ebc52f15ecdcf7e4187dcaec81f7

  • SHA256

    bf3c03ff11e6610bbf806084ec2d58cd5aacb87e52cbf965a789fa74584de3a5

  • SHA512

    c68c8ee27265c81e7bb6ead434436398d198b9c2ce83092a8deb8539045b10b47ed660e2451297edd7eeebedc5254000fd5ad481f4642f64f4d74d6a964d3015

  • SSDEEP

    393216:ph/RLjBJPkh/6StJ+4qnWSz0hgSovW+PABRMW:phVcm9z06WEORX

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 19 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 5 IoCs
  • Kills process with taskkill 6 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\NoEscape8.0.exe
    "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\NoEscape8.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\yourpc\skid.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\yourpc\run.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1688
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\yourpc\main.bat" "
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\yourpc\boot.exe
            boot.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of WriteProcessMemory
            PID:2692
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\yourpc\boot.exe"
              6⤵
              • Creates scheduled task(s)
              PID:2196
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\yourpc\es.vbs"
            5⤵
              PID:588
            • C:\Windows\SysWOW64\reg.exe
              REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
              5⤵
              • Modifies registry key
              PID:480
            • C:\Windows\SysWOW64\timeout.exe
              timeout 10
              5⤵
              • Delays execution with timeout.exe
              PID:720
            • C:\yourpc\INV.exe
              INV.exe
              5⤵
              • Executes dropped EXE
              PID:1416
            • C:\yourpc\tunnel.exe
              tunnel.exe
              5⤵
              • Executes dropped EXE
              PID:1628
            • C:\yourpc\melter.exe
              melter.exe
              5⤵
              • Executes dropped EXE
              PID:360
            • C:\yourpc\10.exe
              10.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:620
              • C:\Windows\SysWOW64\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Documents and Settings\Administrator\Desktop\18769.txt
                6⤵
                  PID:3008
              • C:\yourpc\Magix.exe
                Magix.exe
                5⤵
                • Executes dropped EXE
                PID:2916
              • C:\Windows\SysWOW64\timeout.exe
                timeout 30
                5⤵
                • Delays execution with timeout.exe
                PID:856
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im tunnel.exe
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1896
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im INV.exe
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:912
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im melter.exe
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2984
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im Magix.exe
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1480
              • C:\Windows\SysWOW64\timeout.exe
                timeout 20
                5⤵
                • Delays execution with timeout.exe
                PID:1680
              • C:\yourpc\RGB.exe
                RGB.exe
                5⤵
                • Executes dropped EXE
                PID:1428
              • C:\yourpc\gl.exe
                gl.exe
                5⤵
                • Executes dropped EXE
                PID:1456
              • C:\yourpc\test.exe
                test.exe
                5⤵
                • Executes dropped EXE
                PID:2184
              • C:\Windows\SysWOW64\timeout.exe
                timeout 30
                5⤵
                • Delays execution with timeout.exe
                PID:1448
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im RGB.exe
                5⤵
                • Kills process with taskkill
                PID:2288
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im gl.exe
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2612
              • C:\yourpc\Circle2.exe
                Circle2.exe
                5⤵
                • Executes dropped EXE
                PID:2656
              • C:\Windows\SysWOW64\timeout.exe
                timeout 30
                5⤵
                • Delays execution with timeout.exe
                PID:2520

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\yourpc\10.exe

        Filesize

        291KB

        MD5

        e2001b6e75f84968a254b49faa45b7be

        SHA1

        c70f93d5833543bb96c06a2e5a6642da0b283f12

        SHA256

        fa758441587efb6f25391ceda3bf7c9293555dbd7d36472a2c76c3036f6d9c33

        SHA512

        ebcd62730268b7f6f8b880a7c6d321bfb444e4a6ae0ea9e1a1c02a00db5737abd09b4db5e4515a9060de6d95cba49c5bd0e69a9903bdfd1c54f18eeb031220e3

      • C:\yourpc\Magix.exe

        Filesize

        59KB

        MD5

        026992ed7c38fae57e8839a6c0d883c8

        SHA1

        9b389aa3dd774f3cfff3dcbe8ea8779ef005b31f

        SHA256

        68cb1fe2ee7c3f69fe2d508d117b502ed19337bd332e722605e491a823f89645

        SHA512

        d20fe47538b9e1fa0ccf198f5a4a31506cc59622b2492e9f64435fb06b66ccf93cde056693656da626ebf56ab434425fbf3291db979fe6c67b2a7a14649d9dc7

      • C:\yourpc\boot.exe

        Filesize

        150KB

        MD5

        0b71c2b0a5cb052457abd1e09f6302cb

        SHA1

        e17040a434a818b98d6c217bb73ccdcdc603c56a

        SHA256

        986192549387d257436b94d956234dce12f151ce6904de660e5d39cfce21b775

        SHA512

        fd3e41b1fc8e9aa5f1a5da6161be6f4aa277e3e1377f20ffd217004bc015ddbf3e4c80a7316d99fdfda6e32d497a0996eecb4ddc55b0b011e7c9a74944fbe1d5

      • C:\yourpc\es.vbs

        Filesize

        39B

        MD5

        9c2d6662913494f5f7ecc95564f87132

        SHA1

        e62502b0da2c9714b4cc1bae0f39c7014a9b2d00

        SHA256

        095f01222915f9f8d71edb1593d70b7336c89aed4b42b14dc8e5cff482ab8d3b

        SHA512

        366b4739de8aaddf5133a9f50589e870b187ee0a366c4c3166adcb071c8d3aa180d978c3f85916690763dcd0d99449782ecd18df5144447695490b112f9d4cbc

      • C:\yourpc\gl.exe

        Filesize

        105KB

        MD5

        754be91171c29e0b2b35c209553c6e45

        SHA1

        73da71d831ba2c13aaf28a9e2d581ee52d95d639

        SHA256

        595f476a34f1b6a481a89aec8bab0e323e7ccc7fbc53586982d26f681ddcc4a3

        SHA512

        1ea4b1c01548275f701ccd09cc4018f60efcaacbcc8676fd989d05e9322e5f5bbd967e5206bfda18f6ce6d989dfa45cd4dd9155fc08c1fbdbb2ba025c2927fc6

      • C:\yourpc\main.bat

        Filesize

        1KB

        MD5

        d381fdbe8f6a130e25247fa1e029805b

        SHA1

        618a09cf851eb5bea77595df2e66412d2d954cba

        SHA256

        9eca23b0358e5507734ef7a2247c310c7be23c85776913c49947afb41c885273

        SHA512

        f1f7ca8d93c9764a6223121943fb2b31bd896df975a1c17f745a66cdd5777fe8e0197721da0b9e1610b2a5bdbd8b4ecb4d676df09baef7f35a038a7e5a97a444

      • C:\yourpc\run.vbs

        Filesize

        54B

        MD5

        95cd248d3e5740a059a01eeef728ab48

        SHA1

        ae3e55904ade22ab4672f1f85db865e8e66fcff6

        SHA256

        ac59324226f082c21f5364d027f364086e86c9488dce674d7e93bf5c7c0cbcea

        SHA512

        aa149aa3b524002defd4f92579f672e6e5f3f2deb5124f5adf8980e8386e0faf8f81a5b9667751ac6e19dd3b50f1688a7dfd147e18c9de229ce6f955184ad4b3

      • C:\yourpc\skid.bat

        Filesize

        310B

        MD5

        427d18145e233d828cdbad04596134c9

        SHA1

        84cb6fae8ee844be1fd9eda8a6a74a5cce97ded8

        SHA256

        23efa2c8b42c0c599a2bd60cadfab2eac3a439e891509dc70c1ee2a9f5e86f2c

        SHA512

        fd5e0a70a4bd082311ab5559b832ba8ae8fce91a62faeec827e3a14a302ceda3697b2cc4d9f1c082170fe22ffff52b022791ebc8c6ec35a3946a9c3712e99444

      • C:\yourpc\test.exe

        Filesize

        74KB

        MD5

        64a69d3a6620009ebe49595a5d8d119e

        SHA1

        4d478712f6503dc7f32e600d7b5aa0118c83214d

        SHA256

        199e4e84b644b264d170b04945880f095790206c65fdfb5a88c8ab73bd29357d

        SHA512

        b2e6ace579201f74abea5d4aecf416980ab028d1876ffc57e474b2b2142489ec4589a4c151eafa4a9067b446396829a370c882b0d40ab8073ad7ff266bd6653f

      • C:\yourpc\tunnel.exe

        Filesize

        103KB

        MD5

        7dae1fb2e3a65e8dd594b021a6923e24

        SHA1

        acd069dc223cc4802402944e5afec57d2ae31c08

        SHA256

        732adadb4c7167e61f0f5763c2c01e43fb01369683d23c9652aea99f6c42c810

        SHA512

        121f7f7c30361aa141192586133a670d989b2615d7e451b0e5a2e5375c46a67c9c404df4575778b7474ddf48b1be2d29d61df7d534473725d66295b3d4ef2919

      • \yourpc\Circle2.exe

        Filesize

        132KB

        MD5

        89c39815003090838eb6b7bd87f5525d

        SHA1

        c5f2821319488dc541c91e8500328f09eeef4ac0

        SHA256

        9ebda86d4ed28999d69c1e0f50fcab9b191bf15acc1d9cc0a597263ee36b6610

        SHA512

        0c5c6bfe296a581f5d4ff77bb37e906382f00bf8ec2274f2c95dc334ae3e8d0806a54403434e32735b0e57cc715d184f62f99c713783a8f9d6c79ead007c383b

      • \yourpc\INV.exe

        Filesize

        103KB

        MD5

        e079c468c9caed494623dbf95e9ce5e8

        SHA1

        4d8d1d17e9d7ff455a5c69e048d7575b5a3ea0f7

        SHA256

        8e217ce5670ac1021fdb6101372f9322f7ff82481ecd9badc104ff542e46128c

        SHA512

        d9c1a6f28c0c76b6856dec8723eb79d1b620a70b8ab3b5f028848e890a684beeb3460e310959c69f21cffb0a14751ea6cb719aacdbc2043121f057dd56f868a8

      • \yourpc\RGB.exe

        Filesize

        130KB

        MD5

        b326cda81e5711aed4c4dca71e111c3e

        SHA1

        9e64c68663135bbb1e55a839f46b00a634f3bee1

        SHA256

        29297a0ff5b8b80cf5c96185ad6bd7a323dac9749185c516363e84b6710627ce

        SHA512

        2dfee83e49d83867f1a28c904d31920a393ad56e94c31bcab13a881f2caae35ac387de2e1b8b33b8b09655a6af8d619da63710c03f54d57ee76abf760a292e6b

      • \yourpc\melter.exe

        Filesize

        3KB

        MD5

        d9baac374cc96e41c9f86c669e53f61c

        SHA1

        b0ba67bfac3d23e718b3bfdfe120e5446d0229e8

        SHA256

        a1d883577bcb6c4f9de47b06fe97c370c09bddffb6569b6cf93576371bdbc412

        SHA512

        4ecdf8757e75b02da06a9d42a8ca62b9f2ef292dc04fa37d96603af78433f8aa9dd82fcf1e128a8f463b9691dcc1645b4a64e34f3c5d631f3a0e0670da0d0457

      • memory/1416-153-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/1428-175-0x0000000000400000-0x0000000000422000-memory.dmp

        Filesize

        136KB

      • memory/1456-176-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/1628-154-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/2656-195-0x0000000000400000-0x0000000000422000-memory.dmp

        Filesize

        136KB

      • memory/2692-124-0x0000000000400000-0x000000000043B000-memory.dmp

        Filesize

        236KB

      • memory/2916-155-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2916-158-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2916-161-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2916-163-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB