Analysis

  • max time kernel
    8s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    02-03-2024 20:26

General

  • Target

    TrashMalwares-main/PC shaking v4.0.exe

  • Size

    21.7MB

  • MD5

    d2eb6a0f3b1353b6f60c1ce3a63ef8d1

  • SHA1

    a879af3e84106f4da79519ce08643eeb91f72a15

  • SHA256

    b8d65832342d1fec828025eacbcc6e1df9c2f3276524a4abb1a965707fd475ee

  • SHA512

    9473e711b785eba3e5cfcb36437069a96290864fe9562a5619d95f9fac9c0b46b0c3c942be8ff7fec4204a938392e8be471ea6ce683027cd29b181028b0e2481

  • SSDEEP

    393216:MUbg/uqZ8EuLjIlYgJMFBoJPYG6O4BcwikWGmivl4yA1cmBBS:6G9LjHgUOJPEOyresC4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\PC shaking v4.0.exe
    "C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\PC shaking v4.0.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Windows\Media\PCshakingv4.0.exe
      "C:\Windows\Media\PCshakingv4.0.exe"
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      PID:2640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Media\logotip.jpg

    Filesize

    3.8MB

    MD5

    9a9db1db236b2b45a432a622bd161b87

    SHA1

    c51683ae43ec4ec9ec6cece0e12ca0ab7364f931

    SHA256

    6d277f338cf460691f023946ecd56a0aa0ee27efaa98d3a29a2518a5c9fa3677

    SHA512

    dfd9e25f0fd2adccf6b52aed5d1ffdcf05de198368f42597658a6955e3797edde300553b34d1c24164e1af73533f8b18b1a6a506aceca8ab58f1f8006d1c3dbb

  • C:\Windows\Media\mouse.ico

    Filesize

    203KB

    MD5

    3abff26e58afe2b94ce801295336bf82

    SHA1

    b3222e30303115469b5b3e3d03ed9aed846d830f

    SHA256

    fb078b09259f96b032dce2c345c683b6b9d9316819dc363edd780b91dc11704d

    SHA512

    ba546709378b529eb8887cc5f7ff9f4bc587bae61af009adf8778dc3972c2e57d9291df6f2b6cc8ba36b27c262b8eb6f650d610fc1d731c154bb4cad6df46ac2

  • \??\c:\Windows\Media\Tobu.wav

    Filesize

    26.3MB

    MD5

    27380a8a6026509510e715efb0e31513

    SHA1

    fa1307df97f5870d64d4f7d7941603ccb4507196

    SHA256

    62282c6476f26088c1c5751a966098dc98e083cbdad456c8293dae62d4f8106f

    SHA512

    4aa7fd31848e1379550dfcecaa6fd8ee125841763d331c5b94388212c628b73df50c806d9da95323ea9d54eb57e97077562f5f973b55cadb80d888d9d819f27e

  • \Windows\Media\PCshakingv4.0.exe

    Filesize

    71KB

    MD5

    129c1a8094f0a6a9cdc9f63e86f8a482

    SHA1

    917c6809ae03670edbf5da4cb19c49e85390642c

    SHA256

    2eadcdfd00b8bec4d18b71830cd334569844002a7971c56d3e1e38ff7972c4f3

    SHA512

    076cf44955bebbad12ca905a36a12da4cd20520d8795e2f47f972ad996932731be4f007792954c9737b68330cd395a17ad19aa1e5b1c9e248379c37dcdf1a9e5