Overview

overview

8

Static

static

1

360TS_Setu...oT.exe

windows7-x64

1

360TS_Setu...oT.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    93s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-03-2024 01:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    360TS_Setup_Mini.h1.YWZmaS5jcmVhdGl2ZWNsaWNrcy5QQg.Z3FSamMybGtwemd3TmpNNE5GLWpZMmxrMmdBa01EbGpPV0ZoT.exe

  • Size

    1.4MB

  • MD5

    31fee2c73b8d2a8ec979775cd5f5ced7

  • SHA1

    39182a68bc0c1c07d3ddc47cd69fe3692dbac834

  • SHA256

    d26a7f2d4f3521827201e6cdcd296f132c7d18c3a1ce70c24b423300cff326fe

  • SHA512

    db51b602a8675641bc3a0a980a197243787ed12f5e0619cb1d390c91193d7e3447e3e86e2321c3ea273c6732b356003a249241d7d8a5699931810e5a35d5c650

  • SSDEEP

    24576:kL/7n6lbcC8oblv1zj1SqdAGFQZIxvC45UJoe1Z:E6+C8o5tzjYq+ZIxL5UJoeL

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\360TS_Setup_Mini.h1.YWZmaS5jcmVhdGl2ZWNsaWNrcy5QQg.Z3FSamMybGtwemd3TmpNNE5GLWpZMmxrMmdBa01EbGpPV0ZoT.exe
    "C:\Users\Admin\AppData\Local\Temp\360TS_Setup_Mini.h1.YWZmaS5jcmVhdGl2ZWNsaWNrcy5QQg.Z3FSamMybGtwemd3TmpNNE5GLWpZMmxrMmdBa01EbGpPV0ZoT.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe" /c:101 /pmode:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Program Files (x86)\1709515700_0\360TS_Setup.exe
        "C:\Program Files (x86)\1709515700_0\360TS_Setup.exe" /c:101 /pmode:2 /TSinstall
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of SetWindowsHookEx
        PID:4696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\1709515700_0\360TS_Setup.exe
    Filesize

    6.0MB

    MD5

    76895e930fe9929076499df3e8775618

    SHA1

    b0ed2e805fc992253a488e0e2b837096a5755bf5

    SHA256

    22db7e93df530f928dcb942ed6811438da9072a6e74b9cd5ae2b68fdc4be6d58

    SHA512

    bf93633d74f58d0f158bcbfc3629e631c64be3962c84076b1e017659d29e29121034d3ca3792204daadb43ba838442244d82f7a148a0917368d70c3e9696717a

    Download Submit

  • C:\Program Files (x86)\1709515700_0\360TS_Setup.exe
    Filesize

    5.4MB

    MD5

    f8c41528ea812826c994bc02883df110

    SHA1

    432fe8151873ea65769754ab571903d089a6f257

    SHA256

    8e0a4827052b9185f741cec1efc067c4ba0189b28f212c3c42b0ccd21b8d0734

    SHA512

    d5aa9b2c69f3d553319c782b22fbed404fa9962112d4e3f126fccddff1e5ed6b469966579519e0ec4852fea56ebe340eda281c8f05d0e99077774b9b5fa6a225

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    Filesize

    656B

    MD5

    10dbee10ea7d876a154ca0447427b4ca

    SHA1

    222fd663a5e0b6d3e5b0018700b992cd5e744f05

    SHA256

    52a5faa5428e8a9fedfee3d2ad0f45d396f6c1cef3233c28c0ec82c435c1b688

    SHA512

    68805a3151b03e3f5ed485d7ae4fbd848e123fd180e6c35445a4c96791b18c250824d3e79b7874bcc36234888334acb75a7d899338d8e1d56af8bb77ddc0ce10

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
    Filesize

    830B

    MD5

    2cd1feda405a32b03b262816aa5ae9bf

    SHA1

    686a0db640a91fd1064c013a678ce8d243d7553a

    SHA256

    f7760f7abf7b3711c2e3652d64dc5248fec374145af3cb96d6ad1b83c933bdbb

    SHA512

    57f2564f31161d67a09da0d512854491a58d47a1ad23fdb624bd607d7a2ac8d3ca312c3aefc2b0ba73d76bdbd38683ebc7f5d680993312c3776d02d32f52b182

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1709515700_00000000_base\360base.dll
    Filesize

    1.0MB

    MD5

    b192f34d99421dc3207f2328ffe62bd0

    SHA1

    e4bbbba20d05515678922371ea787b39f064cd2c

    SHA256

    58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73

    SHA512

    00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
    Filesize

    98.7MB

    MD5

    3d8eaf33ff28380f80d146fd4528d2c2

    SHA1

    18cf65b498f8dc9ba84e050df4e332b9300e259e

    SHA256

    1ae58802ddcfb1c5000f3e5412c77f950d683a09367f823155138fd300c80eb3

    SHA512

    145d59627c08c2114cdf49c19ad9f832d760fe5be50c25dbeb435a055f736c1b0b1ba817958a4afdeb83f1788d417e009d5b8b92096fa1167c0fea9609509564

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
    Filesize

    13.2MB

    MD5

    132fad84db99720c763154e66c775a51

    SHA1

    ab2bfe286aa62b6d3ea41bbe0def7509e88d4887

    SHA256

    44f2e2cb39004132560af8a512d5d97c4939901c43c3690a1ffa6c71bd0741b6

    SHA512

    bcdd222de8cd75fa90c5b793588e250f9c7ef4984ae0b895ae8d85995a9ec9a64d59696d9ce6e0ca1099e762f46529c5093fe93b693655e5a9724f3020862fb2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
    Filesize

    21.9MB

    MD5

    908449e71d76c253e4015d15fed4bea3

    SHA1

    b28a99207fe20bb6c924075624d257ac9f082e54

    SHA256

    dfd2db7a23ae91b10981282bdb922f92bc937649bfc8f975e1f82ecb0cfc7eca

    SHA512

    00621e6bb6ecdf1fed2abe78deb3ac917926ac929c6668f6fa065bad1837519720167f3916260080d683e16bcc50582253e8ae2d6011a1f08b2354e9f3522182

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{6CF14795-81E7-4295-B6B7-D3093162255F}.tmp
    Filesize

    3KB

    MD5

    b1ddd3b1895d9a3013b843b3702ac2bd

    SHA1

    71349f5c577a3ae8acb5fbce27b18a203bf04ede

    SHA256

    46cda5ad256bf373f5ed0b2a20efa5275c1ffd96864c33f3727e76a3973f4b3c

    SHA512

    93e6c10c4a8465bc2e58f4c7eb300860186ddc5734599bcdad130ff9c8fd324443045eac54bbc667b058ac1fa271e5b7645320c6e3fc2f28cc5f824096830de1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{E440B6D4-6DAB-4f1b-932C-52D19E99314F}.tmp\360P2SP.dll
    Filesize

    824KB

    MD5

    fc1796add9491ee757e74e65cedd6ae7

    SHA1

    603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

    SHA256

    bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

    SHA512

    8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

    Download Submit

  • memory/1652-13-0x0000000003E50000-0x0000000003E51000-memory.dmp

    Filesize

    4KB

    Download