Overview
overview
10Static
static
7Macrium.Re...64.rar
windows11-21h2-x64
10Macrium.Re...07.rar
windows11-21h2-x64
3Cleaner.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3Readme.txt
windows11-21h2-x64
3Macrium.Re...er.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3Macrium.Re...me.txt
windows11-21h2-x64
3Macrium.Re...ch.zip
windows11-21h2-x64
1Macrium_Re...ch.exe
windows11-21h2-x64
7Macrium.Re...ch.exe
windows11-21h2-x64
7Macrium.Re...up.xml
windows11-21h2-x64
1Macrium.Re...ls.xml
windows11-21h2-x64
1Macrium.Re...ffs_db
windows11-21h2-x64
3Macrium.Re...me.txt
windows11-21h2-x64
3Macrium.Re...64.exe
windows11-21h2-x64
1Macrium.Re..._3.exe
windows11-21h2-x64
1Analysis
-
max time kernel
145s -
max time network
158s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/03/2024, 16:09
Behavioral task
behavioral1
Sample
Macrium.Reflect.8.1.7847.x64.rar
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
Macrium.Reflect.8.1.7847.x64/Macrium.Reflect-Cleaner-hawk007.rar
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
Cleaner.exe
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
Readme.txt
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
Macrium.Reflect.8.1.7847.x64/Macrium.Reflect-Cleaner-hawk007/Cleaner.exe
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
out.exe
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
Macrium.Reflect.8.1.7847.x64/Macrium.Reflect-Cleaner-hawk007/Readme.txt
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
Macrium.Reflect.8.1.7847.x64/Macrium_Reflect-7.x_8.x-patch.zip
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
Macrium_Reflect-7.x_8.x-patch.exe
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
Macrium.Reflect.8.1.7847.x64/Macrium_Reflect-7.x_8.x-patch/Macrium_Reflect-7.x_8.x-patch.exe
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
Macrium.Reflect.8.1.7847.x64/XML/KaraPCImageBackup.xml
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
Macrium.Reflect.8.1.7847.x64/XML/Tails.xml
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
Macrium.Reflect.8.1.7847.x64/XML/sync.ffs_db
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
Macrium.Reflect.8.1.7847.x64/readme.txt
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
Macrium.Reflect.8.1.7847.x64/reflect_server_plus_setup_x64.exe
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
Macrium.Reflect.8.1.7847.x64/reflect_wkstn_setup_x64_3.exe
Resource
win11-20240221-en
General
-
Target
Cleaner.exe
-
Size
1.2MB
-
MD5
4730239db03a288f88b2fcdba98ccd8c
-
SHA1
90a332972128f91adece2e613f8ef6b19d984b8d
-
SHA256
56b43a9f785921257e1e93a32f32ac8774d9218f3c475123cea577700ac37fe0
-
SHA512
eeb342399a82d571e0f54829189dfc42a448d186ca4ad56d211ad906ee55f2545f4452a6e391531ef810a8d24d3d0b5949ebb8d43a2b86e08994b1a656b3e0ca
-
SSDEEP
24576:j4GHnhIzOa51kAMI+i3zgK946teJzrfm+b/MYEK7cVsAZRD:8shdaKjik9fd/MZKgVs
Malware Config
Signatures
-
resource yara_rule behavioral3/memory/2948-0-0x0000000000350000-0x00000000005F6000-memory.dmp upx behavioral3/memory/2948-1-0x0000000000350000-0x00000000005F6000-memory.dmp upx behavioral3/memory/2948-2-0x0000000000350000-0x00000000005F6000-memory.dmp upx -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral3/memory/2948-1-0x0000000000350000-0x00000000005F6000-memory.dmp autoit_exe behavioral3/memory/2948-2-0x0000000000350000-0x00000000005F6000-memory.dmp autoit_exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2948 Cleaner.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\Cleaner.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2948
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3872