Malware Analysis Report

2024-11-30 19:10

Sample ID 240308-lpbbnscg6z
Target baee2a8a64e9c56caf42609a8075f7a8
SHA256 4fb539f018df9d7aa55be88184a499e0a37617f5a4f7c1b81fe685d34f4d4014
Tags
agilenet evasion persistence
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

4fb539f018df9d7aa55be88184a499e0a37617f5a4f7c1b81fe685d34f4d4014

Threat Level: Likely malicious

The file baee2a8a64e9c56caf42609a8075f7a8 was found to be: Likely malicious.

Malicious Activity Summary

agilenet evasion persistence

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Sets service image path in registry

Obfuscated with Agile.Net obfuscator

Checks computer location settings

Checks BIOS information in registry

Maps connected drives based on registry

Drops file in System32 directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Enumerates system info in registry

Modifies registry key

Checks processor information in registry

Checks SCSI registry key(s)

Suspicious behavior: LoadsDriver

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-08 09:42

Signatures

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win10v2004-20240226-en

Max time kernel

61s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Caspue2.exe"

Signatures

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Caspue2.exe

"C:\Users\Admin\AppData\Local\Temp\Caspue2.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 216.58.212.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.212.58.216.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 188.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

memory/2320-0-0x0000000074E00000-0x00000000755B0000-memory.dmp

memory/2320-1-0x0000000000830000-0x0000000000B7E000-memory.dmp

memory/2320-2-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-3-0x0000000003180000-0x0000000003186000-memory.dmp

memory/2320-4-0x0000000006060000-0x0000000006604000-memory.dmp

memory/2320-5-0x0000000005AB0000-0x0000000005B42000-memory.dmp

memory/2320-6-0x0000000074E00000-0x00000000755B0000-memory.dmp

memory/2320-7-0x0000000005BA0000-0x0000000005C06000-memory.dmp

memory/2320-8-0x0000000005880000-0x000000000588A000-memory.dmp

memory/2320-9-0x0000000000964000-0x0000000000965000-memory.dmp

memory/2320-10-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-11-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-12-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-13-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-14-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-0-0x0000000074E00000-0x00000000755B0000-memory.dmp

memory/2320-1-0x0000000000830000-0x0000000000B7E000-memory.dmp

memory/2320-2-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-3-0x0000000003180000-0x0000000003186000-memory.dmp

memory/2320-4-0x0000000006060000-0x0000000006604000-memory.dmp

memory/2320-5-0x0000000005AB0000-0x0000000005B42000-memory.dmp

memory/2320-6-0x0000000074E00000-0x00000000755B0000-memory.dmp

memory/2320-7-0x0000000005BA0000-0x0000000005C06000-memory.dmp

memory/2320-8-0x0000000005880000-0x000000000588A000-memory.dmp

memory/2320-9-0x0000000000964000-0x0000000000965000-memory.dmp

memory/2320-10-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-11-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-12-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-13-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2320-14-0x00000000059A0000-0x00000000059B0000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win7-20240221-en

Max time kernel

117s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\EAC.exe"

Signatures

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\reg.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\system32\reg.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor C:\Windows\system32\reg.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate C:\Windows\system32\reg.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\system32\reg.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\system32\reg.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1524 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\EAC.exe C:\Windows\system32\cmd.exe
PID 1524 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\EAC.exe C:\Windows\system32\cmd.exe
PID 1524 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\EAC.exe C:\Windows\system32\cmd.exe
PID 3064 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3064 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3064 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3064 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3064 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3064 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3064 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\EAC.exe

"C:\Users\Admin\AppData\Local\Temp\EAC.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\68D1.tmp\EAC.bat" "C:\Users\Admin\AppData\Local\Temp\EAC.exe""

C:\Windows\system32\taskkill.exe

taskkill /f /im EpicGamesLauncher.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteClient-Win64-Shipping.exe

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d caspue18823 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d caspue1950 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {be8384} /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {caspue28824-12043-10926-4094} /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {caspue8152-6042-17998-5238} /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d caspue1699 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d caspue6113 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d caspue29639 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d caspue7267-27672-25868-13284 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d caspue1135-23817-12346-11420 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 28361-30393-22062-27120 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 4216 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {caspue20196-14151-9751-26863} /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /f

C:\Windows\system32\reg.exe

reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\Tracing\Microsoft\Profile\Profile /v Guid /t REG_SZ /d 7424-19378-23769-caspue6113 /f

C:\Windows\system32\xcopy.exe

xcopy "C:\Users\Admin\AppData\Local\Temp\EAC.exe"\..\SplashScreen.png C:\Program" "Files\Epic" "Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Launcher /O /X /E /H /K

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\68D1.tmp\EAC.bat

MD5 c01f96bdf2ff1657b09bba3ed640cb32
SHA1 d18e01d79bb532de8b2eab8db8eeb1101f8d0d88
SHA256 1b723906890b1b6773f991127fc6b0989f7b416047cad905294c764aaf63de52
SHA512 90b5cfc6505ce146f785c10fc40a8dbf2d957e89710ff44cc5458313409e042514330fdfea8c71c69bdf1ea24a3a3bdf7746f16585409570ef2e9ca06ca55b8d

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win7-20240215-en

Max time kernel

117s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\caspue.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\caspue.exe

"C:\Users\Admin\AppData\Local\Temp\caspue.exe"

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\reset_adapters.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\reset_adapters.exe

"C:\Users\Admin\AppData\Local\Temp\reset_adapters.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 136.71.105.51.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win10v2004-20240226-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\EAC.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\EAC.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\reg.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor C:\Windows\system32\reg.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate C:\Windows\system32\reg.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\reg.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\reg.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\reg.exe N/A
Delete value \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\system32\reg.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4364 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\EAC.exe C:\Windows\system32\cmd.exe
PID 4364 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\EAC.exe C:\Windows\system32\cmd.exe
PID 3476 wrote to memory of 4428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3476 wrote to memory of 4428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3476 wrote to memory of 3244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3476 wrote to memory of 3244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3476 wrote to memory of 964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4168 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4168 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4456 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4456 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 3148 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 3148 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 968 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 968 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 2280 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 2280 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 1504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 1504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 2348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 2348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 3540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 3540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4156 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4156 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 1512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 1512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 3172 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 3172 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 3128 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 3128 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4160 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4160 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4356 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4356 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3476 wrote to memory of 1164 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\xcopy.exe
PID 3476 wrote to memory of 1164 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\xcopy.exe

Processes

C:\Users\Admin\AppData\Local\Temp\EAC.exe

"C:\Users\Admin\AppData\Local\Temp\EAC.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\13C2.tmp\EAC.bat" "C:\Users\Admin\AppData\Local\Temp\EAC.exe""

C:\Windows\system32\taskkill.exe

taskkill /f /im EpicGamesLauncher.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im FortniteClient-Win64-Shipping.exe

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d caspue18849 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d caspue22402 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {be20225} /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {caspue24722-29024-9572-28993} /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {caspue17502-7063-1582-4055} /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d caspue2051 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d caspue19384 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d caspue30937 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d caspue20964-2537-11036-29614 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d caspue15781-15406-5366-4195 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 17408-20974-7814-17287 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 10844 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {caspue20930-28559-8992-18102} /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /f

C:\Windows\system32\reg.exe

reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /f

C:\Windows\system32\reg.exe

reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\Tracing\Microsoft\Profile\Profile /v Guid /t REG_SZ /d 12678-32522-146-caspue16881 /f

C:\Windows\system32\xcopy.exe

xcopy "C:\Users\Admin\AppData\Local\Temp\EAC.exe"\..\SplashScreen.png C:\Program" "Files\Epic" "Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Launcher /O /X /E /H /K

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2824 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 3.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\13C2.tmp\EAC.bat

MD5 c01f96bdf2ff1657b09bba3ed640cb32
SHA1 d18e01d79bb532de8b2eab8db8eeb1101f8d0d88
SHA256 1b723906890b1b6773f991127fc6b0989f7b416047cad905294c764aaf63de52
SHA512 90b5cfc6505ce146f785c10fc40a8dbf2d957e89710ff44cc5458313409e042514330fdfea8c71c69bdf1ea24a3a3bdf7746f16585409570ef2e9ca06ca55b8d

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\caspue.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\caspue.exe

"C:\Users\Admin\AppData\Local\Temp\caspue.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 199.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 56.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win10v2004-20240226-en

Max time kernel

0s

Max time network

8s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\caspue.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\caspue.sys

Network

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

155s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\devcom.bat"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\devmgmt.msc C:\Windows\system32\mmc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\INF\c_media.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\miradisp.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_computeaccelerator.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\rdcameradriver.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fsundelete.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_smrdisk.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_scmdisk.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_cashdrawer.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\remoteposdrv.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_diskdrive.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\ts_generic.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_receiptprinter.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_firmware.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fsreplication.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_smrvolume.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_scmvolume.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_processor.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fsactivitymonitor.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_barcodescanner.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_apo.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_netdriver.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fsantivirus.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fsvirtualization.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_monitor.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fshsm.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\PerceptionSimulationSixDof.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_holographic.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fscompression.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fsopenfilebackup.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\oposdrv.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fssystem.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\wsdprint.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_proximity.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fsquotamgmt.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\rawsilo.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fsencryption.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_camera.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\dc1-controller.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\digitalmediadevice.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fscontentscreener.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fssecurityenhancer.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fssystemrecovery.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_linedisplay.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_extension.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_swcomponent.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fsinfrastructure.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_magneticstripereader.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_mcx.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_display.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fscopyprotection.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fscfsmetadataserver.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_sslaccel.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_volume.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_fscontinuousbackup.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\xusb22.PNF C:\Windows\system32\mmc.exe N/A
File created C:\Windows\INF\c_ucm.PNF C:\Windows\system32\mmc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom C:\Windows\system32\mmc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\system32\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\mmc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A C:\Windows\system32\mmc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A C:\Windows\system32\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ C:\Windows\system32\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\system32\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags C:\Windows\system32\mmc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\mmc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\mmc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\mmc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ C:\Windows\system32\mmc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Windows\system32\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom C:\Windows\system32\mmc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Windows\system32\mmc.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\mmc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\mmc.exe N/A
N/A N/A C:\Windows\system32\mmc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1608 wrote to memory of 4600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mmc.exe
PID 1608 wrote to memory of 4600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mmc.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\devcom.bat"

C:\Windows\system32\mmc.exe

"C:\Windows\system32\mmc.exe" "C:\Windows\system32\devmgmt.msc"

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win7-20240215-en

Max time kernel

8s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Caspue2.exe"

Signatures

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Caspue2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Caspue2.exe

"C:\Users\Admin\AppData\Local\Temp\Caspue2.exe"

Network

N/A

Files

memory/2344-1-0x0000000074950000-0x000000007503E000-memory.dmp

memory/2344-0-0x0000000000290000-0x00000000005DE000-memory.dmp

memory/2344-2-0x0000000004F80000-0x0000000004FC0000-memory.dmp

memory/2344-3-0x00000000006E0000-0x00000000006E6000-memory.dmp

memory/2344-4-0x00000000003C4000-0x00000000003C5000-memory.dmp

memory/2344-5-0x0000000004F80000-0x0000000004FC0000-memory.dmp

memory/2344-1-0x0000000074950000-0x000000007503E000-memory.dmp

memory/2344-0-0x0000000000290000-0x00000000005DE000-memory.dmp

memory/2344-2-0x0000000004F80000-0x0000000004FC0000-memory.dmp

memory/2344-3-0x00000000006E0000-0x00000000006E6000-memory.dmp

memory/2344-4-0x00000000003C4000-0x00000000003C5000-memory.dmp

memory/2344-5-0x0000000004F80000-0x0000000004FC0000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:45

Platform

win7-20240221-en

Max time kernel

117s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\spoof.exe"

Signatures

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\vsock\ImagePath = "\\??\\C:\\Windows\\vsock.sys" C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Capcom\ImagePath = "\\??\\C:\\Windows\\Capcom.sys" C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\vsock.sys C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A
File created C:\Windows\Capcom.sys C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2940 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\spoof.exe C:\Windows\system32\cmd.exe
PID 2940 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\spoof.exe C:\Windows\system32\cmd.exe
PID 2940 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\spoof.exe C:\Windows\system32\cmd.exe
PID 2608 wrote to memory of 2560 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2608 wrote to memory of 2560 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2608 wrote to memory of 2560 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2608 wrote to memory of 2516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2608 wrote to memory of 2516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2608 wrote to memory of 2516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2608 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\caspue.exe
PID 2608 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\caspue.exe
PID 2608 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\caspue.exe
PID 2484 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe C:\Windows\system32\WerFault.exe
PID 2484 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe C:\Windows\system32\WerFault.exe
PID 2484 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\spoof.exe

"C:\Users\Admin\AppData\Local\Temp\spoof.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\BDB4.tmp\spoof.bat" "C:\Users\Admin\AppData\Local\Temp\spoof.exe""

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 18889 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 20310 /f

C:\Users\Admin\AppData\Local\Temp\caspue.exe

caspue.exe caspue.sys

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2484 -s 140

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\BDB4.tmp\spoof.bat

MD5 1d4dde0fafd1f7417e6b73ccb8cb16b9
SHA1 4feec7c4c8b9a4fbd8e95a4bb088ee9e5c75d654
SHA256 2668c481de349884721a2a2860ef7d344813da395872b4d8910c6480cec27218
SHA512 5fa5109d6b746db72e315bf7122bc49f37d42fc5d1078bf4a5e2507bfc5c7ec5d66e46463a0f2919cef140a8fc1d171d176490caf63435f20d77ca81e8c09aff

Analysis: behavioral13

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\spoof.exe"

Signatures

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vsock\ImagePath = "\\??\\C:\\Windows\\vsock.sys" C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Capcom\ImagePath = "\\??\\C:\\Windows\\Capcom.sys" C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Capcom.sys C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A
File created C:\Windows\vsock.sys C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\caspue.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2784 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\spoof.exe C:\Windows\system32\cmd.exe
PID 2784 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\spoof.exe C:\Windows\system32\cmd.exe
PID 1600 wrote to memory of 4492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1600 wrote to memory of 4492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1600 wrote to memory of 4792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1600 wrote to memory of 4792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1600 wrote to memory of 3616 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\caspue.exe
PID 1600 wrote to memory of 3616 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\caspue.exe

Processes

C:\Users\Admin\AppData\Local\Temp\spoof.exe

"C:\Users\Admin\AppData\Local\Temp\spoof.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4A19.tmp\spoof.bat" "C:\Users\Admin\AppData\Local\Temp\spoof.exe""

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 18817 /f

C:\Windows\system32\reg.exe

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 13222 /f

C:\Users\Admin\AppData\Local\Temp\caspue.exe

caspue.exe caspue.sys

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 199.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 202.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 193.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\4A19.tmp\spoof.bat

MD5 1d4dde0fafd1f7417e6b73ccb8cb16b9
SHA1 4feec7c4c8b9a4fbd8e95a4bb088ee9e5c75d654
SHA256 2668c481de349884721a2a2860ef7d344813da395872b4d8910c6480cec27218
SHA512 5fa5109d6b746db72e315bf7122bc49f37d42fc5d1078bf4a5e2507bfc5c7ec5d66e46463a0f2919cef140a8fc1d171d176490caf63435f20d77ca81e8c09aff

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win7-20231129-en

Max time kernel

118s

Max time network

119s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\devcom.bat"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\devmgmt.msc C:\Windows\system32\mmc.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\mmc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\mmc.exe N/A
N/A N/A C:\Windows\system32\mmc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 756 wrote to memory of 2208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mmc.exe
PID 756 wrote to memory of 2208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mmc.exe
PID 756 wrote to memory of 2208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mmc.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\devcom.bat"

C:\Windows\system32\mmc.exe

"C:\Windows\system32\mmc.exe" "C:\Windows\system32\devmgmt.msc"

Network

N/A

Files

memory/2208-11-0x00000000020F0000-0x00000000020F1000-memory.dmp

memory/2208-12-0x000007FEF6450000-0x000007FEF648A000-memory.dmp

memory/2208-13-0x00000000020F0000-0x00000000020F1000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-08 09:42

Reported

2024-03-08 09:44

Platform

win7-20240221-en

Max time kernel

117s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\reset_adapters.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\reset_adapters.exe

"C:\Users\Admin\AppData\Local\Temp\reset_adapters.exe"

Network

N/A

Files

N/A