Analysis

  • max time kernel
    146s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-03-2024 23:01

General

  • Target

    Windows/PCToaster/PCToaster.exe

  • Size

    411KB

  • MD5

    04251a49a240dbf60975ac262fc6aeb7

  • SHA1

    e211ca63af2ab85ffab1e5fbbdf28a4ef8f77de0

  • SHA256

    85a58aa96dccd94316a34608ba996656a22c8158d5156b6e454d9d69e6ff38c3

  • SHA512

    3422a231e1dadb68d3567a99d46791392ecf5883fd3bbc2cae19a595364dac46e4b2712db70b61b488937d906413d39411554034ffd3058389700a93c17568d2

  • SSDEEP

    3072:quJFS5Aqu+WwjxeI/0gVnfKl0FA+aPobO24yNz88iu8vDYHTlI5EJD5Hbibfd6PK:/JM0mCsWq1/qpz+nF5c

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows\PCToaster\PCToaster.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows\PCToaster\PCToaster.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Windows\PCToaster\PCToaster.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:4660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    94d013f15c045a4c2d24df2131bf4000

    SHA1

    d8e76aaea999b01e027aed7b2f837a3709dded14

    SHA256

    d5d01af08aaa59f052dc9f855d2fc388f424338c05d877d81ae4d9129ae84627

    SHA512

    aa9ad30efcb50a63fd55a089a1c4c80bd304d7e07b75ef736628c9022a94d3371f116e8a34e1bcb1867e095ada13dadfbcbac16dff8e89fc144dea4afa3be106

  • memory/1184-3-0x000001466A2E0000-0x000001466B2E0000-memory.dmp

    Filesize

    16.0MB

  • memory/1184-13-0x000001466A2C0000-0x000001466A2C1000-memory.dmp

    Filesize

    4KB

  • memory/1184-19-0x000001466A2C0000-0x000001466A2C1000-memory.dmp

    Filesize

    4KB

  • memory/1184-24-0x000001466A2C0000-0x000001466A2C1000-memory.dmp

    Filesize

    4KB

  • memory/1184-28-0x000001466A2C0000-0x000001466A2C1000-memory.dmp

    Filesize

    4KB

  • memory/1184-29-0x000001466A2C0000-0x000001466A2C1000-memory.dmp

    Filesize

    4KB

  • memory/1184-40-0x000001466A2E0000-0x000001466B2E0000-memory.dmp

    Filesize

    16.0MB

  • memory/1184-46-0x000001466A2C0000-0x000001466A2C1000-memory.dmp

    Filesize

    4KB

  • memory/4864-0-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB