734403a96fad68cb2ef2b340adddd9cadd5894007aac703dcdb4a4cb8326c538

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/ColorBug/[email protected]
Size

53KB
MD5

6536b10e5a713803d034c607d2de19e3
SHA1

a6000c05f565a36d2250bdab2ce78f505ca624b7
SHA256

775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de
SHA512

61727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018
SSDEEP

1536:ynqAKryDLrASOcRw52sjzIUK7RkYrJ2lrKX:SNdMT8Z8cX

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

[email protected]

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe" [email protected]

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe"	[email protected]

Modifies Control Panel 21 IoCs

evasion

Processes:

[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\Scrollbar = "202 143 193"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\WindowFrame = "75 216 90"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\MenuText = "184 117 208"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\TitleText = "226 19 166"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\Hilight = "78 92 92"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\ButtonFace = "218 127 178"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\InactiveTitleText = "156 3 225"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\Window = "15 167 177"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\ActiveBorder = "7 156 53"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\ActiveTitle = "85 23 121"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\Menu = "54 124 174"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\WindowText = "202 15 236"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\AppWorkspace = "106 179 135"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\ButtonText = "100 218 212"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\Background = "225 81 97"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\InactiveTitle = "73 172 157"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\InactiveBorder = "85 220 196"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\HilightText = "99 75 70"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\ButtonShadow = "90 161 153"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Colors\GrayText = "29 218 246"	[email protected]

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 1968 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	1968	svchost.exe

C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\ColorBug\[email protected]
"C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\ColorBug\[email protected]"
1⤵
- Adds Run key to start application
- Modifies Control Panel
PID:3060

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-1-0x0000022B5E540000-0x0000022B5E550000-memory.dmp

Filesize
64KB

Download
memory/1968-17-0x0000022B5E640000-0x0000022B5E650000-memory.dmp

Filesize
64KB

Download
memory/1968-33-0x0000022B66950000-0x0000022B66951000-memory.dmp

Filesize
4KB

Download
memory/1968-35-0x0000022B66980000-0x0000022B66981000-memory.dmp

Filesize
4KB

Download
memory/1968-36-0x0000022B66980000-0x0000022B66981000-memory.dmp

Filesize
4KB

Download
memory/1968-37-0x0000022B66A90000-0x0000022B66A91000-memory.dmp

Filesize
4KB

Download
memory/3060-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download