Overview

overview

5

Static

static

3

CRU.exe

windows10-1703-x64

1

reset-all.exe

windows10-1703-x64

1

restart.exe

windows10-1703-x64

5

restart64.exe

windows10-1703-x64

5

Resubmissions

12/03/2024, 19:39

240312-ycy87ahf5y 5

12/03/2024, 19:38

240312-ycff3sbf85 5

Analysis

  • max time kernel
    151s
  • max time network
    164s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/03/2024, 19:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    restart.exe

  • Size

    63KB

  • MD5

    8242ce426ad462eff02edae1487a6949

  • SHA1

    9a4f382d427e0de729053535aaa3310cac5f087b

  • SHA256

    b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a

  • SHA512

    aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1

  • SSDEEP

    768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 16 IoCs
  • Drops file in Windows directory 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 37 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\restart.exe
    "C:\Users\Admin\AppData\Local\Temp\restart.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Users\Admin\AppData\Local\Temp\restart64.exe
      restart64.exe
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3196
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
    1⤵
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:208
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x39c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3220
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3844
  • C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /R /T
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:3528

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\System32\wbem\Performance\WmiApRpl.h
          Filesize

          3KB

          MD5

          b133a676d139032a27de3d9619e70091

          SHA1

          1248aa89938a13640252a79113930ede2f26f1fa

          SHA256

          ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15

          SHA512

          c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

          Download Submit

        • C:\Windows\System32\wbem\Performance\WmiApRpl.ini
          Filesize

          29KB

          MD5

          ffdeea82ba4a5a65585103dd2a922dfe

          SHA1

          094c3794503245cc7dfa9e222d3504f449a5400b

          SHA256

          c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390

          SHA512

          7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a

          Download Submit

        • memory/3844-8-0x000001FEEDC20000-0x000001FEEDC40000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3844-11-0x000001FEEDF40000-0x000001FEEDF60000-memory.dmp

          Filesize

          128KB

          Download