Analysis
- max time kernel
233s - max time network
334s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
16/03/2024, 15:16
General
- Target Trojan/2repair.exe
- Size 10.2MB
- Sample240316-sns9esdf21
- SHA256 327e9f126a7d897239ddafc8adbae981e6a4c00d4d3383846ceb8d2befefef04
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 35 IoCs
- Loads dropped DLL 7 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 4 IoCs
- Delays execution with timeout.exe 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 64 IoCs
- Runs net.exe
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 26 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\33AA.tmp\33BB.tmp\33BC.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exeFreeMicrosoft.exe3⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exeAntivirusPlatinum.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\302746537.exe"C:\WINDOWS\302746537.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4941.tmp\302746537.bat" "5⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s c:\windows\comctl32.ocx6⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s c:\windows\mscomctl.ocx6⤵
- Loads dropped DLL
- Modifies registry class
-
-
\??\c:\windows\antivirus-platinum.exec:\windows\antivirus-platinum.exe6⤵
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h c:\windows\antivirus-platinum.exe6⤵
- Views/modifies file attributes
-
-
-
-
-
C:\Windows\system32\timeout.exetimeout /t 23⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exeAntivirus.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\net.exenet stop wscsvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop winmgmt /y4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop winmgmt /y5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet start winmgmt4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start winmgmt5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet start wscsvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start wscsvc5⤵
-
-
-
C:\Windows\SysWOW64\Wbem\mofcomp.exemofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\taskkill.exetaskkill /IM lsass.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exeBadgame.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exeHydra.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exeSGen.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\SFCB1C3.tmp.vbs"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\timeout.exetimeout /t 103⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exePCOptimizerProInstaller.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exeVirusCan.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\13E8.tmp\VirusCan.bat""4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exematrix.exe3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\109D.tmp\109E.tmp\109F.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exebomb.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exeChilledWindows.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x420 0x4981⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
WMSDKNS.XML
109F.bat
VirusCan.bat
33BC.bat
302746537.bat
4otjesjty.mof
SFCB1C3.tmp.vbs
Antivirus.exe
AntivirusPlatinum.exe
Badgame.exe
ChilledWindows.exe
ChilledWindows.exe
Hydra.exe
Melting.exe
PCOptimizerProInstaller.exe
PCOptimizerProInstaller.exe
SGen.exe
VirusCan.exe
bomb.exe
matrix.exe
runaway.exe
GetVersion.dll
LangDLL.dll
System.dll
nsDialogs.dll
302746537.exe
COMCTL32.OCX
MSCOMCTL.OCX
MSCOMCTL.OCX
antivirus-platinum.exe
memory/764-77-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/764-208-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/764-98-0x0000000005010000-0x0000000005020000-memory.dmp
memory/764-70-0x0000000005390000-0x0000000005934000-memory.dmp
memory/872-81-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/1116-211-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/1116-75-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/1916-94-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/2008-220-0x00000000048B0000-0x00000000048C0000-memory.dmp
memory/2008-88-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/2140-78-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2268-92-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/2296-85-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/2300-97-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/2692-76-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/2692-194-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3032-217-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/3032-95-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3032-68-0x0000000000520000-0x0000000000528000-memory.dmp
memory/3112-209-0x000000001CED0000-0x000000001CED8000-memory.dmp
memory/3112-210-0x000000001C830000-0x000000001C840000-memory.dmp
memory/3112-146-0x00000000007A0000-0x0000000000C04000-memory.dmp
memory/3112-221-0x000000001C830000-0x000000001C840000-memory.dmp
memory/3112-213-0x000000001D540000-0x000000001D578000-memory.dmp
memory/3112-214-0x000000001D310000-0x000000001D31E000-memory.dmp
memory/3112-170-0x00007FFBACB50000-0x00007FFBAD611000-memory.dmp
memory/3112-223-0x000000001C830000-0x000000001C840000-memory.dmp
memory/3112-173-0x000000001C830000-0x000000001C840000-memory.dmp
memory/3112-230-0x00007FFBACB50000-0x00007FFBAD611000-memory.dmp
memory/3512-83-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/4364-87-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/4648-161-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4648-102-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4648-153-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4676-74-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/4676-192-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/4696-73-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/4696-191-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/4708-157-0x000000006F440000-0x000000006F449000-memory.dmp
memory/4708-229-0x000000006F440000-0x000000006F449000-memory.dmp
memory/4708-158-0x000000006F440000-0x000000006F449000-memory.dmp
memory/4708-228-0x000000006F440000-0x000000006F449000-memory.dmp
memory/4812-80-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/4812-212-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/4832-72-0x0000000004F70000-0x0000000005002000-memory.dmp
memory/4832-86-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/4932-82-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/5008-96-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/5008-218-0x0000000004B70000-0x0000000004B80000-memory.dmp
memory/5040-79-0x0000000005650000-0x000000000565A000-memory.dmp
memory/5040-222-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/5040-174-0x00000000057B0000-0x00000000057C0000-memory.dmp
memory/5040-99-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/5040-69-0x0000000000C50000-0x0000000000C60000-memory.dmp
memory/5060-180-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5060-172-0x00000000005C0000-0x00000000005C1000-memory.dmp
memory/5648-182-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5648-232-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5988-224-0x0000000000400000-0x000000000040D000-memory.dmp