Analysis
- max time kernel
62s - max time network
41s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
16/03/2024, 15:20
Errors
General
- Target Trojan/2repair.exe
- Size 10.2MB
- Sample240316-sq9desff34
- SHA256 327e9f126a7d897239ddafc8adbae981e6a4c00d4d3383846ceb8d2befefef04
Malware Config
Signatures
- Windows security bypass 2 TTPs 3 IoCs
- Disables RegEdit via registry modification 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 37 IoCs
- Loads dropped DLL 9 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
- Delays execution with timeout.exe 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 5 IoCs
- Modifies Internet Explorer start page 1 TTPs 2 IoCs
- Modifies registry class 64 IoCs
- Runs net.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam 28 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 29 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 4 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1758.tmp\1759.tmp\175A.bat C:\Users\Admin\AppData\Local\Temp\Trojan\2repair.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\FreeMicrosoft.exeFreeMicrosoft.exe3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\AntivirusPlatinum.exeAntivirusPlatinum.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\302746537.exe"C:\WINDOWS\302746537.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\2D76.tmp\302746537.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s c:\windows\comctl32.ocx6⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s c:\windows\mscomctl.ocx6⤵
- Modifies registry class
-
-
\??\c:\windows\antivirus-platinum.exec:\windows\antivirus-platinum.exe6⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h c:\windows\antivirus-platinum.exe6⤵
- Drops file in Windows directory
- Views/modifies file attributes
-
-
-
-
-
C:\Windows\system32\timeout.exetimeout /t 23⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Antivirus.exeAntivirus.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\net.exenet stop wscsvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop winmgmt /y4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop winmgmt /y5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet start winmgmt4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start winmgmt5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet start wscsvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start wscsvc5⤵
-
-
-
C:\Windows\SysWOW64\Wbem\mofcomp.exemofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\taskkill.exetaskkill /IM lsass.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Badgame.exeBadgame.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Hydra.exeHydra.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\SGen.exeSGen.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\SFC3820.tmp.vbs"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\runaway.exerunaway.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\timeout.exetimeout /t 103⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\Melting.exeMelting.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\PCOptimizerProInstaller.exePCOptimizerProInstaller.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\VirusCan.exeVirusCan.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6171.tmp\VirusCan.bat""4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exematrix.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6162.tmp\6163.tmp\6164.bat C:\Users\Admin\AppData\Local\Temp\Trojan\matrix.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\bomb.exebomb.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan\ChilledWindows.exeChilledWindows.exe3⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2320 -s 6524⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
175A.bat
302746537.bat
4otjesjty.mof
VirusCan.bat
Antivirus.exe
AntivirusPlatinum.exe
Badgame.exe
ChilledWindows.exe
Hydra.exe
PCOptimizerProInstaller.exe
SGen.exe
VirusCan.exe
bomb.exe
matrix.exe
runaway.exe
302746537.exe
antivirus-platinum.exe
comctl32.ocx
mscomctl.ocx
Melting.exe
GetVersion.dll
LangDLL.dll
memory/384-129-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/384-165-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/672-136-0x0000000004610000-0x0000000004650000-memory.dmp
memory/672-133-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/672-176-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/884-81-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/884-143-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/884-85-0x0000000000210000-0x0000000000250000-memory.dmp
memory/1028-139-0x0000000002080000-0x00000000020C0000-memory.dmp
memory/1028-98-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1028-152-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1308-80-0x0000000000050000-0x0000000000058000-memory.dmp
memory/1308-140-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1308-82-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1316-243-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1392-124-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1392-160-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1556-172-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1556-141-0x00000000005D0000-0x0000000000610000-memory.dmp
memory/1556-131-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1612-117-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1612-157-0x0000000001E70000-0x0000000001EB0000-memory.dmp
memory/1612-155-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1612-119-0x0000000001E70000-0x0000000001EB0000-memory.dmp
memory/1636-132-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1636-153-0x0000000004890000-0x00000000048D0000-memory.dmp
memory/1636-167-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1636-120-0x0000000004890000-0x00000000048D0000-memory.dmp
memory/1676-185-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1968-135-0x00000000045C0000-0x0000000004600000-memory.dmp
memory/1968-128-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/1968-164-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2120-156-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2120-118-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2120-145-0x0000000001ED0000-0x0000000001F10000-memory.dmp
memory/2248-121-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2248-154-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2248-144-0x0000000000480000-0x00000000004C0000-memory.dmp
memory/2264-123-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2264-159-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2272-151-0x00000000046E0000-0x0000000004720000-memory.dmp
memory/2272-137-0x00000000046E0000-0x0000000004720000-memory.dmp
memory/2272-102-0x0000000000030000-0x0000000000040000-memory.dmp
memory/2272-158-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2272-122-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2284-163-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2284-127-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2288-161-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2288-125-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2316-138-0x0000000000450000-0x0000000000490000-memory.dmp
memory/2316-130-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2316-166-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2432-146-0x0000000004630000-0x0000000004670000-memory.dmp
memory/2432-162-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2432-126-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/2516-234-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2528-68-0x0000000000130000-0x000000000013D000-memory.dmp
memory/2528-70-0x0000000000130000-0x000000000013D000-memory.dmp
memory/2592-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2592-73-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2632-142-0x0000000000400000-0x000000000040D000-memory.dmp
memory/2632-72-0x0000000000400000-0x000000000040D000-memory.dmp
memory/2648-134-0x0000000000490000-0x0000000000496000-memory.dmp
memory/2648-42-0x0000000000490000-0x0000000000496000-memory.dmp
memory/3004-150-0x0000000000340000-0x0000000000380000-memory.dmp
memory/3004-84-0x0000000000340000-0x0000000000380000-memory.dmp
memory/3004-83-0x00000000743F0000-0x0000000074ADE000-memory.dmp
memory/3004-147-0x00000000743F0000-0x0000000074ADE000-memory.dmp