Overview

overview

10

Static

static

10

ccsetup622.exe

windows7-x64

7

ccsetup622.exe

windows10-2004-x64

6

$PLUGINSDIR/INetC.dll

windows7-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$_131_/lang-1025.dll

windows7-x64

1

$_131_/lang-1025.dll

windows10-2004-x64

1

$_131_/lang-1026.dll

windows7-x64

1

$_131_/lang-1026.dll

windows10-2004-x64

1

$_131_/lang-1027.dll

windows7-x64

1

$_131_/lang-1027.dll

windows10-2004-x64

1

$_131_/lang-1028.dll

windows7-x64

1

$_131_/lang-1028.dll

windows10-2004-x64

1

$_131_/lang-1029.dll

windows7-x64

1

$_131_/lang-1029.dll

windows10-2004-x64

1

$_131_/lang-1030.dll

windows7-x64

1

$_131_/lang-1030.dll

windows10-2004-x64

1

$_131_/lang-1031.dll

windows7-x64

1

$_131_/lang-1031.dll

windows10-2004-x64

1

$_131_/lang-1032.dll

windows7-x64

1

$_131_/lang-1032.dll

windows10-2004-x64

1

$_131_/lang-1034.dll

windows7-x64

1

$_131_/lang-1034.dll

windows10-2004-x64

1

$_131_/lang-1035.dll

windows7-x64

1

$_131_/lang-1035.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    131s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2024, 14:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ccsetup622.exe
  • Size 79.5MB
  • Sample240324-ry5vjadc58
  • SHA256 69c172059f6242ae92efcc418a3eb4fb568f2ce193403194652f6ae962680cfe
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccsetup622.exe
    "C:\Users\Admin\AppData\Local\Temp\ccsetup622.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2644

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\System.dll
        • Size 12KB
        • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UserInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\UserInfo.dll
        • Size 4KB
        • SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
        • MD5 SHA1 SHA512
        Submit Download

        asdk.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\a\asdk.dll
        • Size 1.0MB
        • SHA256 74fcd2367fb1d9c0084547ebaf1c6db081946453a5d0a2d668d83d3c489a60a9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        gcapi_dll.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\g\gcapi_dll.dll
        • Size 348KB
        • SHA256 d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pfBL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\p\pfBL.dll
        • Size 13.4MB
        • SHA256 16300bcdbfaeb2c1a55be0099094ddee3a05b6775f59b1e793a32d6c2cc42643
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pfUI.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\ui\pfUI.dll
        • Size 18.1MB
        • SHA256 92a3d60fce2dae1d649721d1fa4679005fd8e8bcbf386718749d75b928ca3123
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CC_Logo_40x96.png
        • Path C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\ui\res\CC_Logo_40x96.png
        • Size 2KB
        • SHA256 b013039e32d2f8e54cfebdbfdabc25f21aa0bbe9ef26a2a5319a20024961e9a7
        • MD5 SHA1 SHA512
        Submit Download

        CC_logo_72x66.png
        • Path C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\ui\res\CC_logo_72x66.png
        • Size 7KB
        • SHA256 58e75de1789c90333daaf93176194d2a3d64f2eecdf57a4b9384a229e81f874f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PF_computer.png
        • Path C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\ui\res\PF_computer.png
        • Size 87KB
        • SHA256 dbd8b6fdb66604a0a5e8efe269fbfa598e4a94dc146006036409d905209da42b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download