d26a7f2d4f3521827201e6cdcd296f132c7d18c3a1ce70c24b423300cff326fe

Analysis

max time kernel
541s
max time network
588s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

360TS_Setup_Mini.exe
Size

1.4MB
MD5

31fee2c73b8d2a8ec979775cd5f5ced7
SHA1

39182a68bc0c1c07d3ddc47cd69fe3692dbac834
SHA256

d26a7f2d4f3521827201e6cdcd296f132c7d18c3a1ce70c24b423300cff326fe
SHA512

db51b602a8675641bc3a0a980a197243787ed12f5e0619cb1d390c91193d7e3447e3e86e2321c3ea273c6732b356003a249241d7d8a5699931810e5a35d5c650
SSDEEP

24576:kL/7n6lbcC8oblv1zj1SqdAGFQZIxvC45UJoe1Z:E6+C8o5tzjYq+ZIxL5UJoeL

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

360TS_Setup_Mini.exe360TS_Setup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	360TS_Setup_Mini.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	360TS_Setup.exe

Executes dropped EXE 2 IoCs

Processes:

360TS_Setup.exe360TS_Setup.exe

pid process

2308 360TS_Setup.exe
4376 360TS_Setup.exe
Loads dropped DLL 3 IoCs

Processes:

360TS_Setup_Mini.exe360TS_Setup.exe360TS_Setup.exe

pid process

4080 360TS_Setup_Mini.exe
2308 360TS_Setup.exe
4376 360TS_Setup.exe
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

360TS_Setup.exe360TS_Setup_Mini.exe

description ioc process

File opened for modification \??\PhysicalDrive0 360TS_Setup.exe
File opened for modification \??\PhysicalDrive0 360TS_Setup_Mini.exe

pid	process
2308	360TS_Setup.exe
4376	360TS_Setup.exe

pid	process
4080	360TS_Setup_Mini.exe
2308	360TS_Setup.exe
4376	360TS_Setup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	360TS_Setup.exe
File opened for modification	\??\PhysicalDrive0	360TS_Setup_Mini.exe

Drops file in Program Files directory 2 IoCs

Processes:

360TS_Setup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\1711473229_0\360TS_Setup.exe	360TS_Setup.exe
File created	C:\Program Files (x86)\1711473229_0\360TS_Setup.exe	360TS_Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

360TS_Setup_Mini.exe

description pid process

Token: SeManageVolumePrivilege 4080 360TS_Setup_Mini.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

360TS_Setup_Mini.exe

pid process

4080 360TS_Setup_Mini.exe
4080 360TS_Setup_Mini.exe
4080 360TS_Setup_Mini.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

360TS_Setup_Mini.exe

pid process

4080 360TS_Setup_Mini.exe
4080 360TS_Setup_Mini.exe
4080 360TS_Setup_Mini.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

360TS_Setup.exe360TS_Setup.exe

pid process

2308 360TS_Setup.exe
4376 360TS_Setup.exe

description	pid	process
Token: SeManageVolumePrivilege	4080	360TS_Setup_Mini.exe

pid	process
4080	360TS_Setup_Mini.exe
4080	360TS_Setup_Mini.exe
4080	360TS_Setup_Mini.exe

pid	process
4080	360TS_Setup_Mini.exe
4080	360TS_Setup_Mini.exe
4080	360TS_Setup_Mini.exe

pid	process
2308	360TS_Setup.exe
4376	360TS_Setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

360TS_Setup_Mini.exe360TS_Setup.exe

description	pid	process	target process
PID 4080 wrote to memory of 2308	4080	360TS_Setup_Mini.exe	360TS_Setup.exe
PID 4080 wrote to memory of 2308	4080	360TS_Setup_Mini.exe	360TS_Setup.exe
PID 4080 wrote to memory of 2308	4080	360TS_Setup_Mini.exe	360TS_Setup.exe
PID 2308 wrote to memory of 4376	2308	360TS_Setup.exe	360TS_Setup.exe
PID 2308 wrote to memory of 4376	2308	360TS_Setup.exe	360TS_Setup.exe
PID 2308 wrote to memory of 4376	2308	360TS_Setup.exe	360TS_Setup.exe

C:\Users\Admin\AppData\Local\Temp\360TS_Setup_Mini.exe
"C:\Users\Admin\AppData\Local\Temp\360TS_Setup_Mini.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4080

C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe" /c:101 /pmode:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308

C:\Program Files (x86)\1711473229_0\360TS_Setup.exe
"C:\Program Files (x86)\1711473229_0\360TS_Setup.exe" /c:101 /pmode:2 /TSinstall
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\1711473229_0\360TS_Setup.exe
Filesize
5.4MB

MD5
bdf79e4dff583d5c7153ea87554d9e41

SHA1
a24ef1477feca5bf8a424c8d48491a5d1ea7b018

SHA256
92bc5219fe516115e45c5a2391e47e0318ba2dac1f5a975df97389b4840dd9ca

SHA512
92dbc0c48187819bba57ed2575c7db89c8a390a31b2b118616633bfd7217210454820d7cebc6307a214d1a21b56d1cc3b88f34c5653341c82870bdeaf2342f04

Download Submit
C:\Program Files (x86)\1711473229_0\360TS_Setup.exe
Filesize
6.0MB

MD5
0b19020165ab7fe8feea947d9a9aea75

SHA1
73dc2de2c327a4a80ae70a315ad295cc6ca52c42

SHA256
3970fc7b234de58b96366db8c80a125002d9d94d9fd32e845fbccf27b0e3f299

SHA512
251224cc76f4adbbf4a20724fa28a87d467a1639cfb90dfc1c58f83de96f8f2b797ee32796503bae19e442e697defe1f6893dc62d5a2d5a36f9b65b2f227a0ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize
656B

MD5
10dbee10ea7d876a154ca0447427b4ca

SHA1
222fd663a5e0b6d3e5b0018700b992cd5e744f05

SHA256
52a5faa5428e8a9fedfee3d2ad0f45d396f6c1cef3233c28c0ec82c435c1b688

SHA512
68805a3151b03e3f5ed485d7ae4fbd848e123fd180e6c35445a4c96791b18c250824d3e79b7874bcc36234888334acb75a7d899338d8e1d56af8bb77ddc0ce10

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
Filesize
830B

MD5
2cd1feda405a32b03b262816aa5ae9bf

SHA1
686a0db640a91fd1064c013a678ce8d243d7553a

SHA256
f7760f7abf7b3711c2e3652d64dc5248fec374145af3cb96d6ad1b83c933bdbb

SHA512
57f2564f31161d67a09da0d512854491a58d47a1ad23fdb624bd607d7a2ac8d3ca312c3aefc2b0ba73d76bdbd38683ebc7f5d680993312c3776d02d32f52b182

Download Submit
C:\Users\Admin\AppData\Local\Temp\1711473229_00000000_base\360base.dll
Filesize
1.0MB

MD5
b192f34d99421dc3207f2328ffe62bd0

SHA1
e4bbbba20d05515678922371ea787b39f064cd2c

SHA256
58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73

SHA512
00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
Filesize
77.0MB

MD5
1145492cd7e38c56bcaae4c549057984

SHA1
10966f9f6a263c94b3200e1b3a6c6bc2a288412c

SHA256
6b66aad1069c09caaf7f410c46fde78e2fd370a61947c915da18f36163ca50ea

SHA512
8f4d1cee28aeb63dcd6002a1a276e730fcab9833b19004ab491772b2215b8ac4dc270b32c5917c9077e36e01406e3b8030ddd7504965bbad660b7d45a4e537bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
Filesize
62.6MB

MD5
7d89343a4adca1e388ba1d4432ee462e

SHA1
e8d56c79cdc5eb95b6cb2052fff894539d86ec1f

SHA256
cd38347083b8c4bc54d28a29e5f85793bd5dd2677915ba1665d6a6aea1b1ea46

SHA512
64dd923cf5af0dd1e5e1f4d7eafe624b5b675f33556fd4efb7493948b655b9efd6aad441ecb713eb96e8023bbb79b6447d43eceb13b85b42c407639f1db7f3f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
Filesize
42.9MB

MD5
8cd036561ce4863c6c3177a1804abc06

SHA1
fb5d6b41cc395091255cc318f4236783af310d9b

SHA256
74d813a73d461e8c46940a0bdedc888081139d27fae0123875902db2eb647365

SHA512
1a52af30f6e95de8de50483a36a4b775e9d6ab55d0f3b857cc00c9094565d7df78f51da6991f7595a692ce0d9391b97557fdc9c3c31b10d77dc1b45437c68794

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1EFB7FC3-B8B1-4641-81DA-24C283F091D1}.tmp
Filesize
3KB

MD5
b1ddd3b1895d9a3013b843b3702ac2bd

SHA1
71349f5c577a3ae8acb5fbce27b18a203bf04ede

SHA256
46cda5ad256bf373f5ed0b2a20efa5275c1ffd96864c33f3727e76a3973f4b3c

SHA512
93e6c10c4a8465bc2e58f4c7eb300860186ddc5734599bcdad130ff9c8fd324443045eac54bbc667b058ac1fa271e5b7645320c6e3fc2f28cc5f824096830de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{32D02FA0-6B6B-480f-BAE5-0DDC095A4487}.tmp\360P2SP.dll
Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
memory/4080-9-0x0000000003E40000-0x0000000003E41000-memory.dmp

Filesize
4KB

Download
memory/4080-50-0x0000000003E40000-0x0000000003E41000-memory.dmp

Filesize
4KB

Download