Overview
overview
9Static
static
7UB Downloa...ir.exe
windows10-1703-x64
8UB Downloa...or.exe
windows10-1703-x64
9UB Downloa...ix.bat
windows10-1703-x64
1UB Downloa...h2.exe
windows10-1703-x64
5UB Downloa...ix.bat
windows10-1703-x64
9UB Downloa...ix.bat
windows10-1703-x64
1UB Downloa...b1.exe
windows10-1703-x64
5UB Downloa...ix.bat
windows10-1703-x64
9Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
11-04-2024 05:34
Behavioral task
behavioral1
Sample
UB Downloads 6.4.24/UB Downloads/Loud Chair.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
UB Downloads 6.4.24/UB Downloads/Privacy Protector.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
UB Downloads 6.4.24/UB Downloads/UB Silent/bsod fix.bat
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
UB Downloads 6.4.24/UB Downloads/UB Silent/u237cgatAh2.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
UB Downloads 6.4.24/UB Downloads/UB Silent/w11 fix.bat
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
UB Downloads 6.4.24/UB Downloads/Unlock All/bsod fix.bat
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
UB Downloads 6.4.24/UB Downloads/Unlock All/nRi28Wtqb1.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
UB Downloads 6.4.24/UB Downloads/Unlock All/w11 fix.bat
Resource
win10-20240404-en
General
-
Target
UB Downloads 6.4.24/UB Downloads/Unlock All/bsod fix.bat
-
Size
415B
-
MD5
392f331dc1744fbe560a2a17d7ca838f
-
SHA1
817559945e137d036f47b26696d4fab5f22572c1
-
SHA256
318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
-
SHA512
0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
Malware Config
Signatures
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.exenet.exedescription pid process target process PID 440 wrote to memory of 200 440 cmd.exe net.exe PID 440 wrote to memory of 200 440 cmd.exe net.exe PID 200 wrote to memory of 2744 200 net.exe net1.exe PID 200 wrote to memory of 2744 200 net.exe net1.exe PID 440 wrote to memory of 4524 440 cmd.exe reg.exe PID 440 wrote to memory of 4524 440 cmd.exe reg.exe PID 440 wrote to memory of 216 440 cmd.exe reg.exe PID 440 wrote to memory of 216 440 cmd.exe reg.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UB Downloads 6.4.24\UB Downloads\Unlock All\bsod fix.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\system32\net.exeNET SESSION2⤵
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 SESSION3⤵PID:2744
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 32⤵PID:4524
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 32⤵PID:216