cdb4690f2f00fef918fc2f175c19045f0fb346a499e59f0b8ec2a6f64b03f52e

Resubmissions

23/04/2024, 14:27

240423-rsfnfshb26 3

23/04/2024, 14:24

240423-rqq2eaha3t 3

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Toolbox OptimizerV1.0.exe
Size

455KB
MD5

0569b38220c2d30697ffbc398308f213
SHA1

d01b93f9b2c6c6f8269e47134ee2a8639cdb29af
SHA256

cdb4690f2f00fef918fc2f175c19045f0fb346a499e59f0b8ec2a6f64b03f52e
SHA512

380ad86a1f83d2f9cd2461f666fc38245c8a0dea1a6bcdf5ad5b161fd72d092826cb5fb33bb278cec09866e9a8dfa95b054fa1d35719e52665e85cfbdfe9374f
SSDEEP

3072:Q7DhdC6kzWypvaQ0FxyNTBf87pzseuW8Rz7m2klts+CDiVsgw7b6:QBlkZvaF4NTBE7LUKwzgw7b6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 3936	4184	Toolbox OptimizerV1.0.exe	92
PID 4184 wrote to memory of 3936	4184	Toolbox OptimizerV1.0.exe	92
PID 3936 wrote to memory of 4688	3936	cmd.exe	93
PID 3936 wrote to memory of 4688	3936	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\15A6.tmp\15B7.tmp\15B8.bat "C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\system32\mode.com
    mode con:cols=128 lines=40
    3⤵
    PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\15A6.tmp\15B7.tmp\15B8.bat

Filesize
87KB

MD5
3512b263fbfaa854e3dffc248d511dd4

SHA1
db752939ffb2659bd32b9c4b91c2173a6a505082

SHA256
7dc4222c41085904ae65a81d758911fd0b1ef3f0578368fc5d17c3e0240d2450

SHA512
8f54d744bf9e1368352049f3ec9aa5422494c66d7ea1e9893b3d0daecc773810148076dcfe1160b2f36ee93aa5b18ff013992b6e3abd1c8517429ff76b54cba2

Download Submit