Analysis
-
max time kernel
239s -
max time network
247s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09/05/2024, 13:06
General
-
Target
uTorrent_zipsoft__13454__[29527].exe
-
Size
673KB
-
MD5
f485331235333f85377f0a5da49f18db
-
SHA1
44d80e2691b35705a20e3f8605a6b316a850ea48
-
SHA256
5d0e089ecc3b9070368bd983cf7c56360b6d1f12bee8ea5a14df8b956fc31cf5
-
SHA512
dfb3cf30bee7580a50097dcb2ead98a70c7ec60dd3ada52c6cae2f174f8e14b85693b9983d039557aca34a9b4136d755f8e198902965712d746c56d44cba2bf4
-
SSDEEP
12288:9w8eE43nhb40+56Dbf4HIkwHj4qkTZXTBJhX:nJmBDr4Mj4q2X
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\uTorrent_zipsoft__13454__[29527].exe"C:\Users\Admin\AppData\Local\Temp\uTorrent_zipsoft__13454__[29527].exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZipSoft\360TS_Setup_Mini_WW_AZ_CPI202204_6.6.0.1054.exe"C:\Users\Admin\AppData\Local\Temp\ZipSoft\360TS_Setup_Mini_WW_AZ_CPI202204_6.6.0.1054.exe" /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4184,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD55cdfc4b9de66db60219b702987b6884f
SHA13f664159cd6af48abc3f4c4a2d0ec16ff715b208
SHA2569a52a5e9dcfcc59699cab7a8777c114d2b9685e68b00502c0bfb28b42ef3321d
SHA5123c14da8a340736a697b4b2188b1b250b7328278a11e3483cc684247a2c10fc2b69435013e2704275dae319d992a048ff66a074065e91e9a2f65cfbd24a874d1d
-
Filesize
830B
MD5a483da8b27289fc9cc49d6b17e61cbf6
SHA12d4a5a704c2ff332df6436b7bcd16365f03c2a97
SHA256f7785d4e80691cb2bb59301fe8962e50862c44d8992a0e308f86689b7ee76911
SHA512e0d061a5ed7c7789d11331b192c0693e9a49398de371153d1d13a8b7a32ae7078ea103b03a535ebd0581f1d9d56bacf77b9e31f68ab1888663111e8d2afea0a9
-
Filesize
1.5MB
MD5315b1959710ad100d0c6a7de71512044
SHA1cca5a448b8f3009cf3c9f4f5b71de06ccfd7cdd6
SHA256032b6dfd8bfb5fd4c7c1a7a63df470d8ccb01b75a47f0b807e830eccdd33a52b
SHA5127d6638c6199dc9cc75136234cbeb10e8c3896d15c81b53ec02bc0200af01cbaf9563eb292ce2172f860b9f47506732ddb2165145827e2348e3f8c23b8eda191b
-
Filesize
824KB
MD5fc1796add9491ee757e74e65cedd6ae7
SHA1603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA256bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
SHA5128fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
7.7MB
-
Filesize
680KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB