Resubmissions
16-05-2024 16:02
240516-thaqkacf53 816-05-2024 15:21
240516-srd9nsaf9x 816-05-2024 15:16
240516-snm3eaag66 8Analysis
-
max time kernel
65s -
max time network
61s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
16-05-2024 16:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.angusj.com/resourcehacker/reshacker_setup.exe
Resource
win10-20240404-en
windows10-1703-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://www.angusj.com/resourcehacker/reshacker_setup.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
https://www.angusj.com/resourcehacker/reshacker_setup.exe
Resource
win11-20240508-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
https://www.angusj.com/resourcehacker/reshacker_setup.exe
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 4364 reshacker_setup.exe 2320 reshacker_setup.tmp 4732 ResourceHacker.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 25 IoCs
description ioc Process File created C:\Program Files (x86)\Resource Hacker\is-D0MLS.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-PM4LC.tmp reshacker_setup.tmp File opened for modification C:\Program Files (x86)\Resource Hacker\ResourceHacker.exe reshacker_setup.tmp File opened for modification C:\Program Files (x86)\Resource Hacker\sample2.dll reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-U6N9S.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-KDHRU.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-8B8OF.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\unins000.dat reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-OKBHH.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-BJD6C.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-RBVHQ.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-UFA4L.tmp reshacker_setup.tmp File opened for modification C:\Program Files (x86)\Resource Hacker\unins000.dat reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-HDN77.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\ResourceHacker.ini ResourceHacker.exe File created C:\Program Files (x86)\Resource Hacker\is-04LRA.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-9QES9.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-OESPU.tmp reshacker_setup.tmp File opened for modification C:\Program Files (x86)\Resource Hacker\ResourceHacker.ini ResourceHacker.exe File created C:\Program Files (x86)\Resource Hacker\is-C1TMR.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-KCC3R.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-6HSER.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-P4VP1.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-S8KSP.tmp reshacker_setup.tmp File created C:\Program Files (x86)\Resource Hacker\is-NIO8C.tmp reshacker_setup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000 ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2" ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 6800310000000000b058718010005245534f55527e310000500009000400efbeb0587180b05871802e00000046ac01000000090000000000000000000000000000008068e7005200650073006f00750072006300650020004800610063006b0065007200000018000000 ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg ResourceHacker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings reshacker_setup.tmp Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 ResourceHacker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 9800310000000000b0587180110050524f4752417e320000800009000400efbe724a6fa8b05871802e00000038040000000001000000000000000000560000000000308d1001500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000 ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" ResourceHacker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 ResourceHacker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" ResourceHacker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 ResourceHacker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" ResourceHacker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell ResourceHacker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" ResourceHacker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" ResourceHacker.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} ResourceHacker.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\reshacker_setup.exe:Zone.Identifier firefox.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4732 ResourceHacker.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2320 reshacker_setup.tmp 2320 reshacker_setup.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4732 ResourceHacker.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 1204 firefox.exe Token: SeDebugPrivilege 1204 firefox.exe Token: SeDebugPrivilege 2320 reshacker_setup.tmp Token: SeDebugPrivilege 2320 reshacker_setup.tmp Token: SeDebugPrivilege 2320 reshacker_setup.tmp Token: SeDebugPrivilege 2320 reshacker_setup.tmp Token: SeDebugPrivilege 2320 reshacker_setup.tmp Token: SeDebugPrivilege 2320 reshacker_setup.tmp Token: SeDebugPrivilege 2320 reshacker_setup.tmp Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe Token: SeDebugPrivilege 4732 ResourceHacker.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1204 firefox.exe 1204 firefox.exe 1204 firefox.exe 1204 firefox.exe 2320 reshacker_setup.tmp -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1204 firefox.exe 1204 firefox.exe 1204 firefox.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1204 firefox.exe 1204 firefox.exe 1204 firefox.exe 1204 firefox.exe 4732 ResourceHacker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 4092 wrote to memory of 1204 4092 firefox.exe 73 PID 1204 wrote to memory of 2528 1204 firefox.exe 74 PID 1204 wrote to memory of 2528 1204 firefox.exe 74 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 1856 1204 firefox.exe 75 PID 1204 wrote to memory of 2260 1204 firefox.exe 76 PID 1204 wrote to memory of 2260 1204 firefox.exe 76 PID 1204 wrote to memory of 2260 1204 firefox.exe 76 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.angusj.com/resourcehacker/reshacker_setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.angusj.com/resourcehacker/reshacker_setup.exe2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1204.0.124108362\883891478" -parentBuildID 20221007134813 -prefsHandle 1628 -prefMapHandle 1620 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c399b1dd-3913-488e-87e8-744c224f606d} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" 1728 207b64f6258 gpu3⤵PID:2528
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1204.1.1975926767\1715226321" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82986fc2-a519-4192-827b-7b80a01ce704} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" 2136 207b63f9558 socket3⤵PID:1856
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1204.2.1285495624\1457981767" -childID 1 -isForBrowser -prefsHandle 2840 -prefMapHandle 2836 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7c7fb65-6e67-432f-8bab-52ec36fd20b7} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" 2740 207b6462e58 tab3⤵PID:2260
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1204.3.1112513636\584831740" -childID 2 -isForBrowser -prefsHandle 3612 -prefMapHandle 3608 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc07e577-1326-4178-a920-cd46b034ef9e} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" 3624 207bb69ce58 tab3⤵PID:3340
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1204.4.1258248326\1171969395" -childID 3 -isForBrowser -prefsHandle 4716 -prefMapHandle 4712 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92eb652f-55f7-44b3-83a4-bbed99692ad4} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" 4688 207bc175358 tab3⤵PID:4448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1204.5.1454527405\1981571848" -childID 4 -isForBrowser -prefsHandle 4848 -prefMapHandle 4852 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ea43f2a-3f21-4ef9-93f8-95b5a2fb20f9} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" 4840 207bd4a0258 tab3⤵PID:4040
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1204.6.1974220901\260448698" -childID 5 -isForBrowser -prefsHandle 5040 -prefMapHandle 5044 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bda8cbfe-7294-43a2-ad61-b8cb0b95093a} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" 5032 207bd4a0858 tab3⤵PID:4952
-
-
C:\Users\Admin\Downloads\reshacker_setup.exe"C:\Users\Admin\Downloads\reshacker_setup.exe"3⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\is-R0O4I.tmp\reshacker_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-R0O4I.tmp\reshacker_setup.tmp" /SL5="$B005C,3504386,870400,C:\Users\Admin\Downloads\reshacker_setup.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2320 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Resource Hacker\ReadMe.txt5⤵PID:4480
-
-
C:\Program Files (x86)\Resource Hacker\ResourceHacker.exe"C:\Program Files (x86)\Resource Hacker\ResourceHacker.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4732
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5538f09449b7ffc050fb12c809431032c
SHA199c017570afe0674a4968c687f3a037c6ae6d366
SHA256f0e3b4d80329ceccc0a86b1a8c4c36410245ddb1de3d4ef80cd7db8cf4e59ec8
SHA5124c5bab1c7245f0517f1e0d805ea9e67f765a4de077020d75be319f6fbd17841eb798d654909ccff7bc8c82563ff154f1d619797abf660ce3de0ca5ee73c3fbd0
-
Filesize
5.9MB
MD5263b8a401528b440657bbdffc64c6487
SHA14e6eb74dc21503925645b3a8e4e8cfc63c6fb237
SHA2561227e484f32c34f026f311e60f1abae065e00f203153dbf0623152dedf5cafbd
SHA512c267ce96d420a2cd3d89023b7745b207851a9c2ad18f474cc8f4eedd40505b4fd7db347b04f5517eca3caee8974971ce478966a395ed412a9f7b4a7383710053
-
Filesize
421B
MD5085ea4adb406bfb99b1c0fd5426e56d2
SHA136a5f9efab071aad194006eedb20ae2f39d420b6
SHA2564f1035c038026759f92addb25efddd5053dda8b3fc80fdec96dbc97b19487506
SHA512d74578913b2a655d44827e061cd2592cf5ee22314a171de88549d15cdc2d42bf83277ce4b26b2f7198494020f7200bfff74e4f07598a9adae7589d2f147ed533
-
Filesize
2.6MB
MD555abbaa40e0eaeacaabad31eaf9692a0
SHA12684b820255d0c57c0fb8243dc38693fd31d862f
SHA256120cfafb05cac4650cb299f05a38422580f0ed6b15bd495d46cf40216c8200f2
SHA5129510d1c16c07764d21cac248a784064ec719463927befd9fb33506f6a46617a0e44436ee5d6177a45a69499806f9e4113fcee0ee7f3c09a73bad474e82c7975b
-
Filesize
2.5MB
MD5c5cac19a48b63987b767c8ce36a09282
SHA1899834cb9faa1a04029403085a761c5a2aae0045
SHA2569aec7890b56a86f175957b7a99fe57ce6234d16995e019d3008a5d599fdf8e28
SHA512a796cdec441c82353fc160d92af14ade268172b7d232c8f1bcdd5c807b7dce3c4c4cb877b467446b54f058b0bc4219f82ee99df2851d83d121ced2b3674ab1a5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5cf6a3e7dea093888fe40de419a84d561
SHA124f352c447c5c385aa26824bdbf1e099311f7e5c
SHA256319c5b0e9aebfd69ec9e9f8c4763fbee1a8c5b2688e200b91b307a0d246e2ffe
SHA5124e10740b7219928092d36f6f5ba1f3bc2b7b20fef3a0ffae73a38d51398c8c05130037ebdb918d36db839f71bed522e9747b3076c7a43156d0cefa5c60d166ff
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\477949b4-cceb-4486-95bb-be478cdf0b6f
Filesize746B
MD58b234c947b7ee7eadccbbb2bdc132cc6
SHA1b8fe6585b0932d21ae53be2a069659859f439ba7
SHA256883601364825cfa32239494ebe918aff6cc55172bd9e4393b1349861bbe9fe52
SHA5128bb240c4cca94a4faf8d6f4adcca088535b2c28e90a07245d96d20b986ec7ae75018c297433fe9001ce0f256056b3b4459cf9fe3e122dc5b852bcb1d9b673fac
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\8d0c63d9-acfa-474d-bd7e-c7a97131191a
Filesize10KB
MD53d7ec26816f1a7dc72097b246ad783cc
SHA11026499b46be0343cd6d7d26ac8a6d947c1ee051
SHA25622c3546bf9257a7cc42b0321963d691724013ef273933f8779472d9ec0e5c389
SHA51244936e38badfd71d6fa358267e34613113c7889a5caab6a628edc3cbdb674a3d1bdf49985ef2ca1c943088f376d876cea7bbc26fd6efa0c512085e06ea893c0e
-
Filesize
6KB
MD5811cba473fe92c82b02c00eee4f1ac1c
SHA1e04d27aa67f9affed061e47e25759919a2a0ece8
SHA2567bd17b71888d6298ac44c1ac6852736d80d391f1539bfcfd6ec8da0844b711ab
SHA512ef446961577313c30092d7f16994143f1824af2e3d8221f5a80356e260ba622325cb63c20b13bfba75d7b6ef887ad2cb3e125c209b4b88b43003992cd0dd2ac8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4
Filesize996B
MD5f214b509991579173d62b68ee1baa6de
SHA1971440efdb1a24c41aed3a1b5ca6158f19f6b4e0
SHA256d8c94f7d3d2ef6da4b326d016f29f59f068d6d295ee49e5e8c482fe8305eebcd
SHA512187b72b98d8afdb4f710aa300adf38ae88aeddd2193a7019ad6035780806b1e8be887d5257b26162007a2b64541b9d1c77e5307b391723facd4eede534d619c1
-
Filesize
7KB
MD5da4217e7e1212dbd974c37103b0f082d
SHA13434e728a9ac81003dc2ecdf1e613f6ee696cfef
SHA256ace32d47a3d2d0c3576bcbd8f7c54abdf30895f40962bed98ffea904afe75a43
SHA512b55a165a0df7f592e8b1cc0f1c64945f1896fbe901ba744af70cc58a5090bc90bbf28418efbadcc6d24af6a9704218aa3ab7d3b1eed0eb860b8810718b825006
-
Filesize
4.1MB
MD502eb693dcfb90a696d191badbcf314ce
SHA1b1d0352c35d7da251e2fa19ecbe8c1e5286f898f
SHA256246457363396dcea4cc3d19ce2a431897bac948ae1694d3e87cc0ebaf2ea39f5
SHA51217b6a5f2446459c058bd035df784adad0e58aa7438a56e02fd75c593eb6bae82719b6293de6b1504e1089cade44b5e137771991816d616c08f92eb2c249cc159