Analysis
-
max time kernel
17s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 10:45
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe
Resource
win10v2004-20240508-en
General
-
Target
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe
-
Size
782KB
-
MD5
f0a5b6bb52a088b9b8ee76b341e58e2b
-
SHA1
d362d5dee873c8c62489b95f4beb9fb7c5887ba4
-
SHA256
5131d0642a54d02c54545e823e706b89be27243608a047c07349fbc30e07dde5
-
SHA512
d06932744b4a7c156deaf76fe6cf64aea3ee4f5a4e7465674f710d5791296d0f66fa922267e137d7bc135e2d42c7efe97cffdda9ae922f678b260ded8c256a60
-
SSDEEP
12288:o9y0Qed1VRfr655Kw6kRaDsaXz2QEPCJj7bo7C1OC40r24bvryRrQ4ZUCR:o9Ce3/s5b5sV06j7bYAl42n/yRMNC
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\permdata\\java.exe" svchost.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exejava.exepid process 4552 svchost.exe 4604 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Essentials = "C:\\Users\\Admin\\AppData\\Roaming\\MsMpEng.exe" VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\permdata\\java.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exedescription pid process target process PID 4984 set thread context of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exesvchost.exedescription pid process Token: SeDebugPrivilege 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe Token: SeIncreaseQuotaPrivilege 4552 svchost.exe Token: SeSecurityPrivilege 4552 svchost.exe Token: SeTakeOwnershipPrivilege 4552 svchost.exe Token: SeLoadDriverPrivilege 4552 svchost.exe Token: SeSystemProfilePrivilege 4552 svchost.exe Token: SeSystemtimePrivilege 4552 svchost.exe Token: SeProfSingleProcessPrivilege 4552 svchost.exe Token: SeIncBasePriorityPrivilege 4552 svchost.exe Token: SeCreatePagefilePrivilege 4552 svchost.exe Token: SeBackupPrivilege 4552 svchost.exe Token: SeRestorePrivilege 4552 svchost.exe Token: SeShutdownPrivilege 4552 svchost.exe Token: SeDebugPrivilege 4552 svchost.exe Token: SeSystemEnvironmentPrivilege 4552 svchost.exe Token: SeChangeNotifyPrivilege 4552 svchost.exe Token: SeRemoteShutdownPrivilege 4552 svchost.exe Token: SeUndockPrivilege 4552 svchost.exe Token: SeManageVolumePrivilege 4552 svchost.exe Token: SeImpersonatePrivilege 4552 svchost.exe Token: SeCreateGlobalPrivilege 4552 svchost.exe Token: 33 4552 svchost.exe Token: 34 4552 svchost.exe Token: 35 4552 svchost.exe Token: 36 4552 svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exesvchost.execmd.exedescription pid process target process PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4984 wrote to memory of 4552 4984 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 4552 wrote to memory of 4620 4552 svchost.exe cmd.exe PID 4552 wrote to memory of 4620 4552 svchost.exe cmd.exe PID 4552 wrote to memory of 4620 4552 svchost.exe cmd.exe PID 4552 wrote to memory of 4604 4552 svchost.exe java.exe PID 4552 wrote to memory of 4604 4552 svchost.exe java.exe PID 4552 wrote to memory of 4604 4552 svchost.exe java.exe PID 4620 wrote to memory of 3600 4620 cmd.exe attrib.exe PID 4620 wrote to memory of 3600 4620 cmd.exe attrib.exe PID 4620 wrote to memory of 3600 4620 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\permdata\java.exe"C:\permdata\java.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
C:\Users\Admin\AppData\Local\Temp\tmpcmd.batFilesize
50B
MD5b774ae3fb1da087e1f83b4f7b2060e5a
SHA197eb9be49ac3af9c851c9e1e84e32bfd53e325a8
SHA256adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b
SHA512f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701
-
memory/4552-6-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/4552-9-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/4552-13-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/4552-11-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/4552-18-0x00000000025D0000-0x00000000025D1000-memory.dmpFilesize
4KB
-
memory/4552-29-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/4984-0-0x0000000074A62000-0x0000000074A63000-memory.dmpFilesize
4KB
-
memory/4984-1-0x0000000074A60000-0x0000000075011000-memory.dmpFilesize
5.7MB
-
memory/4984-3-0x0000000074A60000-0x0000000075011000-memory.dmpFilesize
5.7MB
-
memory/4984-31-0x0000000074A60000-0x0000000075011000-memory.dmpFilesize
5.7MB