Overview
overview
7Static
static
7rrrr/HWiNFO64.exe
windows11-21h2-x64
7rrrr/STRES...st.dll
windows11-21h2-x64
1rrrr/STRES...40.dll
windows11-21h2-x64
1rrrr/STRES...40.dll
windows11-21h2-x64
3rrrr/STRES...64.exe
windows11-21h2-x64
1rrrr/STRES...32.exe
windows11-21h2-x64
1rrrr/STRES...md.dll
windows11-21h2-x64
1rrrr/STRES...64.exe
windows11-21h2-x64
1rrrr/STRES...64.exe
windows11-21h2-x64
6rrrr/STRES...se.rtf
windows11-21h2-x64
1rrrr/STRES...ic.exe
windows11-21h2-x64
1rrrr/STRES...ro.exe
windows11-21h2-x64
1rrrr/STRES...CT.exe
windows11-21h2-x64
7rrrr/STRES...M5.exe
windows11-21h2-x64
3rrrr/STRES...T0.dll
windows11-21h2-x64
3rrrr/STRES...de.url
windows11-21h2-x64
1rrrr/STRES...se.url
windows11-21h2-x64
1rrrr/STRES...ms.url
windows11-21h2-x64
1rrrr/STRES...op.exe
windows11-21h2-x64
1rrrr/STRES...4P.exe
windows11-21h2-x64
1rrrr/STRES...mi.exe
windows11-21h2-x64
1rrrr/STRES...io.exe
windows11-21h2-x64
1rrrr/STRES...yu.exe
windows11-21h2-x64
1rrrr/STRES...na.exe
windows11-21h2-x64
1rrrr/STRES...ri.exe
windows11-21h2-x64
1rrrr/STRES...mi.exe
windows11-21h2-x64
1rrrr/STRES...ri.exe
windows11-21h2-x64
1rrrr/STRES...na.exe
windows11-21h2-x64
1rrrr/STRES...oa.exe
windows11-21h2-x64
1rrrr/STRES...bs.dll
windows11-21h2-x64
1rrrr/STRES...20.dll
windows11-21h2-x64
1rrrr/STRES...12.dll
windows11-21h2-x64
1Analysis
-
max time kernel
1469s -
max time network
1494s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-05-2024 00:17
Behavioral task
behavioral1
Sample
rrrr/HWiNFO64.exe
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
rrrr/STRESS TEST/KarhuTestMem/x64/ramtest.dll
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
rrrr/STRESS TEST/KarhuTestMem/x64/vcomp140.dll
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
rrrr/STRESS TEST/KarhuTestMem/x86/vcomp140.dll
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
rrrr/STRESS TEST/LinpackXtreme-1.1.5/LinpackXtreme_x64.exe
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
rrrr/STRESS TEST/LinpackXtreme-1.1.5/binaries/x32/linpack_amd32.exe
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
rrrr/STRESS TEST/LinpackXtreme-1.1.5/binaries/x64/libiomp5md.dll
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
rrrr/STRESS TEST/LinpackXtreme-1.1.5/binaries/x64/linpack_intel64.exe
Resource
win11-20240419-en
Behavioral task
behavioral9
Sample
rrrr/STRESS TEST/LinpackXtreme-1.1.5/hwmonitor/HWMonitor_x64.exe
Resource
win11-20240508-en
Behavioral task
behavioral10
Sample
rrrr/STRESS TEST/LinpackXtreme-1.1.5/license.rtf
Resource
win11-20240426-en
Behavioral task
behavioral11
Sample
rrrr/STRESS TEST/MemTestPro 7/MTPclassic.exe
Resource
win11-20240426-en
Behavioral task
behavioral12
Sample
rrrr/STRESS TEST/MemTestPro 7/MemTestPro.exe
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
rrrr/STRESS TEST/OCCT.exe
Resource
win11-20240508-en
Behavioral task
behavioral14
Sample
rrrr/STRESS TEST/TestMem5 v0.12 (Many configs repackaged)/TM5.exe
Resource
win11-20240426-en
Behavioral task
behavioral15
Sample
rrrr/STRESS TEST/TestMem5 v0.12 (Many configs repackaged)/bin/MT0.dll
Resource
win11-20240508-en
Behavioral task
behavioral16
Sample
rrrr/STRESS TEST/ThrottleStop_9.6/Basic Throttlestop and Undervolting Guide.url
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
rrrr/STRESS TEST/ThrottleStop_9.6/The ThrottleStop Guide (2023)- How to Lower Temperatures, Increase.url
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
rrrr/STRESS TEST/ThrottleStop_9.6/ThrottleStop - TPU Forums.url
Resource
win11-20240508-en
Behavioral task
behavioral19
Sample
rrrr/STRESS TEST/ThrottleStop_9.6/ThrottleStop.exe
Resource
win11-20240508-en
Behavioral task
behavioral20
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/04-P4P.exe
Resource
win11-20240426-en
Behavioral task
behavioral21
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/05-A64 ~ Kasumi.exe
Resource
win11-20240426-en
Behavioral task
behavioral22
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/08-NHM ~ Ushio.exe
Resource
win11-20240419-en
Behavioral task
behavioral23
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/11-BD1 ~ Miyu.exe
Resource
win11-20240419-en
Behavioral task
behavioral24
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/11-SNB ~ Hina.exe
Resource
win11-20240426-en
Behavioral task
behavioral25
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/13-HSW ~ Airi.exe
Resource
win11-20240426-en
Behavioral task
behavioral26
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/14-BDW ~ Kurumi.exe
Resource
win11-20240426-en
Behavioral task
behavioral27
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/17-SKX ~ Kotori.exe
Resource
win11-20240426-en
Behavioral task
behavioral28
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/17-ZN1 ~ Yukina.exe
Resource
win11-20240426-en
Behavioral task
behavioral29
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/18-CNL ~ Shinoa.exe
Resource
win11-20240508-en
Behavioral task
behavioral30
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/IccLibs.dll
Resource
win11-20240508-en
Behavioral task
behavioral31
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/cilkrts20.dll
Resource
win11-20240426-en
Behavioral task
behavioral32
Sample
rrrr/STRESS TEST/Y-CRUNCHER/Binaries/tbb12.dll
Resource
win11-20240508-en
General
-
Target
rrrr/STRESS TEST/TestMem5 v0.12 (Many configs repackaged)/TM5.exe
-
Size
32KB
-
MD5
c5cd49bcf5fc17944383d387638c955e
-
SHA1
13122d07d828637943ca7e8043f77beca4e76928
-
SHA256
b7ed4b39de012e88ec9ad7f21b0ac68a4e863fe078b5c54857a16d37d480cc21
-
SHA512
7bc066b43804dad6b346c375efae121c6047ae37cbf1238b1e54ebd045e90daa55cb0f9db239c9d1ac6bf31bb7a48558658ef70fe3c0492cea278de0f5cbbdc5
-
SSDEEP
768:0abgunPJRyK4QjjuWnXe784mX3XUVPrRG:0GxPJRyKPuWnOwhX3XUpRG
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: 33 5064 TM5.exe Token: SeIncBasePriorityPrivilege 5064 TM5.exe Token: 33 3336 TM5.exe Token: SeIncBasePriorityPrivilege 3336 TM5.exe Token: 33 492 TM5.exe Token: SeIncBasePriorityPrivilege 492 TM5.exe Token: 33 3888 TM5.exe Token: SeIncBasePriorityPrivilege 3888 TM5.exe Token: 33 2640 TM5.exe Token: SeIncBasePriorityPrivilege 2640 TM5.exe Token: 33 3764 TM5.exe Token: SeIncBasePriorityPrivilege 3764 TM5.exe Token: 33 3960 TM5.exe Token: SeIncBasePriorityPrivilege 3960 TM5.exe Token: 33 5048 TM5.exe Token: SeIncBasePriorityPrivilege 5048 TM5.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5064 wrote to memory of 2640 5064 TM5.exe 80 PID 5064 wrote to memory of 2640 5064 TM5.exe 80 PID 5064 wrote to memory of 2640 5064 TM5.exe 80 PID 5064 wrote to memory of 5048 5064 TM5.exe 81 PID 5064 wrote to memory of 5048 5064 TM5.exe 81 PID 5064 wrote to memory of 5048 5064 TM5.exe 81 PID 5064 wrote to memory of 3888 5064 TM5.exe 82 PID 5064 wrote to memory of 3888 5064 TM5.exe 82 PID 5064 wrote to memory of 3888 5064 TM5.exe 82 PID 5064 wrote to memory of 492 5064 TM5.exe 83 PID 5064 wrote to memory of 492 5064 TM5.exe 83 PID 5064 wrote to memory of 492 5064 TM5.exe 83 PID 5064 wrote to memory of 3336 5064 TM5.exe 84 PID 5064 wrote to memory of 3336 5064 TM5.exe 84 PID 5064 wrote to memory of 3336 5064 TM5.exe 84 PID 5064 wrote to memory of 3764 5064 TM5.exe 85 PID 5064 wrote to memory of 3764 5064 TM5.exe 85 PID 5064 wrote to memory of 3764 5064 TM5.exe 85 PID 5064 wrote to memory of 3960 5064 TM5.exe 86 PID 5064 wrote to memory of 3960 5064 TM5.exe 86 PID 5064 wrote to memory of 3960 5064 TM5.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\TM5.exe"C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\TM5.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\TM5.exe
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\TM5.exe
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\TM5.exe
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\TM5.exe
- Suspicious use of AdjustPrivilegeToken
PID:492
-
-
C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\TM5.exe
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
-
C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\TM5.exe
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\TM5.exe
- Suspicious use of AdjustPrivilegeToken
PID:3960
-