Malware Analysis Report

2024-09-11 05:56

Sample ID 240526-pe75facc44
Target MicrosoftToolkit.exe
SHA256 92c691d8e8157dc95310628e644d4e98a734ab5aa1f7e22644d256eb463c7d1c
Tags
discovery exploit spyware stealer upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

92c691d8e8157dc95310628e644d4e98a734ab5aa1f7e22644d256eb463c7d1c

Threat Level: Likely malicious

The file MicrosoftToolkit.exe was found to be: Likely malicious.

Malicious Activity Summary

discovery exploit spyware stealer upx

Possible privilege escalation attempt

Executes dropped EXE

UPX packed file

Checks BIOS information in registry

Checks computer location settings

Reads user/profile data of web browsers

Modifies file permissions

Loads dropped DLL

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Creates scheduled task(s)

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
File and Directory Permissions Modification
T1222
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-26 12:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 12:15

Reported

2024-05-26 12:19

Platform

win7-20231129-en

Max time kernel

77s

Max time network

39s

Command Line

"C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe"

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\bootsect.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\Logs\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2188 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2188 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2188 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2188 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2188 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2188 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2188 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2188 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 1112 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 1112 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 1112 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 1112 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2188 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 1348 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1348 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1348 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1348 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1468 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2808 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2808 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2808 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1468 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 500 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 500 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 500 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 500 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1468 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1764 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1764 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1764 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1764 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2544 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2544 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2544 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1468 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1684 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1684 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1684 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1684 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1468 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe

"C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe"

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c expand.exe "C:\Users\Admin\AppData\Roaming\ServiceData\c1Gt4H.tmp" -F:* "C:\Users\Admin\AppData\Roaming\ServiceData"

C:\Windows\SysWOW64\expand.exe

expand.exe "C:\Users\Admin\AppData\Roaming\ServiceData\c1Gt4H.tmp" -F:* "C:\Users\Admin\AppData\Roaming\ServiceData"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "cmd.exe /c takeown /f C:\ldrscan\bootwin"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c takeown /f C:\ldrscan\bootwin

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\ldrscan\bootwin

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)"

C:\Windows\SysWOW64\icacls.exe

icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "cmd.exe /c takeown /f C:\ldrscan\bootwin"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c takeown /f C:\ldrscan\bootwin

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\ldrscan\bootwin

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)"

C:\Windows\SysWOW64\icacls.exe

icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)

C:\Windows\system32\cmd.exe

cmd.exe /A /C "C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ilc "C:\Acer.XRM-MS""

C:\Windows\System32\cscript.exe

C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ilc "C:\Acer.XRM-MS"

C:\Windows\system32\cmd.exe

cmd.exe /A /C "C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ipk FJGCP-4DFJD-GJY49-VJBQ7-HYRR2"

C:\Windows\System32\cscript.exe

C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ipk FJGCP-4DFJD-GJY49-VJBQ7-HYRR2

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "compact /u \\?\Volume{e17cb743-8f1b-11ee-b600-806e6f6e6963}\OGDRP"

C:\Windows\SysWOW64\compact.exe

compact /u \\?\Volume{e17cb743-8f1b-11ee-b600-806e6f6e6963}\OGDRP

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "C:\bootsect.exe /nt60 SYS /force"

C:\bootsect.exe

C:\bootsect.exe /nt60 SYS /force

C:\Windows\system32\taskeng.exe

taskeng.exe {5ABE7784-96D8-4657-B43F-CB9625211B9C} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe

C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe "C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"

Network

Country Destination Domain Proto
US 8.8.8.8:53 wmfor4vs.top udp
RU 130.193.42.199:80 wmfor4vs.top tcp
RU 130.193.42.199:80 wmfor4vs.top tcp
RU 130.193.42.199:80 wmfor4vs.top tcp

Files

memory/2188-2-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2188-4-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2188-0-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2188-5-0x0000000000030000-0x0000000000031000-memory.dmp

memory/2188-7-0x0000000000030000-0x0000000000031000-memory.dmp

memory/2188-9-0x0000000000030000-0x0000000000031000-memory.dmp

memory/2188-12-0x0000000000040000-0x0000000001040000-memory.dmp

\Users\Admin\AppData\Local\Temp\Setup.exe

MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e

memory/2188-17-0x00000000176F0000-0x0000000017913000-memory.dmp

memory/1468-29-0x00000000006C0000-0x00000000006D0000-memory.dmp

memory/1468-34-0x00000000008E0000-0x00000000008F2000-memory.dmp

memory/1468-21-0x00000000006A0000-0x00000000006B3000-memory.dmp

memory/1468-66-0x0000000000920000-0x0000000000930000-memory.dmp

memory/1468-58-0x00000000006D0000-0x00000000006E0000-memory.dmp

memory/1468-50-0x0000000000900000-0x0000000000911000-memory.dmp

memory/1468-42-0x0000000010000000-0x0000000010021000-memory.dmp

\??\c:\users\admin\appdata\roaming\servicedata\c1gt4h.tmp

MD5 9533ba8d9930f60f0b6257bdb79b2384
SHA1 b0b9dc920e83343784e818dcf4d9607de51118bb
SHA256 6a30579a54855ff5899cd73278d61e6b3d69abadc7ffedc6c0e0c3aa03594131
SHA512 e86c782b98b28e8eefc03cb703eb2c640d6b748285b76c93f8a892e2427a20de00c7dd4c141e1c38e69b2f78b54f6705e2ae40071aaba0392193fc1a7071259d

C:\Acer.XRM-MS

MD5 f25832af6a684360950dbb15589de34a
SHA1 17ff1d21005c1695ae3dcbdc3435017c895fff5d
SHA256 266d64637cf12ff961165a018f549ff41002dc59380605b36d65cf1b8127c96f
SHA512 e0cf23351c02f4afa85eedc72a86b9114f539595cbd6bcd220e8b8d70fa6a7379dcd947ea0d59332ba672f36ebda6bd98892d9b6b20eedafc8be168387a3dd5f

memory/1468-97-0x0000000000400000-0x0000000000623000-memory.dmp

\??\Volume{e17cb743-8f1b-11ee-b600-806e6f6e6963}\OGDRP

MD5 0d3043bda61e25f88f14c7864daff530
SHA1 baa4ee221de901824e3e1de0b182545e750789f0
SHA256 5338a54076874848496707b2aba1db0a77c16ac6c29550199c5bac31452e5759
SHA512 72097c661524c1df32545197dfb8263ab4846f53c6673710095412410cb465a0dadd754cee602b551a9c213ac167e015c538ba348481f5b8036f682bcfd58d92

C:\bootsect.exe

MD5 1de8f5ff88f1503d1a198b7cd8899afd
SHA1 c0d6e9f2e87d84bd0be3d0e0b2fbaec92a2b0baf
SHA256 5b64c8a4062d075dac6049ac98eeadaf1850f70ed228695ba25cac9f075b593a
SHA512 f0027698431a2ffd31904e363f7025ded83316e511f261f4b342d65420c8b2d176ae7056b9940660a55571f28ff22fd744f26ed32ad77b0553de7610848c4ccd

memory/1468-110-0x0000000000400000-0x0000000000623000-memory.dmp

C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe

MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg

MD5 b36280ab2514b1772d2058fe14633850
SHA1 57b4b40365eb4e26aa9f9125acc9965210776195
SHA256 a3b628be13ef3a1f09ab8e4af4f59203e7e721283bd9414f2a35c03abd0ecf46
SHA512 7c13c658c2be4430aa7e6fa4a6b6116a91e5cf5c9ce425eb698236193b96d12656d264ce3f19940a17b8a59f7b7e5dfb1ea0c0c9dc381a788c3acf4f8fdfddfa

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 12:15

Reported

2024-05-26 12:19

Platform

win10v2004-20240508-en

Max time kernel

67s

Max time network

78s

Command Line

"C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe"

Signatures

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\LOGS\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 900 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 900 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 900 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 900 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 900 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 900 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2480 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2480 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 900 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 900 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 900 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe C:\Windows\SysWOW64\cmd.exe
PID 1324 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1324 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1324 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe

"C:\Users\Admin\AppData\Local\Temp\MicrosoftToolkit.exe"

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c expand.exe "C:\Users\Admin\AppData\Roaming\ServiceData\c1Gt4H.tmp" -F:* "C:\Users\Admin\AppData\Roaming\ServiceData"

C:\Windows\SysWOW64\expand.exe

expand.exe "C:\Users\Admin\AppData\Roaming\ServiceData\c1Gt4H.tmp" -F:* "C:\Users\Admin\AppData\Roaming\ServiceData"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 wmfor4vs.top udp
RU 130.193.42.199:80 wmfor4vs.top tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 199.42.193.130.in-addr.arpa udp
RU 130.193.42.199:80 wmfor4vs.top tcp
RU 130.193.42.199:80 wmfor4vs.top tcp
US 8.8.8.8:53 udp

Files

memory/900-0-0x0000000014980000-0x0000000014981000-memory.dmp

memory/900-1-0x0000000014990000-0x0000000014991000-memory.dmp

memory/900-2-0x00000000003F0000-0x00000000013F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Setup.exe

MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e

memory/4044-16-0x0000000000400000-0x0000000000623000-memory.dmp

memory/4044-17-0x00000000024A0000-0x00000000024B3000-memory.dmp

memory/4044-30-0x00000000024C0000-0x00000000024D2000-memory.dmp

memory/4044-54-0x0000000002380000-0x0000000002390000-memory.dmp

memory/4044-70-0x0000000002E80000-0x0000000002EA0000-memory.dmp

memory/4044-62-0x0000000002500000-0x0000000002510000-memory.dmp

memory/4044-46-0x00000000024E0000-0x00000000024F1000-memory.dmp

memory/4044-38-0x0000000010000000-0x0000000010021000-memory.dmp

memory/4044-25-0x0000000002330000-0x0000000002340000-memory.dmp

\??\c:\users\admin\appdata\roaming\servicedata\c1gt4h.tmp

MD5 9533ba8d9930f60f0b6257bdb79b2384
SHA1 b0b9dc920e83343784e818dcf4d9607de51118bb
SHA256 6a30579a54855ff5899cd73278d61e6b3d69abadc7ffedc6c0e0c3aa03594131
SHA512 e86c782b98b28e8eefc03cb703eb2c640d6b748285b76c93f8a892e2427a20de00c7dd4c141e1c38e69b2f78b54f6705e2ae40071aaba0392193fc1a7071259d

memory/4044-90-0x0000000000400000-0x0000000000623000-memory.dmp