d453f0e745c8ea0ff5d918d0358662dec10af3b8cef3061e445ec87aca4cd8fe

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ClearTrack.exe
Size 179KB
Sample240528-aee2bsfb31
SHA256 703907ad4d1c128669a0a75236a9c993ac3bf4d59153a2306f8ed6b1f8000730
MD5 55860160a16f2ebd445b452908ee93d9
SHA1 87e18db5e59325530e5c1fd16ad0d158e48ea406
SHA512 533b428fae5557b950b15dfe9ddfdcbc9d07cd55507196b3162b4814a55fba6aaf93fd955e89b4869360a681dbe20588882afccaf38b22e9b4eff24775031bea
SSDEEP 1536:EREBs+O3jqcHxpwZhShfvrrIF/s37Ad4wmrN2mkKMkF59c1XvLt/lEOl:ESB1WVxpwirrIF/u7Adrmr9jS1jt/lN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3020	1680	ClearTrack.exe	28
PID 1680 wrote to memory of 3020	1680	ClearTrack.exe	28
PID 1680 wrote to memory of 3020	1680	ClearTrack.exe	28
PID 1680 wrote to memory of 3020	1680	ClearTrack.exe	28
PID 3020 wrote to memory of 2668	3020	cmd.exe	30
PID 3020 wrote to memory of 2668	3020	cmd.exe	30
PID 3020 wrote to memory of 2668	3020	cmd.exe	30
PID 3020 wrote to memory of 2668	3020	cmd.exe	30
PID 2668 wrote to memory of 2760	2668	cmd.exe	31
PID 2668 wrote to memory of 2760	2668	cmd.exe	31
PID 2668 wrote to memory of 2760	2668	cmd.exe	31
PID 2668 wrote to memory of 2760	2668	cmd.exe	31
PID 2668 wrote to memory of 2564	2668	cmd.exe	32
PID 2668 wrote to memory of 2564	2668	cmd.exe	32
PID 2668 wrote to memory of 2564	2668	cmd.exe	32
PID 2668 wrote to memory of 2564	2668	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\ClearTrack.exe
"C:\Users\Admin\AppData\Local\Temp\ClearTrack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FEF8.tmp\ClearTrack.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment" /s | findstr /i /r /c:"^ * InstallDir"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment" /s
      4⤵
      PID:2760
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i /r /c:"^ * InstallDir"
      4⤵
      PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ClearTrack.bat

Path C:\Users\Admin\AppData\Local\Temp\FEF8.tmp\ClearTrack.bat
Size 409B
SHA256 851d6a3da5e6e9f1e5f0570542a4f87146b3bcd679c871faa69f035dbb1bad11
MD5 4941e9060d75e523bee3247b422ddf8f
SHA1 a95080cd9e20480a9a0709c52ad9dd31cec53fcc
SHA512 5f60605e6b062a686af23c1493f6e264ccbff567136e8eb5ec1062741de05feb02522a0737424982b64b2165dc651515c84f6c4bf8c6aac3a3e315b236227c32
MD5 SHA1 SHA512

Submit Download