d453f0e745c8ea0ff5d918d0358662dec10af3b8cef3061e445ec87aca4cd8fe

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ClearTrack.exe
Size 179KB
Sample240528-aee2bsfb31
SHA256 703907ad4d1c128669a0a75236a9c993ac3bf4d59153a2306f8ed6b1f8000730
MD5 55860160a16f2ebd445b452908ee93d9
SHA1 87e18db5e59325530e5c1fd16ad0d158e48ea406
SHA512 533b428fae5557b950b15dfe9ddfdcbc9d07cd55507196b3162b4814a55fba6aaf93fd955e89b4869360a681dbe20588882afccaf38b22e9b4eff24775031bea
SSDEEP 1536:EREBs+O3jqcHxpwZhShfvrrIF/s37Ad4wmrN2mkKMkF59c1XvLt/lEOl:ESB1WVxpwirrIF/u7Adrmr9jS1jt/lN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	ClearTrack.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1140	1144	ClearTrack.exe	83
PID 1144 wrote to memory of 1140	1144	ClearTrack.exe	83
PID 1144 wrote to memory of 1140	1144	ClearTrack.exe	83
PID 1140 wrote to memory of 4512	1140	cmd.exe	87
PID 1140 wrote to memory of 4512	1140	cmd.exe	87
PID 1140 wrote to memory of 4512	1140	cmd.exe	87
PID 4512 wrote to memory of 1028	4512	cmd.exe	88
PID 4512 wrote to memory of 1028	4512	cmd.exe	88
PID 4512 wrote to memory of 1028	4512	cmd.exe	88
PID 4512 wrote to memory of 2920	4512	cmd.exe	89
PID 4512 wrote to memory of 2920	4512	cmd.exe	89
PID 4512 wrote to memory of 2920	4512	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\ClearTrack.exe
"C:\Users\Admin\AppData\Local\Temp\ClearTrack.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4844.tmp\ClearTrack.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment" /s | findstr /i /r /c:"^ * InstallDir"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment" /s
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i /r /c:"^ * InstallDir"
      4⤵
      PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ClearTrack.bat

Path C:\Users\Admin\AppData\Local\Temp\4844.tmp\ClearTrack.bat
Size 409B
SHA256 851d6a3da5e6e9f1e5f0570542a4f87146b3bcd679c871faa69f035dbb1bad11
MD5 4941e9060d75e523bee3247b422ddf8f
SHA1 a95080cd9e20480a9a0709c52ad9dd31cec53fcc
SHA512 5f60605e6b062a686af23c1493f6e264ccbff567136e8eb5ec1062741de05feb02522a0737424982b64b2165dc651515c84f6c4bf8c6aac3a3e315b236227c32
MD5 SHA1 SHA512

Submit Download