Overview
overview
10Static
static
10MENU.bat
windows7-x64
7MENU.bat
windows10-2004-x64
7Work/RegToScript.exe
windows7-x64
1Work/RegToScript.exe
windows10-2004-x64
1Work/RestExplorer.exe
windows7-x64
8Work/RestExplorer.exe
windows10-2004-x64
8Work/SoundChanger.exe
windows7-x64
7Work/SoundChanger.exe
windows10-2004-x64
7Work/TrInstaller.exe
windows7-x64
1Work/TrInstaller.exe
windows10-2004-x64
1Work/cecho.exe
windows7-x64
7Work/cecho.exe
windows10-2004-x64
7Work/explorer.exe.dll
windows10-2004-x64
1Work/nircmd.exe
windows7-x64
1Work/nircmd.exe
windows10-2004-x64
1Analysis
- max time kernel
129s - max time network
121s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
29/05/2024, 16:33
Behavioral task
behavioral1
Sample
MENU.bat
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
MENU.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Work/RegToScript.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
Work/RegToScript.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Work/RestExplorer.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
Work/RestExplorer.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Work/SoundChanger.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral8
Sample
Work/SoundChanger.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Work/TrInstaller.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral10
Sample
Work/TrInstaller.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Work/cecho.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
Work/cecho.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Work/explorer.exe.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Work/nircmd.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral15
Sample
Work/nircmd.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target Work/RestExplorer.exe
- Size 806KB
- Sample240529-t2nfrscc77
- SHA256 ec890a669da3c53b73ca83ec0c267fa0dcf1ad428feb829a3422ebc36bc1841f
- MD5 ac75bde2b70097ca86e16987bf387857
- SHA1 06e72123132e1ef58f7b7ea3c8e65cb75062e6d6
- SHA512 f4994e8e5a807caa254e73e9796d61bcea204f0aa80cc391bccddbf28478f738c1d4f095518196a9b152654596beb184b36507ffcf434407d78ad1c3e43b96a0
- SSDEEP 12288:v69zDWz/xwNqdsbrIX3JALF1QbCagrEGgtNryyCJuDT/PNa04YQtHyw4AR6SPWc:v2DW/xbmX2YIb+Qsu3/PNLDQtHyZiP3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe 2776 RestExplorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2956 explorer.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe Token: SeShutdownPrivilege 2956 explorer.exe - Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe - Suspicious use of SendNotifyMessage 23 IoCs
pid Process 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe 2956 explorer.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2956 2776 RestExplorer.exe 28 PID 2776 wrote to memory of 2956 2776 RestExplorer.exe 28 PID 2776 wrote to memory of 2956 2776 RestExplorer.exe 28 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Work\RestExplorer.exe"C:\Users\Admin\AppData\Local\Temp\Work\RestExplorer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2d7j7t6w.tmp
- Size 2KB
- SHA256 6950445d7d967f1429b2ab03cbdcf2c245155972733e323a0ffe94dd04e6d304
- MD5 d9acba73dffd843661462beb9426b321
- SHA1 04be5d82c4a76987ad20be81cb1d9bd594157fa7
- SHA512 0066274c467a8f408291e09d8389cae79a5e7c4711d99d8cff4649f0b9b8770dc8fd57f5479c7bff985b7637eab41ce81b39142c8bea414923a0d7baaa0252dc
- MD5 SHA1 SHA512