Resubmissions
31/05/2024, 15:51
240531-tarn4sdg75 6Analysis
-
max time kernel
30s -
max time network
28s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
Clustertruck.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Clustertruck.exe
Resource
win10v2004-20240426-en
General
-
Target
Clustertruck.exe
-
Size
16.0MB
-
MD5
5bf37319f5d7cd5793ab0e4f79b32238
-
SHA1
b94986cc9a1131cefa9f7c910d66fcde8de79464
-
SHA256
8975bb39ab3a37f2134b2c3795391927abc3bb77d3531957edf6449e1ac2ca06
-
SHA512
86c508df849cafe716b9cd703f3bb42bcf27806107c245eb9b34186ef27d7391706ea9de8a864721f3259158ca7c658d079e6ea0f9b54f0671a4e5b054b34900
-
SSDEEP
393216:AkfjFwjHOrqsbE93h4Heq9g9mPqYczp1V3zVu/9a9/qNByUTh0pkKSEmKdZ5Qe:lBaMTh6kMmKds
Malware Config
Signatures
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-711569230-3659488422-571408806-1000\{FA2971F4-A929-4533-805A-5934C1B08B26} svchost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-711569230-3659488422-571408806-1000\{DCC50F02-160D-40E0-9D8C-116780228458} svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1468 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Clustertruck.exe"C:\Users\Admin\AppData\Local\Temp\Clustertruck.exe"1⤵PID:4808
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:3132
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4324
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
PID:3364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c