Resubmissions

31/05/2024, 15:51

240531-tarn4sdg75 6

Analysis

  • max time kernel
    30s
  • max time network
    28s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 15:51

General

  • Target

    Clustertruck.exe

  • Size

    16.0MB

  • MD5

    5bf37319f5d7cd5793ab0e4f79b32238

  • SHA1

    b94986cc9a1131cefa9f7c910d66fcde8de79464

  • SHA256

    8975bb39ab3a37f2134b2c3795391927abc3bb77d3531957edf6449e1ac2ca06

  • SHA512

    86c508df849cafe716b9cd703f3bb42bcf27806107c245eb9b34186ef27d7391706ea9de8a864721f3259158ca7c658d079e6ea0f9b54f0671a4e5b054b34900

  • SSDEEP

    393216:AkfjFwjHOrqsbE93h4Heq9g9mPqYczp1V3zVu/9a9/qNByUTh0pkKSEmKdZ5Qe:lBaMTh6kMmKds

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Clustertruck.exe
    "C:\Users\Admin\AppData\Local\Temp\Clustertruck.exe"
    1⤵
      PID:4808
    • C:\Windows\System32\GameBarPresenceWriter.exe
      "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
      1⤵
        PID:3132
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1468
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
        1⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Modifies registry class
        PID:4324
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
        1⤵
        • Checks processor information in registry
        • Modifies registry class
        PID:3364

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\Videos\Captures\desktop.ini

              Filesize

              190B

              MD5

              b0d27eaec71f1cd73b015f5ceeb15f9d

              SHA1

              62264f8b5c2f5034a1e4143df6e8c787165fbc2f

              SHA256

              86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

              SHA512

              7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c