Malware Analysis Report

2024-10-10 07:25

Sample ID 240610-zlbd6azbma
Target memreduct-3.4-setup.exe
SHA256 a7ba8b9da0a1fdf7a886fe86b2ca55b4afe05d69b2c9c4d33b27d65986d6a033
Tags
discovery evasion execution persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

a7ba8b9da0a1fdf7a886fe86b2ca55b4afe05d69b2c9c4d33b27d65986d6a033

Threat Level: Shows suspicious behavior

The file memreduct-3.4-setup.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion execution persistence

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Launch Agent

Drops file in Program Files directory

Drops file in Windows directory

Resource Forking

Enumerates physical storage devices

Launchctl

Unsigned PE

Modifies data under HKEY_USERS

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-10 20:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 20:47

Reported

2024-06-10 20:49

Platform

win7-20240419-en

Max time kernel

75s

Max time network

80s

Command Line

"C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe"

Signatures

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe

"C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nso16BE.tmp\System.dll

MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

\Users\Admin\AppData\Local\Temp\nso16BE.tmp\nsDialogs.dll

MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

memory/2564-16-0x0000000002E90000-0x0000000002E91000-memory.dmp

memory/1640-17-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 20:47

Reported

2024-06-10 20:50

Platform

win10v2004-20240226-en

Max time kernel

126s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Mem Reduct\License.txt C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe N/A
File created C:\Program Files\Mem Reduct\Readme.txt C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe N/A
File created C:\Program Files\Mem Reduct\uninstall.exe C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe N/A
File created C:\Program Files\Mem Reduct\memreduct.lng C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe N/A
File created C:\Program Files\Mem Reduct\memreduct.exe C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe N/A
File created C:\Program Files\Mem Reduct\memreduct.exe.sig C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe N/A
File created C:\Program Files\Mem Reduct\History.txt C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\2229298842\61454011.pri C:\Windows\system32\LogonUI.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\shutdown.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A
N/A N/A C:\Program Files\Mem Reduct\memreduct.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe

"C:\Users\Admin\AppData\Local\Temp\memreduct-3.4-setup.exe"

C:\Program Files\Mem Reduct\memreduct.exe

"C:\Program Files\Mem Reduct\memreduct.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\shutdown.exe

shutdown -r -t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39a3855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nseF668.tmp\System.dll

MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

C:\Users\Admin\AppData\Local\Temp\nseF668.tmp\nsDialogs.dll

MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

C:\Program Files\Mem Reduct\memreduct.exe

MD5 bfbe78d329b87dd1d5ae51707fdf928b
SHA1 015c758391b620dee72625ed59b522c06f6457d7
SHA256 31689824dd984bd9c0f07c20f05bc253f6d107581aec4609044fddcdd50f655d
SHA512 e950551d53e50a0296a60730c0cc2ee029ef9026159e159bee9bb29a0f19756f5167f77c4024854fd58bede7ff8051ac4a2f5acf55443ed29c381e909fd04e5a

C:\Program Files\Mem Reduct\memreduct.lng

MD5 fd343886fff92efb78d9c037030940c2
SHA1 3569587a9540d5e90e0adbf49548d0510bc5a2ea
SHA256 d8e4df8cf32ac59b5cf17187725b06a87783306cd09f56551b07dbac28996241
SHA512 2ac3a75d21748d52bd1602da6ee0dd914f76fcb274855e8fa91231bf184e531b2fa60a18c192b38c5f22888a7ef3b6239ba3ef31018524b916b94f408ef214db

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-10 20:47

Reported

2024-06-10 20:49

Platform

macos-20240410-en

Max time kernel

31s

Max time network

35s

Command Line

[sh -c sudo /bin/zsh -c "/Users/run/memreduct-3.4-setup.exe"]

Signatures

Launch Agent

persistence

Resource Forking

evasion
Description Indicator Process Target
N/A /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd N/A N/A
N/A /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd N/A N/A
N/A /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy N/A N/A
N/A /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper N/A N/A
N/A /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid N/A N/A
N/A /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd N/A N/A

Launchctl

execution
Description Indicator Process Target
N/A /bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist N/A N/A

Processes

/bin/sh

[sh -c sudo /bin/zsh -c "/Users/run/memreduct-3.4-setup.exe"]

/bin/bash

[sh -c sudo /bin/zsh -c "/Users/run/memreduct-3.4-setup.exe"]

/usr/bin/sudo

[sudo /bin/zsh -c /Users/run/memreduct-3.4-setup.exe]

/bin/zsh

[/bin/zsh -c /Users/run/memreduct-3.4-setup.exe]

/Users/run/memreduct-3.4-setup.exe

[/Users/run/memreduct-3.4-setup.exe]

/usr/libexec/xpcproxy

[xpcproxy com.apple.sysmond]

/usr/libexec/sysmond

[/usr/libexec/sysmond]

/usr/libexec/xpcproxy

[xpcproxy com.apple.security.cloudkeychainproxy3]

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

[/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy]

/usr/libexec/xpcproxy

[xpcproxy com.apple.geod]

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod

[/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod]

/usr/libexec/xpcproxy

[xpcproxy com.apple.quicklook.ui.helper]

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper

[/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper]

/usr/libexec/xpcproxy

[xpcproxy com.apple.xpc.launchd.oneshot.0x10000001.Microsoft Word]

/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word

[/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word -psn_0_192559]

/usr/libexec/xpcproxy

[xpcproxy com.apple.XprotectFramework.AnalysisService 590]

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService

[/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService]

/usr/libexec/xpcproxy

[xpcproxy com.apple.siri.context.service]

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService

[/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService]

/usr/libexec/xpcproxy

[xpcproxy com.apple.spindump]

/usr/sbin/spindump

[/usr/sbin/spindump]

/usr/libexec/xpcproxy

[xpcproxy com.apple.tailspind]

/usr/libexec/xpcproxy

[xpcproxy com.apple.spindump_agent]

/usr/libexec/tailspind

[/usr/libexec/tailspind]

/usr/libexec/spindump_agent

[/usr/libexec/spindump_agent]

/usr/libexec/xpcproxy

[xpcproxy com.apple.systemprofiler]

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information

[/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information]

/usr/libexec/xpcproxy

[xpcproxy com.apple.storeuid]

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid

[/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid]

/usr/libexec/xpcproxy

[xpcproxy com.apple.PerformanceAnalysis.animationperfd]

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd

[/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.ReportMemoryException]

/usr/libexec/ReportMemoryException

[/usr/libexec/ReportMemoryException]

/usr/libexec/xpcproxy

[xpcproxy com.apple.installd]

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd

[/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.storedownloadd]

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd

[/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.system_installd]

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd

[/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.replayd]

/usr/libexec/replayd

[/usr/libexec/replayd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.metadata.mdwrite]

/usr/libexec/xpcproxy

[xpcproxy com.apple.Safari.CacheDeleteExtension 620]

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension

[/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension]

/usr/libexec/xpcproxy

[xpcproxy com.apple.pbs]

/System/Library/CoreServices/pbs

[/System/Library/CoreServices/pbs]

/usr/libexec/xpcproxy

[xpcproxy com.apple.geod]

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod

[/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod]

/usr/libexec/xpcproxy

[xpcproxy com.apple.secinitd]

/usr/libexec/secinitd

[/usr/libexec/secinitd]

/usr/libexec/xpcproxy

[xpcproxy com.microsoft.autoupdate.fba.2660]

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant

[/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant]

/bin/launchctl

[/bin/launchctl list]

/usr/libexec/xpcproxy

[xpcproxy com.microsoft.autoupdate.helper]

/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper

[/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper]

/bin/launchctl

[/bin/launchctl load /Library/LaunchAgents/com.microsoft.update.agent.plist]

/usr/bin/codesign

[/usr/bin/codesign -v /Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper]

Network

Country Destination Domain Proto
US 20.189.173.2:443 tcp
US 8.8.8.8:53 onedscolprdeus06.eastus.cloudapp.azure.com udp
US 20.42.73.25:443 onedscolprdeus06.eastus.cloudapp.azure.com tcp
US 8.8.8.8:53 bag-cdn-lb.itunes-apple.com.akadns.net udp
US 8.8.8.8:53 b._dns-sd._udp.0.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 db._dns-sd._udp.0.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 b._dns-sd._udp.0.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 db._dns-sd._udp.0.0.127.10.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 ecs.office.com udp
US 52.113.194.132:443 ecs.office.com tcp
US 8.8.8.8:53 odc.officeapps.live.com udp
NL 52.109.89.119:443 odc.officeapps.live.com tcp
US 8.8.8.8:53 roaming.officeapps.live.com udp
NL 52.109.89.19:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 messaging.engagement.office.com udp
NL 52.111.243.8:443 messaging.engagement.office.com tcp
US 8.8.8.8:53 gspe1-ssl.ls.apple.com.edgesuite.net udp
NL 23.209.125.28:443 tcp
US 8.8.8.8:53 e4686.dsce9.akamaiedge.net udp
NL 72.246.172.153:443 tcp
US 8.8.8.8:53 a479.dscg4.akamai.net udp
NL 23.72.252.80:443 gspe1-ssl.ls.apple.com.edgesuite.net tcp

Files

/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsObject.db

MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.microsoft.Word//mds/mdsDirectory.db

MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

/Users/run/Library/Group Containers/UBF8T346G9.Office/FontCache/4/PreviewFont/hier_officeFontsPreview_4_39.ttf

MD5 e5223ac9cb2716d1c490cb0e41a954b6
SHA1 e370e858bac68d8ab6e9363ee4516aad1ee3ebf3
SHA256 096791f1856261c77f26b7e21fc308928b3b4408f8b65cfb75ae2ee531a7da30
SHA512 2aa2c3b894a3dd8b296d6e386b53f3b12d5afe0d32e69f68f2beac0d6d639474cf0c6de85550475ab537abb2d9dc714300009b8da1e2528aa61377408c851952

/Users/run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml

MD5 aa8248b950c795b1c43cc635392b8fc2
SHA1 cba37c5d780736dcfbf54691d007b6b40abdfa88
SHA256 73e7b03f68381d05d3e9e362b3e8a28a739f8ceedd6b67203a5c16219757bdf2
SHA512 a616e995f732e117b713e4e0e357ac66c5fd410c12a861ac365dc554ea116497e2c0e09a28169c6e565034dd6d842ec816ee4eea51836f3aa217b62a555d3fb8

/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/TelemetryUploadFilecom.microsoft.autoupdate.fba.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-10 20:47

Reported

2024-06-10 20:48

Platform

ubuntu2404-amd64-20240523-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A