Overview
overview
5Static
static
3cru-1.5.2.zip
windows7-x64
1cru-1.5.2.zip
windows10-2004-x64
1CRU.exe
windows7-x64
1CRU.exe
windows10-2004-x64
1Info.txt
windows7-x64
1Info.txt
windows10-2004-x64
1reset-all.exe
windows7-x64
1reset-all.exe
windows10-2004-x64
1restart.exe
windows7-x64
4restart.exe
windows10-2004-x64
5restart64.exe
windows7-x64
4restart64.exe
windows10-2004-x64
5Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 21:32
Static task
static1
Behavioral task
behavioral1
Sample
cru-1.5.2.zip
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
cru-1.5.2.zip
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
CRU.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
CRU.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Info.txt
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Info.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
reset-all.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
reset-all.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
restart.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
restart.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
restart64.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
restart64.exe
Resource
win10v2004-20240508-en
General
-
Target
restart.exe
-
Size
63KB
-
MD5
8242ce426ad462eff02edae1487a6949
-
SHA1
9a4f382d427e0de729053535aaa3310cac5f087b
-
SHA256
b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
-
SHA512
aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
-
SSDEEP
768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx
Malware Config
Signatures
-
Drops file in Windows directory 3 IoCs
Processes:
restart64.exedescription ioc process File opened for modification C:\Windows\INF\setupapi.app.log restart64.exe File opened for modification C:\Windows\setupact.log restart64.exe File opened for modification C:\Windows\setuperr.log restart64.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
restart64.exedescription pid process Token: SeLoadDriverPrivilege 2984 restart64.exe Token: SeLoadDriverPrivilege 2984 restart64.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
restart.exedescription pid process target process PID 1688 wrote to memory of 2984 1688 restart.exe restart64.exe PID 1688 wrote to memory of 2984 1688 restart.exe restart64.exe PID 1688 wrote to memory of 2984 1688 restart.exe restart64.exe PID 1688 wrote to memory of 2984 1688 restart.exe restart64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\restart.exe"C:\Users\Admin\AppData\Local\Temp\restart.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\restart64.exerestart64.exe2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2984