Malware Analysis Report

2024-09-23 11:51

Sample ID 240614-re4hcsxenm
Target aa17324e8950122d3c65acbfab167fd0_JaffaCakes118
SHA256 0e816833fbbb7b8625c0b3b53ad13344776182f4da76e51dde391ecc37ace157
Tags
bootkit evasion persistence trojan
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

0e816833fbbb7b8625c0b3b53ad13344776182f4da76e51dde391ecc37ace157

Threat Level: Shows suspicious behavior

The file aa17324e8950122d3c65acbfab167fd0_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

bootkit evasion persistence trojan

Checks BIOS information in registry

Checks whether UAC is enabled

Enumerates connected drives

Writes to the Master Boot Record (MBR)

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-14 14:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 14:07

Reported

2024-06-14 14:09

Platform

win7-20231129-en

Max time kernel

140s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Ware.exe"

Signatures

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cc557e64beda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f993280333965d47b02853de65ec960200000000020000000000106600000001000020000000f535f4bffd40f616b9751ca8a53ce7098d303acab46870830fdce3dfc4fe8cca000000000e8000000002000020000000cf7e610c9874bfb8cfcdc6aa5ca9cec2ea57cfc2b885d40ac838cac673dd65ef900000007bd51ab19c26023a76d15b272de52fd58a2cb3905eb4fb41dfb695959a2471d7fc7e59d76762ce32edbe8631efaad936433d0ca9e812c45bfefa00464e62d8046269a08d7a8e4fecdd385e1c3c88625a475417def5d59129b9f91f8f1e1639f3c9b307c9ef0fc2049b55219381c2cda7d28248d39bcd29f57f8a30d3128b0fd9da032ca1a03fd1d825f6fba1eff560ef40000000af8b43b45e95d4ebeb4dcc1185c57cb31509f32957d3c46797ddaacb533fe481e0c1b380b2daccc6003b290dcbd952b7d92248e4c9f08f5b989ebf79b2749f74 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f993280333965d47b02853de65ec9602000000000200000000001066000000010000200000008116bc0d4f50c8bc4d774ca3aba97adf91b45018b83cc4027502e5fb28f26a73000000000e80000000020000200000008121c977f07f767a5e72e77ef9c7c6ad0ca16f06fd688499e959977df024aef72000000050b6c3f8636d4b383d07663f86b1872402af21d1db4cd7fd7ed9117dc0e250d8400000003d063ae1a6cb676cfb2297658c27b57ba6c21dfb1b44ae7b4dc9aba6005e349847edc51d12abd9fb721cc40195cef2a05fc0fad8ec33441d69e28df76eb43e6d C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A800981-2A57-11EF-910D-CE7E212FECBD} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424535908" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Ware.exe

"C:\Users\Admin\AppData\Local\Temp\Ware.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.virtualhardwares.com udp
HK 8.210.51.125:80 www.virtualhardwares.com tcp
US 8.8.8.8:53 hm.baidu.com udp
CN 111.45.3.198:443 hm.baidu.com tcp
US 8.8.8.8:53 virtualhardwares.com udp
HK 8.210.51.125:80 virtualhardwares.com tcp
HK 8.210.51.125:80 virtualhardwares.com tcp
CN 111.45.3.198:443 hm.baidu.com tcp
CN 111.45.3.198:443 hm.baidu.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
NL 23.62.61.72:80 www.bing.com tcp
NL 23.62.61.72:80 www.bing.com tcp
CN 183.240.98.228:443 hm.baidu.com tcp
CN 183.240.98.228:443 hm.baidu.com tcp
CN 183.240.98.228:443 hm.baidu.com tcp
CN 14.215.183.79:443 hm.baidu.com tcp
CN 14.215.183.79:443 hm.baidu.com tcp
CN 14.215.183.79:443 hm.baidu.com tcp
CN 111.45.11.83:443 hm.baidu.com tcp
CN 111.45.11.83:443 hm.baidu.com tcp
CN 111.45.11.83:443 hm.baidu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
CN 14.215.182.140:443 hm.baidu.com tcp
CN 14.215.182.140:443 hm.baidu.com tcp
CN 14.215.182.140:443 hm.baidu.com tcp
HK 8.210.51.125:80 virtualhardwares.com tcp
HK 8.210.51.125:80 virtualhardwares.com tcp
US 8.8.8.8:53 wwa.lanzoui.com udp
CN 118.31.212.253:443 wwa.lanzoui.com tcp
CN 118.31.212.253:443 wwa.lanzoui.com tcp
CN 118.31.212.253:443 wwa.lanzoui.com tcp

Files

memory/2232-11-0x00000000027E0000-0x00000000027E2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar2CA2.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e8a73d4ada693fc2b67ddd5a729a1d63
SHA1 8affd48c44e3bd7670794b3031587728858534af
SHA256 9c42d5aa0c3f07149a148f72b8cf3624475ec8e3d02a7ae761f8fc46bccc0438
SHA512 c734de854b9638f2eaac7eaea0d7bc96ad386bd0d15bac57542a65099e97206920647f7523c0f7b20dc2631b71c879ea2468a3198822d913582a95afdb14f4db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 37dc5e898a2b754657fe1d314eaa2455
SHA1 f8d0f2d66cbba2fbd23f1290067db828e2c86286
SHA256 58481689fa793173a16bcd50d5db804165c31d06a460c1811ca5dca8a2bb2dbf
SHA512 c82b168e2787a8ba184d1c0b3237ff8dbae64edf91c4b3efcebe9cae388d19a66908adaeb25227e283ffd20ceb5f87f5a327835e40bdf513b4ae2145ebb843f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 cf528dec36dab92be1534a8ff804effb
SHA1 1bfddf387f377936649bc078c9c38ad7408b64f3
SHA256 5ed927cee75f3fa2537e130df08afea274846cd7e05df219518120983460cd71
SHA512 55caf0d153a1172547707fd10bf1a98e532b1c4aa5efb68a0e1266ce8c2126c98fabf87817e0ca2e5457e5c40931d15c1af1fed8a3b7dc226d3a809819ce5587

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bad2a9b0da7bfd93ac34864222e6e7d5
SHA1 f3933192b490f67be3d3e39451139e186091ec98
SHA256 f00bd35981185c23de6214ae4318e8679e475fdd2e9421a2201b04a01efc8bc9
SHA512 3a1b5d96746446790960c78947f04e1945ca948dea143c5ec4dc478e1e6b60383b9301054fd0a29cdc9cfbb54bba15a0260ee8f220d2dee6092cca154b5a9082

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29d5fc6b615d5e96290a389bdfdf48cd
SHA1 403f4bf5b751203ec54c4533e554cc8dfa4da223
SHA256 7d5f1475449063f86c029970656fb37e674316d953b27c2d2542481df697ba6e
SHA512 d3dd9ef11485c1b87c4535fbabac60369418187d4f7c385c781022ab78054ea8f97035ea9847a8dff545fe388197b8f9809658aa2a9be0d1aee445ab51a84392

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75201d6a7ff81c0b3683c4ef94fe8f1a
SHA1 d7c1f45c02ad0a830aaccb675002bd8bca063e62
SHA256 1ca063c913b3764bb07ced6d9c5474a8765b18666f6945de980d981f38e0e9c4
SHA512 752f9446ef8ff226ec74dd678f0a9557dc068e3665838233af588bcbf2c263b446fa61f4512924d6b08cab8e7ab6af5ea52a09642227717232bf0bd14826ddc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 afc71ee69d7f7dc6e4bf2be7e632027b
SHA1 c860989c9715bb13312cc584d76cb2d7bfb9fb88
SHA256 5109d498155b81300b5b4b344f19c8ecddb14123e23366f661325f68fe5febf9
SHA512 b86b82d2b8d13e82b09cc0624ee8465675aed5e9d8d39658920972c6aeb0a972c3951e7f385a06e6d007267c32b71e6c64029b58f6df8625e1c72c6712022c85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 215796b04c33798c3477a5db102c52de
SHA1 4bd283ad9e153dedd9bc3388557be495c2de5a05
SHA256 1ddb0f4a16c2b4ed7a8f4d2ab3702661e51f1ba5d1716086ab9ecc9cc753e5f2
SHA512 60a0b83b2c8c0ae2725a1eb4b953aaec8bd10849c8b444bc58a17e16a1e5c89a2cffcae9f0698b3f79ff22968f23868614e6283ac75c97d6caa8078237edcf1b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0cdfbf14aa8e1e78ad8ca2d3335578bb
SHA1 ec781398353f92bcc06412834e514327070acf24
SHA256 b4dcfdecae4366addcfbe61dd5a63fd8919cdc8830098f4e72260f16cff08eb5
SHA512 38f7b02909b5a1b1f720d951586cfe84db7f0018427382e57a6867a102eac2b125b1a451c19ee5b35e797b32a45ef2b253ccef208a43a8dae259fde627545cb9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 001a9c8cac1e831391cefcb8f19b5fab
SHA1 7de23c0cdb3ae0741b16976f736fab232417e794
SHA256 ff55c5224af06803b29d5f89b42041e354a5e27a3c7e93b114bbbf5b22f90aa9
SHA512 27443c150fd06dff29aac743f305e267538206d797e9d973a4cc1cd3c5f145de8bf56e2bd656496e96196c9961d5b4100c111f1d72ec5869bb7c01789c03c148

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

memory/2232-590-0x00000000003F0000-0x000000000058F000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d39f1335065c8c34634805bdbdbe638d
SHA1 ca31728d2cfdc10aa3f1a07fdc95582676ab5e6a
SHA256 bd4ae78a0db32e4f6f04177bcaf30918115d1568bec78c7ece1834017da5a48e
SHA512 2c1c96ea3463d8f0b65bfdb35e49b015ee0dd1282b22ad83ee94024c2aa38cc82d591309713261987c186d254f9b0def45eebcd9b79e5f3dddaea519e5ce6d9c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 674d9b071433119bcffb3c8b6ef9e719
SHA1 e60b36c84717eca2cd78ba043c9b3d914c545e53
SHA256 9a76a54360df21e628fc4bfca9ccc027eaf32cfd43283a0bfd37d2bf8873c9a2
SHA512 c39838dcd03d6b921326d553705039bc739f2ccd56e12cec25b077151fa833811947903902ac0f2b9eeb567afc46b0946da34908715c5c939f25b97d9320e0c3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3a032d7e3baaac3fa32260da298162c6
SHA1 231e68b501b343d181b35a84a5b65e478885b2c9
SHA256 81fc7f5f843dc64b85ba2508fb0b7e89ece82f8da6d71e2ba4cfca1e0997f8b2
SHA512 1a5efec5dddd4106dc7b0d5afe21064239fb4b80d314068270a5840a55d6a577a07e725fa54cd62cca8265fd3f7585043afdff26f4f5678bf3d4ecc06b4fe3cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2cc88f53f96c71ea80e8f2777c365881
SHA1 a0143b3325d12f1ba86428ba2be3d646f6db062d
SHA256 41a8bd9e2b7cd4a3b72b2c022236d1e8ae8c4478fafc10e855e2c4aeb45cdae3
SHA512 31d093ee2b54aa2a1d156eb19cef9174b7802cc440d238f07efcce4ce0ab7be0ff54f9c4f2cf830b09d836ca41888a3a904020456c575579668bafb8a434edc7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f8e4d4d3cd84ddc2dfc3689d6828a48
SHA1 14d0607dcc9c236ef24fedb42fd3bc861cbb4853
SHA256 84c39cba7756d70b2d68e1f563b0ac07eaeb8b4b08daf105c1025a124515e767
SHA512 0437818bf0d3ab2b13e6336d2bf7a51996f4d410ba7deb35616cb4ca1337d2bc0c381279f681130dfc519f3d24041c2c7a8f9c985a0c324730bff41bdd6d1981

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51ca0838a57fd3b396323eb0ed2a59aa
SHA1 70c4f96c085e6ddf21670710e7249734551482f6
SHA256 c4d879508672188d25b67a71e5bbe0cad64de35eb78008f285682439428f1dad
SHA512 0e16f8a7b0c093dd73998b338826775e98bb91f88a3bd3d69bb7cffb2420b6605a9775d1ffdfe9a3e66c428fb2f4f0f4b5fade84e794504ada3f2c0a43434af3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3cdcfed6d9a0b53ecec626257ed9f9d5
SHA1 04d56f9b0ad4dbac5f6900555ed270931f9e6784
SHA256 7024379bbb0ce909ccd40dcbd064abf1e5729c5439923ad184ab429fd5c436ca
SHA512 793a34316983b3c24f843b0b6a418da34d5eac3875ea4494cce62db72614cbb7f53b647ff906308d46f373dc82aa4f811d8631f9a5c4057b1bf26249fd6642b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7d411939a4038e0d7c3a93a591685cb7
SHA1 770dc3f0daa8f3bfb70706d8e5f74a2ff44f0de0
SHA256 a7293d3f982353796213bf7296b45e53fb79c3deac0cdbcc52b6e7665be55f95
SHA512 97e81eb560699255136114c5d05290e0814720c27e8784e3b6afd07cdd88ff5bb50b0867b4327a8773b8efc624e4b5f70ed5c2b131ad589f8faa34ab8d8c56f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20dda47a9a569ffe9611d7370c6ead05
SHA1 c7c255940f216d9b0bdb1eddae9b3e78336cd7f8
SHA256 c30d89fcfa15b8c628e4e1c147f8d6254c6cd7de3d7d6324bc58967202f66b0c
SHA512 debf9c3e463b06041fe071e6090599ea117369ce020c713c00148d02d8fe6e6154c74120c68859dfea596578ede7dda3b538a1c21e177c9ed87642c094a12fb7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7cc966982f7ecb3608649a6826bd3793
SHA1 180649914c0ad8c4143ee633a7ae66ac727e1dbe
SHA256 f9fc7e62a7959c51474b82eec470adc3380b7c704b68fe92881aa1cc9c228924
SHA512 1959247e952227f5d765023a0121fda2e6ad91820e3bc7d8f7be7d9115937300018c8c9f7efd5a210490b4c2e89b840467af58378b971bac3cb92f99de228a6d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 14:07

Reported

2024-06-14 14:09

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Ware.exe"

Signatures

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Ware.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Ware.exe

"C:\Users\Admin\AppData\Local\Temp\Ware.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.virtualhardwares.com udp

Files

memory/3720-0-0x00000000005B0000-0x000000000074F000-memory.dmp