Overview
overview
8Static
static
3trichlorom...ty.exe
windows7-x64
1trichlorom...ty.exe
windows10-2004-x64
1trichlorom...ty.exe
windows7-x64
1trichlorom...ty.exe
windows10-2004-x64
1trichlorom...ne.exe
windows7-x64
8trichlorom...ne.exe
windows10-2004-x64
8trichlorom...ty.exe
windows7-x64
1trichlorom...ty.exe
windows10-2004-x64
1trichloromethane.exe
windows7-x64
8trichloromethane.exe
windows10-2004-x64
8trichlorom...te.bat
windows7-x64
1trichlorom...te.bat
windows10-2004-x64
1trichlorom...DL.dll
windows7-x64
1trichlorom...DL.dll
windows10-2004-x64
1trichlorom...-4.dll
windows7-x64
3trichlorom...-4.dll
windows10-2004-x64
3trichlorom...mu.exe
windows7-x64
1trichlorom...mu.exe
windows10-2004-x64
1trichlorom...ss.exe
windows7-x64
1trichlorom...ss.exe
windows10-2004-x64
1trichlorom...sm.exe
windows7-x64
1trichlorom...sm.exe
windows10-2004-x64
1trichlorom...in.exe
windows7-x64
7trichlorom...in.exe
windows10-2004-x64
7trichlorom...bin.py
windows7-x64
3trichlorom...bin.py
windows10-2004-x64
3trichlorom...ne.exe
windows7-x64
8trichlorom...ne.exe
windows10-2004-x64
8trichlorom...ty.exe
windows7-x64
1trichlorom...ty.exe
windows10-2004-x64
1trichloromethane.exe
windows7-x64
8trichloromethane.exe
windows10-2004-x64
8Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19/06/2024, 16:40
Static task
static1
Behavioral task
behavioral1
Sample
trichloromethane.exe-Malware-main/trichloromethane-safety.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
trichloromethane.exe-Malware-main/trichloromethane-safety.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
trichloromethane.exe-Malware-main/trichloromethane.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
trichloromethane.exe-Malware-main/trichloromethane.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
trichloromethane-safety.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
trichloromethane-safety.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
trichloromethane.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
trichloromethane.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Create.bat
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Create.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/SDL.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/SDL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/libcurl-4.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/libcurl-4.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/qemu.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/qemu.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/compress.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/compress.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/nasm.exe
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/nasm.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.py
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
trichloromethane-safety.exe
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
trichloromethane-safety.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
trichloromethane.exe
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
trichloromethane.exe
Resource
win10v2004-20240508-en
General
-
Target
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.py
-
Size
1KB
-
MD5
32dfd28117b185e4870eaf506bb38af7
-
SHA1
b3f3572f0f4403d90889ee5cae7f0774759a1328
-
SHA256
f12bf9386320e3bf1419cc0227430d86c280d40a855b35aff36939f0396b11c7
-
SHA512
247b2ab09495f1a596bfcd567df5a39742591164b1472fd5e6c13d02dbcef0906212a8c06ddfdc8233e11af01cbf8b32536fff1550d7dc7599153d55edcf974d
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2636 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2636 AcroRd32.exe 2636 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2812 2276 cmd.exe 29 PID 2276 wrote to memory of 2812 2276 cmd.exe 29 PID 2276 wrote to memory of 2812 2276 cmd.exe 29 PID 2812 wrote to memory of 2636 2812 rundll32.exe 30 PID 2812 wrote to memory of 2636 2812 rundll32.exe 30 PID 2812 wrote to memory of 2636 2812 rundll32.exe 30 PID 2812 wrote to memory of 2636 2812 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\trichloromethane.exe-Malware-main\trichloromethane\PayloadMBR\Programs\png2bin.py1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\trichloromethane.exe-Malware-main\trichloromethane\PayloadMBR\Programs\png2bin.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\trichloromethane.exe-Malware-main\trichloromethane\PayloadMBR\Programs\png2bin.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ef43270828b9ab91295de64ece1c4594
SHA1db0a83979aadea04461494d87760974694cf3763
SHA2562bf07aabbe1d1723b617a6331eef35114b19f8ac6b4e304ebe1db3c43aafe7bf
SHA512c19563df5428aae85a1149fb79776db8048531b8c011754de1de21eb6662a7965cf05de7eaf8932a973e7767805739eb0cfbea3270709a346af5882cf47effb8