Malware Analysis Report

2025-01-03 09:12

Sample ID 240620-nqlvxavgjg
Target 05a12676dbbfa3e35001e5fd37b81bdc_JaffaCakes118
SHA256 391e080880375fe93108469b21d9312d244bdd86b5f8276793117dfcbcf2245c
Tags
bootkit discovery persistence upx pdf link
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

391e080880375fe93108469b21d9312d244bdd86b5f8276793117dfcbcf2245c

Threat Level: Shows suspicious behavior

The file 05a12676dbbfa3e35001e5fd37b81bdc_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

bootkit discovery persistence upx pdf link

Loads dropped DLL

Checks computer location settings

UPX packed file

Executes dropped EXE

Enumerates connected drives

Writes to the Master Boot Record (MBR)

Checks installed software on the system

Adds Run key to start application

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

One or more HTTP URLs in PDF identified

Modifies registry class

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 11:36

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

One or more HTTP URLs in PDF identified

pdf link

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 11:36

Reported

2024-06-20 11:38

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

56s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Manual.pdf"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3636 wrote to memory of 1652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3636 wrote to memory of 1652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3636 wrote to memory of 1652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4368 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1652 wrote to memory of 4652 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Manual.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2D3A8E73D724CC838B1BA09662BC84B9 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=485AE10C115FB895B325E01F9FEBAF96 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=485AE10C115FB895B325E01F9FEBAF96 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E06BF702603F4A1052595AEBE6494268 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=94DF6C80D15F809BFDC27D07C5AFABCE --mojo-platform-channel-handle=2432 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=574FE50B762082254ADA94528F591F72 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6341872EF96BA454B9BF8F777EBCFD4C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6341872EF96BA454B9BF8F777EBCFD4C --renderer-client-id=7 --mojo-platform-channel-handle=2452 --allow-no-sandbox-job /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-20 11:36

Reported

2024-06-20 11:36

Platform

win10v2004-20240508-en

Max time kernel

0s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-20 11:36

Reported

2024-06-20 11:38

Platform

win7-20240221-en

Max time kernel

147s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\PartitionStar\PSWin.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup\Star-Tools PartitionStar = "RunDll32.exe AdvPack.dll,LaunchINFSection Setup.inf,DefaultInstallRun.ntx86" C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Wrapper = "runonce" C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" C:\Windows\SysWOW64\InfDefaultInstall.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\T: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\G: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\O: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\P: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\V: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\W: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\X: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\F: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\J: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\K: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\L: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\M: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\R: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\H: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\I: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\N: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\Q: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\S: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\U: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\E: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Program Files (x86)\PartitionStar\PSWin.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\W95inf32.dll C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
File created C:\Windows\SysWOW64\W95inf16.dll C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\PartitionStar\PSDOS.exe C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41FA.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41E0.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41E1.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PSWin.hlp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PSWin.cnt C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41F5.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41F6.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41F6.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41F9.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41F9.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41FA.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41E3.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PSWin.exe C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41F5.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\ReadMe.txt C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PS.ini C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File created C:\Program Files (x86)\TMP4352$.TMP C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PS.ini C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\Manual.pdf C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41E0.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41E4.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41F7.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\FreeDOS.bin C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41E2.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41E3.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41E4.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\Order.txt C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PSDOS.hlp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41E2.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41F7.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET41F8.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\Setup.inf C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\TMP4352$.TMP C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41E1.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET41F8.tmp C:\Windows\SysWOW64\RunDll32.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.app.log C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Windows\setup.ini C:\Windows\SysWOW64\RunDll32.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\runonce.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\runonce.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\runonce.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\runonce.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\RunDll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\RunDll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\RunDll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\RunDll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\RunDll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\RunDll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\RunDll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2860 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\InfDefaultInstall.exe
PID 2860 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\InfDefaultInstall.exe
PID 2860 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\InfDefaultInstall.exe
PID 2860 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\InfDefaultInstall.exe
PID 2860 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\InfDefaultInstall.exe
PID 2860 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\InfDefaultInstall.exe
PID 2860 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\InfDefaultInstall.exe
PID 2796 wrote to memory of 1572 N/A C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\SysWOW64\runonce.exe
PID 2796 wrote to memory of 1572 N/A C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\SysWOW64\runonce.exe
PID 2796 wrote to memory of 1572 N/A C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\SysWOW64\runonce.exe
PID 2796 wrote to memory of 1572 N/A C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\SysWOW64\runonce.exe
PID 2796 wrote to memory of 1572 N/A C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\SysWOW64\runonce.exe
PID 2796 wrote to memory of 1572 N/A C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\SysWOW64\runonce.exe
PID 2796 wrote to memory of 1572 N/A C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\SysWOW64\runonce.exe
PID 1572 wrote to memory of 3048 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\runonce.exe
PID 1572 wrote to memory of 3048 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\runonce.exe
PID 1572 wrote to memory of 3048 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\runonce.exe
PID 1572 wrote to memory of 3048 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\runonce.exe
PID 1572 wrote to memory of 3048 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\runonce.exe
PID 1572 wrote to memory of 3048 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\runonce.exe
PID 1572 wrote to memory of 3048 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\runonce.exe
PID 3048 wrote to memory of 2500 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\RunDll32.exe
PID 3048 wrote to memory of 2500 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\RunDll32.exe
PID 3048 wrote to memory of 2500 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\RunDll32.exe
PID 3048 wrote to memory of 2500 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\RunDll32.exe
PID 3048 wrote to memory of 2500 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\RunDll32.exe
PID 3048 wrote to memory of 2500 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\RunDll32.exe
PID 3048 wrote to memory of 2500 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\RunDll32.exe
PID 2500 wrote to memory of 2420 N/A C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\PartitionStar\PSWin.exe
PID 2500 wrote to memory of 2420 N/A C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\PartitionStar\PSWin.exe
PID 2500 wrote to memory of 2420 N/A C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\PartitionStar\PSWin.exe
PID 2500 wrote to memory of 2420 N/A C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\PartitionStar\PSWin.exe
PID 2500 wrote to memory of 2420 N/A C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\PartitionStar\PSWin.exe
PID 2500 wrote to memory of 2420 N/A C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\PartitionStar\PSWin.exe
PID 2500 wrote to memory of 2420 N/A C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\PartitionStar\PSWin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\SysWOW64\InfDefaultInstall.exe

"C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\Admin\AppData\Local\Temp\SETUP.INF"

C:\Windows\SysWOW64\runonce.exe

"C:\Windows\system32\runonce.exe" -r

C:\Windows\SysWOW64\runonce.exe

"C:\Windows\System32\runonce.exe"

C:\Windows\SysWOW64\RunDll32.exe

RunDll32.exe AdvPack.dll,LaunchINFSection Setup.inf,DefaultInstallRun.ntx86

C:\Program Files (x86)\PartitionStar\PSWin.exe

"C:\Program Files (x86)\PartitionStar\PSWin.exe"

Network

N/A

Files

memory/2860-0-0x0000000000400000-0x000000000042B000-memory.dmp

memory/2860-2-0x00000000001C0000-0x00000000001EB000-memory.dmp

memory/2860-1-0x00000000001C0000-0x00000000001EB000-memory.dmp

memory/2860-6-0x0000000000400000-0x000000000042B000-memory.dmp

\Program Files (x86)\PartitionStar\PSWin.exe

MD5 474a12b1eaffdb28820e92b61d4e291a
SHA1 90d971e74428f2f412523e938b91a5be4ea614c5
SHA256 23b3d0ea99bf847f6cd0e4bbcb56ed920eafd215845b80b01a4040b7b964b7de
SHA512 06e33fd812da116c30163851c3b9b018f6a298056abd62d7f4009ac908d1882a3a7bc5baef8c78c71ac90759195f7c9695c896a3cce7f202a50f1a1f2279a92f

memory/2420-51-0x0000000000400000-0x000000000051E000-memory.dmp

memory/2500-47-0x00000000032D0000-0x00000000033EE000-memory.dmp

memory/2420-53-0x0000000000400000-0x000000000051E000-memory.dmp

memory/2420-54-0x0000000000400000-0x000000000051E000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-20 11:36

Reported

2024-06-20 11:38

Platform

win7-20240611-en

Max time kernel

140s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PSWin.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PSWin.exe

"C:\Users\Admin\AppData\Local\Temp\PSWin.exe"

Network

N/A

Files

memory/1700-0-0x0000000000400000-0x000000000051E000-memory.dmp

memory/1700-1-0x0000000000260000-0x0000000000261000-memory.dmp

memory/1700-3-0x0000000000400000-0x000000000051E000-memory.dmp

memory/1700-4-0x0000000000400000-0x000000000051E000-memory.dmp

memory/1700-5-0x0000000000260000-0x0000000000261000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-20 11:36

Reported

2024-06-20 11:38

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PSWin.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\PSWin.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PSWin.exe

"C:\Users\Admin\AppData\Local\Temp\PSWin.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 74.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/3560-0-0x0000000000400000-0x000000000051E000-memory.dmp

memory/3560-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

memory/3560-3-0x0000000000400000-0x000000000051E000-memory.dmp

memory/3560-4-0x0000000000400000-0x000000000051E000-memory.dmp

memory/3560-5-0x00000000005C0000-0x00000000005C1000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-20 11:36

Reported

2024-06-20 11:38

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\PartitionStar\PSWin.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup\Star-Tools PartitionStar = "RunDll32.exe AdvPack.dll,LaunchINFSection Setup.inf,DefaultInstallRun.ntx86" C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Wrapper = "runonce" C:\Windows\SysWOW64\InfDefaultInstall.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" C:\Windows\SysWOW64\InfDefaultInstall.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\M: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\N: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\K: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\L: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\O: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\P: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\T: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\E: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\F: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\H: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\U: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\W: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\X: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\G: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\Q: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\S: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\V: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\I: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\J: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A
File opened (read-only) \??\R: C:\Program Files (x86)\PartitionStar\PSWin.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Program Files (x86)\PartitionStar\PSWin.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\W95inf16.dll C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
File created C:\Windows\SysWOW64\W95inf32.dll C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\PartitionStar\SET6264.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET6277.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET6278.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET6278.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET628C.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\FreeDOS.bin C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\Manual.pdf C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET628C.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET628D.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PSDOS.hlp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET6275.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PSWin.hlp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PSWin.cnt C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET628B.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\Setup.inf C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET6275.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PS.ini C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET628B.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PSWin.exe C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET6279.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET628A.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET628D.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET6277.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\ReadMe.txt C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET628A.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\TMP4352$.TMP C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET6263.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PSDOS.exe C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET6276.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET6276.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET6263.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\SET6264.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\Order.txt C:\Windows\SysWOW64\RunDll32.exe N/A
File created C:\Program Files (x86)\PartitionStar\TMP4352$.TMP C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\SET6279.tmp C:\Windows\SysWOW64\RunDll32.exe N/A
File opened for modification C:\Program Files (x86)\PartitionStar\PS.ini C:\Program Files (x86)\PartitionStar\PSWin.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\setup.ini C:\Windows\SysWOW64\RunDll32.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\runonce.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\runonce.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\runonce.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\runonce.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 116 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\InfDefaultInstall.exe
PID 116 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\InfDefaultInstall.exe
PID 116 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\InfDefaultInstall.exe
PID 3144 wrote to memory of 4028 N/A C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\SysWOW64\runonce.exe
PID 3144 wrote to memory of 4028 N/A C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\SysWOW64\runonce.exe
PID 3144 wrote to memory of 4028 N/A C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\SysWOW64\runonce.exe
PID 4028 wrote to memory of 1684 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\runonce.exe
PID 4028 wrote to memory of 1684 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\runonce.exe
PID 4028 wrote to memory of 1684 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\runonce.exe
PID 1684 wrote to memory of 2816 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\RunDll32.exe
PID 1684 wrote to memory of 2816 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\RunDll32.exe
PID 1684 wrote to memory of 2816 N/A C:\Windows\SysWOW64\runonce.exe C:\Windows\SysWOW64\RunDll32.exe
PID 2816 wrote to memory of 2672 N/A C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\PartitionStar\PSWin.exe
PID 2816 wrote to memory of 2672 N/A C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\PartitionStar\PSWin.exe
PID 2816 wrote to memory of 2672 N/A C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\PartitionStar\PSWin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\SysWOW64\InfDefaultInstall.exe

"C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\Admin\AppData\Local\Temp\SETUP.INF"

C:\Windows\SysWOW64\runonce.exe

"C:\Windows\system32\runonce.exe" -r

C:\Windows\SysWOW64\runonce.exe

"C:\Windows\System32\runonce.exe"

C:\Windows\SysWOW64\RunDll32.exe

RunDll32.exe AdvPack.dll,LaunchINFSection Setup.inf,DefaultInstallRun.ntx86

C:\Program Files (x86)\PartitionStar\PSWin.exe

"C:\Program Files (x86)\PartitionStar\PSWin.exe"

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp

Files

memory/116-0-0x0000000000400000-0x000000000042B000-memory.dmp

memory/116-3-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Program Files (x86)\PartitionStar\PSWin.exe

MD5 474a12b1eaffdb28820e92b61d4e291a
SHA1 90d971e74428f2f412523e938b91a5be4ea614c5
SHA256 23b3d0ea99bf847f6cd0e4bbcb56ed920eafd215845b80b01a4040b7b964b7de
SHA512 06e33fd812da116c30163851c3b9b018f6a298056abd62d7f4009ac908d1882a3a7bc5baef8c78c71ac90759195f7c9695c896a3cce7f202a50f1a1f2279a92f

memory/2672-40-0x0000000000400000-0x000000000051E000-memory.dmp

memory/2672-42-0x0000000000400000-0x000000000051E000-memory.dmp

memory/2672-43-0x0000000000400000-0x000000000051E000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 11:36

Reported

2024-06-20 11:38

Platform

win7-20240220-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Manual.pdf"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Manual.pdf"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 1886b0a417a2169776db7bad8eb03a80
SHA1 1cbb10fe5d9d0bf0fbdcff172358395b93c7a808
SHA256 0bbabe8dc6b46736538ca9823d81cf38569b7462df131975f2c095d509101e6f
SHA512 cb9edcd0edd50892efcaef372b95ea42b6ec9cb05069a5f2f122abf7f6ab99a39dedeec49901ccd7e6c1ce1d199946f7d91fe6ba3fb5587b3c1f924973c97334

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-20 11:36

Reported

2024-06-20 11:36

Platform

win7-20240221-en

Max time kernel

0s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-20 11:36

Reported

2024-06-20 11:36

Platform

win7-20240611-en

Max time kernel

0s

Max time network

5s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-20 11:36

Reported

2024-06-20 11:36

Platform

win10v2004-20240226-en

Max time kernel

1s

Max time network

9s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp

Files

N/A