Overview

overview

8

Static

static

3

cmdi_1.exe

windows10-1703-x64

8

cmdi_1.exe

windows10-2004-x64

8

cmdi_1.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    2s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/07/2024, 02:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cmdi_1.exe

  • Size

    914KB

  • MD5

    944a75975433eccb801f9dde6937c72a

  • SHA1

    3ed7a483d65582e284bb18b36bbccc1b17501ccd

  • SHA256

    4f14e58530b66f518f1ce4951bc2b40cb391202b0d683bf2a39d5c0c6bec37ff

  • SHA512

    cae5230d2a985a7b332d7d891f43a6ae78ba713a87bdacee67255acda350dddc0df655559c2362ecec3166bb34488a39d107d34c504e41f5397f8b49b616c822

  • SSDEEP

    24576:2Y4XP7iFOptl7do60OegX7Aoonn5XnMvQo:wXDndD0Ervonn

Score
8/10
persistence

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cmdi_1.exe
    "C:\Users\Admin\AppData\Local\Temp\cmdi_1.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:3092
      • C:\Windows\SoftwareDistribution\Download\unknowncheatsme.exe
        "C:\Windows\SoftwareDistribution\Download\unknowncheatsme.exe" C:\Windows\SoftwareDistribution\Download\unknowncheatsme.sys
        2⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:1184
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        2⤵
          PID:168

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SoftwareDistribution\Download\unknowncheatsme.exe
        Filesize

        134KB

        MD5

        34cfbe3ff70461820ccc31a1afeec0b3

        SHA1

        5d32e91c039c9a6f723ba3c04c1179d02e6a0ce9

        SHA256

        6ebcc6896b243c761da4fc28a26249b0c146ae17aff7697c09bc447008e831df

        SHA512

        1ca4661be645e7e954d89c83f1fd126a5e936533052d4e330c9faccb83bb5942d28265375cee743e468b1625a0c1f10888e7957fe88c718e8501a86a78cdc06e

        Download Submit