Analysis
- max time kernel
107s - max time network
100s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
14/08/2024, 03:46
General
- Target CCleaner.exe
- Size 37.1MB
- Sample240814-eb3qfawdnd
- SHA256 9cea0bdcf677382833e973158a0c7c9b5dee86fbd7c6fdb8b114aa7b23e64d58
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CCleaner64.exe"C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2944-0-0x00007FF7BD4A0000-0x00007FF7BD4A1000-memory.dmp
memory/2944-1-0x00007FF7BD4B0000-0x00007FF7BD4B1000-memory.dmp
memory/2944-2-0x00007FF7BD4C0000-0x00007FF7BD4C1000-memory.dmp
memory/2944-3-0x00007FF7BD4D0000-0x00007FF7BD4D1000-memory.dmp
memory/2944-4-0x00007FF7BD4E0000-0x00007FF7BD4E1000-memory.dmp
memory/2944-5-0x00007FF7BD540000-0x00007FF7BD541000-memory.dmp
memory/2944-6-0x00007FF7BD4F0000-0x00007FF7BD4F1000-memory.dmp
memory/2944-7-0x00007FF7BD030000-0x00007FF7BD031000-memory.dmp