40ab55c737a8c45953cc87e8b4f51c7e6a4192a43d2e11154f1052daf4b305ec

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SystemSpeedBooster.exe
Size

3.8MB
MD5

ad8a54f3bb1e1a664749b22b54ec384c
SHA1

88916c7b9dc5207bce48a1e738bf958dd9e1ad7a
SHA256

e14236496d11424e12c0b52d0179c50794ba4a73e7e29fc0390d4336bf0240d7
SHA512

80f7a89fe58d23f2017950ad4441e828949ce975d092c45ad849c548e4fc86f8cc37d36c096284b3f1cdc8dcde713e6285b02fc1636c89c95c86875339189f40
SSDEEP

49152:qN2pCSEENf5cTyD4ANkYB2gnedjc8t8SlC8RoeT3mlmziuuRdwcuL+XTym31A+Px:qKcTnANkYB2gnedjJlCfeDBuRp1TPpw

Score

3^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
2120	SystemSpeedBooster.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemSpeedBooster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemSpeedBooster.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	SystemSpeedBooster.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2364	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe
2120	SystemSpeedBooster.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2120	2364	SystemSpeedBooster.exe	30
PID 2364 wrote to memory of 2120	2364	SystemSpeedBooster.exe	30
PID 2364 wrote to memory of 2120	2364	SystemSpeedBooster.exe	30
PID 2364 wrote to memory of 2120	2364	SystemSpeedBooster.exe	30

C:\Users\Admin\AppData\Local\Temp\SystemSpeedBooster.exe
"C:\Users\Admin\AppData\Local\Temp\SystemSpeedBooster.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\SystemSpeedBooster.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemSpeedBooster.exe" runas
  2⤵
  - Access Token Manipulation: Create Process with Token
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-2-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2120-11-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2120-12-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2120-13-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/2120-14-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download
memory/2364-0-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2364-1-0x0000000000400000-0x00000000007D7000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads