913c6f43c39f4ed8255bc5085c4baaabcdcf7c3a4cef992430adf932e4e5df7e

Resubmissions

22-08-2024 19:59

240822-yqgw3axfrj 1

22-08-2024 19:56

240822-ynx59sxfjr 6

Analysis

max time kernel
127s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
22-08-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

instalator mojej paczki.bat
Size

4KB
MD5

f2f70d93b1789c929e7e233541e62c6e
SHA1

9f42eb9e66ce4b6cb6baa9425c965c43e5dbf29f
SHA256

913c6f43c39f4ed8255bc5085c4baaabcdcf7c3a4cef992430adf932e4e5df7e
SHA512

52d05123719032ff3bde96e28a06990d9e8ff11ca57ac8e64f14194664f3b9947757898489318747633646f2da5ac9b7e0923c91a13f7b13bf84827b4b0ae958
SSDEEP

96:cezJtsSsaSvQw4UGxWrhZ4rqcuQjQAmECbvhW5CSklZr4JYLXZPLLLWZAqVqPtDb:bVjWrhZ4rqRFAmECbhrSsZr4JyXZzLCg

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000788534b6cdf4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	4024	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4024	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4024	SearchIndexer.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 496	4376	cmd.exe	89
PID 4376 wrote to memory of 496	4376	cmd.exe	89
PID 4376 wrote to memory of 2052	4376	cmd.exe	90
PID 4376 wrote to memory of 2052	4376	cmd.exe	90
PID 4376 wrote to memory of 1168	4376	cmd.exe	91
PID 4376 wrote to memory of 1168	4376	cmd.exe	91
PID 4376 wrote to memory of 3032	4376	cmd.exe	92
PID 4376 wrote to memory of 3032	4376	cmd.exe	92
PID 4376 wrote to memory of 1668	4376	cmd.exe	93
PID 4376 wrote to memory of 1668	4376	cmd.exe	93
PID 4376 wrote to memory of 4160	4376	cmd.exe	94
PID 4376 wrote to memory of 4160	4376	cmd.exe	94
PID 4376 wrote to memory of 1096	4376	cmd.exe	95
PID 4376 wrote to memory of 1096	4376	cmd.exe	95
PID 4024 wrote to memory of 3172	4024	SearchIndexer.exe	105
PID 4024 wrote to memory of 3172	4024	SearchIndexer.exe	105
PID 4024 wrote to memory of 4800	4024	SearchIndexer.exe	106
PID 4024 wrote to memory of 4800	4024	SearchIndexer.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\instalator mojej paczki.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\system32\curl.exe
  curl https://cdn.modrinth.com/data/P7dR8mSH/versions/P7uGFii0/fabric-api-0.92.2B1.20.1.jar -o C:\Users\Admin\AppData\Roaming\.minecraft\mods\fabric-api-0.92.2+1.20.1.jar
  2⤵
  PID:496
- C:\Windows\system32\curl.exe
  curl https://cdn.modrinth.com/data/AANobbMI/versions/QHGZ9XSU/sodium-fabric-0.5.9Bmc1.20.1.jar -o C:\Users\Admin\AppData\Roaming\.minecraft\mods\sodium-fabric-0.5.8+mc1.20.1.jar
  2⤵
  PID:2052
- C:\Windows\system32\curl.exe
  curl https://cdn.modrinth.com/data/gvQqBUqZ/versions/ZSNsJrPI/lithium-fabric-mc1.20.1-0.11.2.jar -o C:\Users\Admin\AppData\Roaming\.minecraft\mods\lithium-fabric-md1.20.1-0.11.2.jar
  2⤵
  PID:1168
- C:\Windows\system32\curl.exe
  curl https://cdn.modrinth.com/data/Orvt0mRa/versions/VlLxDisa/indium-1.0.31Bmc1.20.4.jar -o C:\Users\Admin\AppData\Roaming\.minecraft\mods\indium-1.0.31+mc1.20.4.jar
  2⤵
  PID:3032
- C:\Windows\system32\curl.exe
  curl https://cdn.modrinth.com/data/YL57xq9U/versions/KHQ2Hnpt/iris-1.7.0Bmc1.20.1.jar -o C:\Users\Admin\AppData\Roaming\.minecraft\mods\iris-1.7.0+mc1.20.1.jar
  2⤵
  PID:1668
- C:\Windows\system32\curl.exe
  curl https://cdn.modrinth.com/data/1IjD5062/versions/84Zs6tNo/continuity-3.0.0-beta.5B1.20.1.jar -o C:\Users\Admin\AppData\Roaming\.minecraft\mods\continuity-3.0.0-beta.5+1.20.1.jar
  2⤵
  PID:4160
- C:\Windows\system32\curl.exe
  curl https://cdn.modrinth.com/data/lfHFW1mp/versions/OLBYX5jG/journeymap-1.20.1-5.10.1-fabric.jar -o C:\Users\Admin\AppData\Roaming\.minecraft\mods\journeymap-1.20.1-5.10.1-fabric.jar
  2⤵
  PID:1096

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3172
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2644 2640 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\.minecraft\mods\continuity-3.0.0-beta.5+1.20.1.jar

Filesize
75B

MD5
ec2c6925a7dafdc0064179af269db092

SHA1
fef35098cf25319059c52d8d010aa644052d5f3a

SHA256
c07c66218123240f6e1a8b0871f73279a7449af7040cd0b6d99aa3723d38a11a

SHA512
f747f7e6fc97fcdea0f3c5a4a1b3749dd8327cd4109863c6ef0351e5df625dfb639b19e480d9d7e89d42b43db45b2364a39f5568f0d5093b7fcfc5141f0ce3b0

Download Submit
memory/4024-7-0x000002CCD4C60000-0x000002CCD4C70000-memory.dmp

Filesize
64KB

Download
memory/4024-23-0x000002CCD4D60000-0x000002CCD4D70000-memory.dmp

Filesize
64KB

Download
memory/4024-39-0x000002CCD9450000-0x000002CCD9458000-memory.dmp

Filesize
32KB

Download
memory/4024-41-0x000002CCD9670000-0x000002CCD9678000-memory.dmp

Filesize
32KB

Download
memory/4024-42-0x000002CCD9660000-0x000002CCD9661000-memory.dmp

Filesize
4KB

Download
memory/4024-44-0x000002CCD9660000-0x000002CCD9668000-memory.dmp

Filesize
32KB

Download