Overview

overview

8

Static

static

3

au.exe

windows7-x64

7

au.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$R0.dll

windows7-x64

3

$R0.dll

windows10-2004-x64

3

Data/sqlite3.dll

windows7-x64

3

Data/sqlite3.dll

windows10-2004-x64

3

Office2007Blue.dll

windows7-x64

1

Office2007Blue.dll

windows10-2004-x64

1

au.chm

windows7-x64

1

au.chm

windows10-2004-x64

1

au.exe

windows7-x64

7

au.exe

windows10-2004-x64

7

au32.exe

windows7-x64

1

au32.exe

windows10-2004-x64

3

clearpasti...ry.vbs

windows7-x64

8

clearpasti...ry.vbs

windows10-2004-x64

8

createsrpoint.vbs

windows7-x64

4

createsrpoint.vbs

windows10-2004-x64

1

da.exe

windows7-x64

3

da.exe

windows10-2004-x64

3

hstdel.exe

windows7-x64

1

hstdel.exe

windows10-2004-x64

3

rc.chm

windows7-x64

1

rc.chm

windows10-2004-x64

1

rc.exe

windows7-x64

3

rc.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    134s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 19:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    clearpasticonhistory.vbs

  • Size

    241B

  • MD5

    c2f92bd41b97855a68e39ad6bbc3b9e4

  • SHA1

    8a70c5384bedbcf7be26b5d43ae0e3c276d4ed05

  • SHA256

    79b3101e208879d26b84113859a46919e4f1d29da417f604f2946e5949bc4db4

  • SHA512

    12273e97c8b6f0804fe4d6f237aace1456c0ef4c57871d057724c7bcccbca6cb6bec4e4daef37cbb465fdbd097f03c881c2dd00e9a37fe86c159b858297fa9ce

Score
8/10
persistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Modifies registry class 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\clearpasticonhistory.vbs"
    1⤵
      PID:2468
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2060
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x590
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2816

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2060-3-0x00000000039F0000-0x0000000003A00000-memory.dmp

      Filesize

      64KB

      Download