Overview

overview

4

Static

static

1

URLScan

urlscan

https://files.catbox...

windows10-1703-x64

4

Resubmissions

14-09-2024 19:03

240914-xqjvzszgjl 4

14-09-2024 19:00

240914-xnsp4szfjm 3

14-09-2024 18:55

240914-xk9jfszfpd 3

Analysis

  • max time kernel
    83s
  • max time network
    85s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14-09-2024 19:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://files.catbox.moe/548e27.bat

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://files.catbox.moe/548e27.bat"
    1⤵
      PID:1964
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3844
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\548e27.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4512
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic diskdrive get Model
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4000
        • C:\Windows\system32\findstr.exe
          findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
          3⤵
            PID:1304
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\548e27.bat" "
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2392
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic diskdrive get Model
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2488
          • C:\Windows\system32\findstr.exe
            findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
            3⤵
              PID:1440
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\548e27.bat" "
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5028
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic diskdrive get Model
              3⤵
                PID:2728
              • C:\Windows\system32\findstr.exe
                findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
                3⤵
                  PID:4176
            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
              1⤵
              • Modifies registry class
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2104
            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
              1⤵
              • Drops file in Windows directory
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:924
            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
              1⤵
              • Drops file in Windows directory
              • Modifies registry class
              PID:1316
            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
              1⤵
              • Drops file in Windows directory
              • Modifies registry class
              PID:3524
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              1⤵
                PID:2480
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                • Modifies registry class
                PID:164

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VSH5XF98\edgecompatviewlist[1].xml
                Filesize

                74KB

                MD5

                d4fc49dc14f63895d997fa4940f24378

                SHA1

                3efb1437a7c5e46034147cbbc8db017c69d02c31

                SHA256

                853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                SHA512

                cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3TKIKQVA\suggestions[1].en-US
                Filesize

                17KB

                MD5

                5a34cb996293fde2cb7a4ac89587393a

                SHA1

                3c96c993500690d1a77873cd62bc639b3a10653f

                SHA256

                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                SHA512

                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\RWTB4C9B\favicon[1].png
                Filesize

                7KB

                MD5

                9e3fe8db4c9f34d785a3064c7123a480

                SHA1

                0f77f9aa982c19665c642fa9b56b9b20c44983b6

                SHA256

                4d755ac02a070a1b4bb1b6f1c88ab493440109a8ac1e314aaced92f94cdc98e9

                SHA512

                20d8b416bd34f3d80a77305c6fcd597e9c2d92ab1db3f46ec5ac84f5cc6fb55dfcdccd03ffdc5d5de146d0add6d19064662ac3c83a852f3be8b8f650998828d1

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\548e27.bat.q30dd8n.partial
                Filesize

                3.4MB

                MD5

                8060a10b7a0dd79762120ce7a646ae86

                SHA1

                27530385aa5f4cc34c298d9110d24fe3feccae5c

                SHA256

                a8012c20cf2e60fb05675e0382bc5e698f23feceb2457188e981c2b69c18df24

                SHA512

                0c14c9514527317979bb580b2ab08b243824051318c00c02a7c36af5bac451e212d66f3afeed30f6c53b1c146c971875a084dc26cdf81a1d1dd051ccf6e848c8

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\PQUWUY8A\548e27[1].bat
                Filesize

                32KB

                MD5

                d9a101723cff55748df45893eaa0093d

                SHA1

                ecf7140a20bfcc4fe00d16988de2ea663247d504

                SHA256

                550c04b179d49e69f960cc909575b3e4cb806ad4cc00764957003fc0c50b5510

                SHA512

                9a5235b39007e056ae23895e7607e63a8b0e7ea37a3f25d9eeacb814ab4afb1189fb662b5a94c7aad2402c7fa08a574208e66d99fc8031690f40980ecc008a5c

                Download Submit

              • memory/924-44-0x000001B118330000-0x000001B118430000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/1316-106-0x00000287A3900000-0x00000287A3A00000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/1316-63-0x00000287B3BE0000-0x00000287B3BE2000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1316-61-0x00000287B3B20000-0x00000287B3B22000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1316-166-0x00000287B4EE0000-0x00000287B4EE2000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1316-164-0x00000287B4DC0000-0x00000287B4DC2000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1316-162-0x00000287B4180000-0x00000287B4182000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1316-58-0x00000287A37E0000-0x00000287A37E2000-memory.dmp

                Filesize

                8KB

                Download

              • memory/3524-74-0x0000023AAAD00000-0x0000023AAAE00000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/3844-67-0x00000204488E0000-0x00000204488E1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3844-66-0x00000204488D0000-0x00000204488D1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3844-16-0x0000020441A20000-0x0000020441A30000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3844-35-0x0000020440A00000-0x0000020440A02000-memory.dmp

                Filesize

                8KB

                Download

              • memory/3844-0-0x0000020441920000-0x0000020441930000-memory.dmp

                Filesize

                64KB

                Download