Analysis
-
max time kernel
83s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 05:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
noclip_[unknowncheats.me]_.exe
Resource
win10-20240611-en
windows10-1703-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
noclip_[unknowncheats.me]_.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
noclip_[unknowncheats.me]_.exe
Resource
win11-20240802-en
windows11-21h2-x64
14 signatures
150 seconds
General
-
Target
noclip_[unknowncheats.me]_.exe
-
Size
556KB
-
MD5
e84e4da0f16e40521247870311efd7ac
-
SHA1
30683171aae1e7dd7288e3b1ad7ef1fbde632365
-
SHA256
fa4da01ef3e3d6eca87a36ba135e9b2084461a68e975895bc57050f6ab472def
-
SHA512
0b763636a40bf7bb09521859db1b78ea205bc17a6fe685851a1dce8d3f64a101267c56f706742a7c2dab0e61709924126793853ffa3f84bb706145e6817dbb2b
-
SSDEEP
12288:VRSNhZBlfA8/C8sSoC+PZE9O2bJIC0fDNNr:VsfA8K8J+O93l0fZF
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NalDrv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\NalDrv.sys" if3I1.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation noclip_[unknowncheats.me]_.exe -
Executes dropped EXE 1 IoCs
pid Process 4204 if3I1.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\SoftwareDistribution\Download\if3I1.sys noclip_[unknowncheats.me]_.exe File created C:\Windows\SoftwareDistribution\Download\if3I1.exe noclip_[unknowncheats.me]_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe 2352 noclip_[unknowncheats.me]_.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4204 if3I1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSystemEnvironmentPrivilege 4204 if3I1.exe Token: SeDebugPrivilege 4204 if3I1.exe Token: SeLoadDriverPrivilege 4204 if3I1.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2352 wrote to memory of 4204 2352 noclip_[unknowncheats.me]_.exe 83 PID 2352 wrote to memory of 4204 2352 noclip_[unknowncheats.me]_.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\noclip_[unknowncheats.me]_.exe"C:\Users\Admin\AppData\Local\Temp\noclip_[unknowncheats.me]_.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SoftwareDistribution\Download\if3I1.exe"C:\Windows\SoftwareDistribution\Download\if3I1.exe" -map C:\Windows\SoftwareDistribution\Download\if3I1.sys2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD5083c6c05ac5875d0b6e997e894ca07bc
SHA169d0116998e8a70db5852fccb86d45975ce88a9a
SHA25603aefd40698cafbd48138784f362fb9a36f726fb50f262ca40695729f7b553ca
SHA512fb0b9994f9ddadd825476ed19a8299ef90536dae58b4f3087145ca4033a63d4ae0da944ac8bf4e71324e1b63af755ab1d82019e55de6377b00c9812ed57f3fdf