Analysis

  • max time kernel
    92s
  • max time network
    102s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31/10/2024, 10:07

General

  • Target

    Koa_Paid_Tweak_Tool.bat

  • Size

    87KB

  • MD5

    2523b7ade7ef2ab0364cf7af2480780b

  • SHA1

    f0a796bbe87cbedb2422f1a30ed679910b16eec8

  • SHA256

    fb97d6ec1b1de59c4f02b55c8f95e756a13f9119f4bd08e77e832890ae529317

  • SHA512

    3cef3cd7f42f3950ae5d683762747cbc8fbbeba37d8e761e2dffb6ac2469db992023407ed8dd62f2f4bcdc3be91c3de03b8af834a93e423651f1c3548cd9fe3a

  • SSDEEP

    384:0jW4urpgB0TBp1uFuyIBmGlngbuPPqoeV9WIblw8WGDyLNZfKGDyLNZfU9a1QL:n80TBWQyEjPqoC9yiU0QL

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Koa_Paid_Tweak_Tool.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Windows\system32\reg.exe
      Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
      2⤵
      • UAC bypass
      PID:3808
    • C:\Windows\system32\reg.exe
      Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
      2⤵
        PID:3096
      • C:\Windows\system32\reg.exe
        Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
        2⤵
          PID:2080
        • C:\Windows\system32\reg.exe
          Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
          2⤵
            PID:3856
          • C:\Windows\system32\reg.exe
            Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
            2⤵
              PID:1732
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2076
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'KoaPaid' -RestorePointType 'MODIFY_SETTINGS'"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5068
            • C:\Windows\system32\chcp.com
              chcp 65001
              2⤵
                PID:364
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
                2⤵
                  PID:3244
                • C:\Windows\system32\reg.exe
                  Reg.exe add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f
                  2⤵
                    PID:1844
                  • C:\Windows\system32\timeout.exe
                    timeout /t 1 /nobreak
                    2⤵
                    • Delays execution with timeout.exe
                    PID:3508
                  • C:\Windows\system32\reg.exe
                    Reg.exe add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "58" /f
                    2⤵
                      PID:2988
                    • C:\Windows\system32\timeout.exe
                      timeout /t 1 /nobreak
                      2⤵
                      • Delays execution with timeout.exe
                      PID:2352
                    • C:\Windows\system32\reg.exe
                      Reg.exe add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f
                      2⤵
                        PID:1964
                      • C:\Windows\system32\timeout.exe
                        timeout /t 1 /nobreak
                        2⤵
                        • Delays execution with timeout.exe
                        PID:3120
                      • C:\Windows\system32\reg.exe
                        Reg.exe add "HKCU\Control Panel\Accessibility\MouseKeys" /v "Flags" /t REG_SZ /d "0" /f
                        2⤵
                          PID:4724
                        • C:\Windows\system32\reg.exe
                          Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseSpeed" /t REG_SZ /d "0" /f
                          2⤵
                            PID:1636
                          • C:\Windows\system32\reg.exe
                            Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f
                            2⤵
                              PID:4532
                            • C:\Windows\system32\reg.exe
                              Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseThreshold2" /t REG_SZ /d "0" /f
                              2⤵
                                PID:3088
                              • C:\Windows\system32\timeout.exe
                                timeout /t 1 /nobreak
                                2⤵
                                • Delays execution with timeout.exe
                                PID:1448
                              • C:\Windows\system32\reg.exe
                                Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseSensitivity" /t REG_SZ /d "10" /f
                                2⤵
                                  PID:2296
                                • C:\Windows\system32\timeout.exe
                                  timeout /t 1 /nobreak
                                  2⤵
                                  • Delays execution with timeout.exe
                                  PID:3640
                                • C:\Windows\system32\reg.exe
                                  Reg.exe add "HKCU\Control Panel\Keyboard" /v "KeyboardDelay" /t REG_SZ /d "0" /f
                                  2⤵
                                    PID:1160
                                  • C:\Windows\system32\timeout.exe
                                    timeout /t 1 /nobreak
                                    2⤵
                                    • Delays execution with timeout.exe
                                    PID:2144
                                  • C:\Windows\system32\reg.exe
                                    Reg.exe add "HKCU\Control Panel\Keyboard" /v "KeyboardSpeed" /t REG_SZ /d "31" /f
                                    2⤵
                                      PID:3164
                                    • C:\Windows\system32\timeout.exe
                                      timeout /t 1 /nobreak
                                      2⤵
                                      • Delays execution with timeout.exe
                                      PID:1684
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
                                      2⤵
                                        PID:4564
                                      • C:\Windows\system32\SystemPropertiesPerformance.exe
                                        C:\Windows\system32\SystemPropertiesPerformance.exe
                                        2⤵
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        PID:4428
                                    • C:\Windows\system32\vssvc.exe
                                      C:\Windows\system32\vssvc.exe
                                      1⤵
                                      • Checks SCSI registry key(s)
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3804
                                    • C:\Windows\system32\srtasks.exe
                                      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1344

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                            Filesize

                                            2KB

                                            MD5

                                            88dc70c361a22feac57b031dd9c1f02f

                                            SHA1

                                            a9b4732260c2a323750022a73480f229ce25d46d

                                            SHA256

                                            43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

                                            SHA512

                                            19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            64B

                                            MD5

                                            5caad758326454b5788ec35315c4c304

                                            SHA1

                                            3aef8dba8042662a7fcf97e51047dc636b4d4724

                                            SHA256

                                            83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

                                            SHA512

                                            4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3xavvjip.bda.ps1

                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                          • memory/2076-0-0x00007FFC74B53000-0x00007FFC74B55000-memory.dmp

                                            Filesize

                                            8KB

                                          • memory/2076-1-0x000001DB56B40000-0x000001DB56B62000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/2076-10-0x00007FFC74B50000-0x00007FFC75612000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/2076-11-0x00007FFC74B50000-0x00007FFC75612000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/2076-12-0x00007FFC74B50000-0x00007FFC75612000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/2076-15-0x00007FFC74B50000-0x00007FFC75612000-memory.dmp

                                            Filesize

                                            10.8MB