f45bcf726922fe01b71eb17cdaea8fcea57bdeefced3054e118732a41805f15f

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08/11/2024, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CRU/restart.exe
Size 63KB
Sample241108-sblntavank
SHA256 b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
MD5 8242ce426ad462eff02edae1487a6949
SHA1 9a4f382d427e0de729053535aaa3310cac5f087b
SHA512 aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
SSDEEP 768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	restart.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: 33	3908	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3908	AUDIODG.EXE
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe
Token: SeLoadDriverPrivilege	948	restart64.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe
948	restart64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 948	2944	restart.exe	77
PID 2944 wrote to memory of 948	2944	restart.exe	77

C:\Users\Admin\AppData\Local\Temp\CRU\restart.exe
"C:\Users\Admin\AppData\Local\Temp\CRU\restart.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe
  restart64.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:948

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:5036

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 148KB
SHA256 4e4e1300a939cc5d58d0c6914410d5ad8eaf876571011fa1c6f0ce27bf59822d
MD5 6e71c59a539ba8c2d46c4c8f478edf8c
SHA1 868558341297d83b247f8be13b375541eb58b886
SHA512 1a86ab970d99430334ba14cc14d75cb902f267e9e15019afcb64400ec6e4335adae3687a5916ccfec5fd0c82c89bfeeac2aed0c6aad693f35e7326f8fb158f9e
SSDEEP 3072:wb+j2tTPhtqHM8NgVbGc1h9IJO3I+/eOM2pWpry/WmRKpgJVC6vBGA1:XgJVCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 153KB
SHA256 53d617778c1ba174c22b47fd2d84035aa28c58bdcab6c3f3224f3777d1d8e7ee
MD5 6c65a113c1d1dcbc5f7603db0134dcb7
SHA1 1eb93cc7aeb12860b63129a69b812b694748a816
SHA512 67c438c141f7d6509db1d0bb17b312b66be8947a623580cc49fcb3000f7e402dda856ab1d422a68bbb25392d00902fef2bd31ce9cc491769205cdd7b31edf605
SSDEEP 3072:XLx1hD5Jz3qFg2pWprycWTjKZLJVjjvhe0W:lLJVjO
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 147KB
SHA256 af503f9b58bc5975fc609c95c2edad09adb32c5633859516350546031e05b0ca
MD5 ae40b57742832ddaf4efe6bee70ecb10
SHA1 ebc87ac614bdf44249300e73018686da5c31d7e3
SHA512 6c875bfabbe94359fe36eb144a5a9828d6c9d20c5999149df0aaacc4c9be748b5b6bab4639c7ef9d7bb4886073771d7b73ea1190dac61b5220c5f852ef101e3c
SSDEEP 3072:SkDp3Z1hu/JK3XKG2pWpryGW1EKWGJVRoRvImg:SwGJVRd
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 146KB
SHA256 ba0f96d41b93fc7eeda6bf74a24291d50281ea66c6c1af140c7c527911b2aff9
MD5 856012ea58e361f0f04f88e6fa29ae3a
SHA1 8866aca13626d450eb65b12a86fde1cf2ff6d94d
SHA512 8cc8831ef97f0e51dbf17c8f2c2fb74ef82f157fb1735fe1e76b35333d71bcd279394bdc249286a376281f4f5830a7bf92b405ac3dbb0762e84a0780526e9887
SSDEEP 3072:0A67APDh1h9EJ53umw2pWprysWLDK7fJV65+gf80:PfJV6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc011.dat

Path C:\Windows\System32\perfc011.dat
Size 126KB
SHA256 26ee1d72642d1d79b307581e6027a259696d5e3299d9d6685153a68b8c58b61b
MD5 5afbd30597a275ad6d5e98187742c01b
SHA1 4e9a82a388532a0fcb3671047504384e040b48a1
SHA512 6d2514d6a12809a7db4901b586b57e03b6e5b0cc4ecd1baeb4f5188ca033773f7ca077fa8e8beadcf82724fd16d9136c0fc252a0163b71a0ff0eae3363f2c0cf
SSDEEP 3072:XJWO1h5/JN33o2tAIO2pWpryjWo3KvoJVVJBfYip:EoJVVb
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 724KB
SHA256 d1b8be34dfdff53435bcd3f176f7aa9f17aa8f1145c42edee1ed1eec9faf02b2
MD5 3bd8043ff69087c78cf81f0aa082664f
SHA1 c669871201f05f6153dfa3f6a78d4609d818568e
SHA512 a51d2bb5641aaff1ab091a1c331b6e515bb333d2dfa9f09662d35b2315e6fbd14932102167075cd8bdacf7c8f57fe7313f7b1639090070851c2ecf7662384d6d
SSDEEP 3072:MhpwBxTEsmVdx1wN8EBNjcbg+hSILPDtzcSx2A8q1JuqaB32rSrSQYCxly/2dj9p:W3ddwzjNHX
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 686KB
SHA256 a0ae9b96680526dd73b3469504eaeb3882c655e3f4557b9e120de1ddd8edb834
MD5 efeeda97e31eb12669293d78feaff451
SHA1 f3680730a9ed165f49be4a2b1be8477196f15afb
SHA512 452da0e9a2c17de87d5a0db150acf299310d684c50c4f16daa5f1c298267d76d990000a0bf4e5ffb2afe5769e74bfcdf351e8d68b933a432a9130cdcdd81f1b2
SSDEEP 3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHXOZocUqYm3MEnBeHsZhgX3eTxg5o/3ZdOm:78M6d0/OZLMbjNOCm
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 770KB
SHA256 26ff30f2296fe28893dbfae42c4a702f7c8935d04ff4a42fb96fc8a92c6f2e5d
MD5 89960dfe2687d730daf52de34d2eb15c
SHA1 12f26da7ede572765e1b26cd08753ed39cc62ca6
SHA512 e9d6a576b8aa1eaefd4afff6ee417b0ba6aa58f8b133afe32738e23255bada5c163e2287ff1cef03fe1645088dcd4c2bd6b3bd2364772eec447554bf2072edb2
SSDEEP 3072:o2xx7F17Fetjvtx1tT3JCF86nceg1ncBLOAv9Dy2Ym3vfKBNQyLLhGPy/+583TXE:+tjvtx1tT5SnyncBLOA5yQyLCt1ZjNAA
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 772KB
SHA256 f7aed0dbe8b5a73416dca6b1cd1024ba31244bbabebe79a90edcda383cb8399d
MD5 4fa344b5f9b3efdf965f7d9f32abd9ee
SHA1 dd884d88f8b0310147a08f66b253d4bec8727c0f
SHA512 1a952aae612a9f72c252b870d121a0c9d52e66e509214ae03f560abacd6a02cc62e39c03753b25e017bdd65905b99f9f67e4e67bb49355dde9b45708324ddb33
SSDEEP 3072:8seo6JpGytgViPIny4auTsQy2XQDIefsnnSRfERwpZRVDNtflhzKysdD4hqa1bYo:gTGgqaB2LAXNWTjNuX
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 772KB
SHA256 c70b892d93e93c37c826ba97459e8fb724e6c5cf6dc2288613430fc59c0c1eb0
MD5 a583c28c05f94a635bd67fee2d905a27
SHA1 a4af858c69297cb8a59cade7da6e5a36b43e7548
SHA512 06626f291b69e044e8e44fa46576c0287e4df434cd07b0bdb1b162fed25ddef652e5ad8d08d984f2d7d4c027c8ee032eef485f7269f0a83e11c1fa61f80a5d67
SSDEEP 3072:g+8gxXowjkUXx5E8d8tj/v9GLcr+cu8ov+pmPxIpzRa/rpdYm3ZBAdczUkhUCq7p:rYj/v9GLBopzgMdczU+qTMwH+jNV7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 468KB
SHA256 73174de99ccd45c2a8d818742ed313a55321186162005c0f2567e162954943a5
MD5 33cbb4d0e471fd527da2ded235fe9636
SHA1 aa9d9b062511eb38a1faf9a740f8fb709b02a7dd
SHA512 a4c17182347bc3c5cce76562f26b27ac62e84c8589dd91d2840a452b6c593656f3d3a2fd5b7f207f32be0f5a0494bc44987fb70e6e8f3a756a0703df20baa93f
SSDEEP 3072:ZZg3ID5H7gVmRw4T0z+3dczXEeYm3xBsah25o8/v/BLiaj01s3jxrfBY4ftu9Oaz:Tg33mRwZz+3dRy4jNWBb1
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApRpl.h

Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
Size 3KB
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
MD5 SHA1 SHA512

Submit Download

WmiApRpl.ini

Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Size 29KB
SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
MD5 ffdeea82ba4a5a65585103dd2a922dfe
SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a
SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
MD5 SHA1 SHA512 SSDEEP

Submit Download