Overview

overview

9

Static

static

9

tox tweaki...or.exe

windows11-21h2-x64

1

tox tweaki...or.exe

windows11-21h2-x64

1

tox tweaki...CK.exe

windows11-21h2-x64

9

tox tweaki...ew.exe

windows11-21h2-x64

6

tox tweaki...up.exe

windows11-21h2-x64

1

tox tweaki...8.appx

windows11-21h2-x64

1

Microsoft.UI.Xaml.dll

windows11-21h2-x64

1

Microsoft.UI.Xaml.dll

windows11-21h2-x64

1

tox tweaki...up.exe

windows11-21h2-x64

8

tox tweaki...LG.exe

windows11-21h2-x64

1

tox tweaki...el.exe

windows11-21h2-x64

1

tox tweaki...un.exe

windows11-21h2-x64

3

Export.bat

windows11-21h2-x64

1

Import.bat

windows11-21h2-x64

1

SCEWIN_64.exe

windows11-21h2-x64

1

amifldrv64.sys

windows11-21h2-x64

1

amigendrv64.sys

windows11-21h2-x64

1

tox tweaki...64.exe

windows11-21h2-x64

1

tox tweaki...CL.exe

windows11-21h2-x64

1

tox tweaki...64.exe

windows11-21h2-x64

7

tox tweaki...64.sys

windows11-21h2-x64

1

tox tweaki...64.sys

windows11-21h2-x64

1

tox tweaki...vc.exe

windows11-21h2-x64

1

CRU/CRU.exe

windows11-21h2-x64

3

CRU/reset-all.exe

windows11-21h2-x64

3

CRU/restart.exe

windows11-21h2-x64

5

CRU/restart64.exe

windows11-21h2-x64

5

tox tweaki...on.exe

windows11-21h2-x64

1

Export.bat

windows11-21h2-x64

3

tox tweaki...ll.exe

windows11-21h2-x64

7

tox tweaki...xp.exe

windows11-21h2-x64

8

tox tweaki...tr.exe

windows11-21h2-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/11/2024, 14:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tox tweaking/niggers/openshell.exe
  • Size 7.9MB
  • Sample241108-sblntavank
  • SHA256 31e616f27fad0c9b14a22c02ded2dc524411abf53d72c4136f22db1be0156865
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoverypersistenceprivilege_escalationstealer

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 41 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\openshell.exe
    "C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\openshell.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /i "C:\ProgramData\OpenShellSetup64_4_4_190.msi"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2604
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2552
      • C:\Windows\syswow64\MsiExec.exe
        "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\Open-Shell\ClassicExplorer32.dll"
        2⤵
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:4528
      • C:\Windows\System32\MsiExec.exe
        "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Open-Shell\ClassicExplorer64.dll"
        2⤵
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:2968
      • C:\Windows\syswow64\MsiExec.exe
        "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\StartMenuHelper32.dll"
        2⤵
        • Loads dropped DLL
        • Modifies system executable filetype association
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1576
      • C:\Windows\System32\MsiExec.exe
        "C:\Windows\System32\MsiExec.exe" /Y "C:\Windows\system32\StartMenuHelper64.dll"
        2⤵
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4652
      • C:\Program Files\Open-Shell\StartMenu.exe
        "C:\Program Files\Open-Shell\StartMenu.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2708
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4192
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:4124

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Browser Extensions

          1
          T1176

          Event Triggered Execution

          2
          T1546

          Change Default File Association

          1
          T1546.001

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Change Default File Association

          1
          T1546.001

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          4
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e57fa20.rbs
          • Path C:\Config.Msi\e57fa20.rbs
          • Size 20KB
          • SHA256 aa0a59364983f6b7f5bfb02feaa374af6f6517b5b39e8a2d8fdfe183177de655
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ClassicExplorer32.dll
          • Path C:\Program Files\Open-Shell\ClassicExplorer32.dll
          • Size 863KB
          • SHA256 ba769f3ac5d06433babf0c260f9e6178834ebdad5bbd43bcdabe5ca3ea140d77
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ClassicExplorer64.dll
          • Path C:\Program Files\Open-Shell\ClassicExplorer64.dll
          • Size 964KB
          • SHA256 9c52a38e89a954d9e200fcd3a8b29fa92dd0239945902b817732e45c3a216f1f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ExplorerL10N.ini
          • Path C:\Program Files\Open-Shell\ExplorerL10N.ini
          • Size 98KB
          • SHA256 b351158059f3d94c112863defad9063c5cdb81dea0b47530809ef4d8de4b68ab
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Start Menu Settings.lnk
          • Path C:\Program Files\Open-Shell\Start Menu Settings.lnk
          • Size 1KB
          • SHA256 50c2f6f5db017b37ca6723686c7ec179dddff386da8997b2d052f2d331f620fe
          • MD5 SHA1 SHA512
          Submit Download

          Start Menu Settings.lnk~RFe57fc52.TMP
          • Path C:\Program Files\Open-Shell\Start Menu Settings.lnk~RFe57fc52.TMP
          • Size 1KB
          • SHA256 48e2e6aac16e91fbe4398117d1cbd70453beb9f76e4bec48ad4b8b00a541d483
          • MD5 SHA1 SHA512
          Submit Download

          Start Screen.lnk
          • Path C:\Program Files\Open-Shell\Start Screen.lnk
          • Size 1KB
          • SHA256 aef790d9a3965418cd943c8d7659254ebde36a873ae26edd4498227753d49823
          • MD5 SHA1 SHA512
          Submit Download

          Start Screen.lnk
          • Path C:\Program Files\Open-Shell\Start Screen.lnk
          • Size 2KB
          • SHA256 32caee90aebba381dd7fac40330ac8e571a229a3895791160b26f6f3e0d49df3
          • MD5 SHA1 SHA512
          Submit Download

          Start Screen.lnk
          • Path C:\Program Files\Open-Shell\Start Screen.lnk
          • Size 2KB
          • SHA256 52fc2bf080040b906f9a4b40bd22ed8e139359e42174c1785f013871851de019
          • MD5 SHA1 SHA512
          Submit Download

          Start Screen.lnk~RFe57fc52.TMP
          • Path C:\Program Files\Open-Shell\Start Screen.lnk~RFe57fc52.TMP
          • Size 1KB
          • SHA256 e082f4570256edc5c29a71195ff563fb9540edd137e15816666ecc3bd73c3b12
          • MD5 SHA1 SHA512
          Submit Download

          StartMenu.exe
          • Path C:\Program Files\Open-Shell\StartMenu.exe
          • Size 259KB
          • SHA256 08f505b325a67b61eb997cd45d61fb04851b6e6477110739a7cfc1ef5d290fae
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          StartMenuDLL.dll
          • Path C:\Program Files\Open-Shell\StartMenuDLL.dll
          • Size 2.7MB
          • SHA256 3a2898c5a1c71c42a95583ccd2ad72e30f43d815b3da3452b3d245ba5c0aa1e5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          StartMenuHelperL10N.ini
          • Path C:\Program Files\Open-Shell\StartMenuHelperL10N.ini
          • Size 11KB
          • SHA256 53cafbc10e671b2885775dc7d7b66e93156a4fb661aee95e03c2dd74ea99fa84
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          StartMenuL10N.ini
          • Path C:\Program Files\Open-Shell\StartMenuL10N.ini
          • Size 286KB
          • SHA256 ff4ba6dc92215a59e2d84e2ec489bb5cdc3b3799f08d83a0b27639117e25ce33
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Classic Explorer Settings.lnk~RFe57fc32.TMP
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Classic Explorer Settings.lnk~RFe57fc32.TMP
          • Size 1KB
          • SHA256 8ae9d0ee7884564160f5fea841276e180888f59c9e2f6a2233bf3d7ae4c44b78
          • MD5 SHA1 SHA512
          Submit Download

          Open-Shell Menu Settings.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Menu Settings.lnk
          • Size 1KB
          • SHA256 af6538484093c0cd2e5521bdc516400806a888afbcf82ace8a482b93d5d7265c
          • MD5 SHA1 SHA512
          Submit Download

          Open-Shell Menu Settings.lnk~RFe57fc42.TMP
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Menu Settings.lnk~RFe57fc42.TMP
          • Size 1KB
          • SHA256 ee82805563dc448be0b00ab94b5c2b5d32a4016c1887e2ae4e9d5acf9268b029
          • MD5 SHA1 SHA512
          Submit Download

          Open-Shell Update.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Update.lnk
          • Size 1KB
          • SHA256 205e91ed199eddb1d4d9019f1627d3af222f6c0fe25315a78c4009ad7104a15d
          • MD5 SHA1 SHA512
          Submit Download

          Open-Shell Update.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Update.lnk
          • Size 1KB
          • SHA256 009cde3813240f22eb47821b27e5b87e52f58b4b54c439a128784c29bf0da653
          • MD5 SHA1 SHA512
          Submit Download

          Open-Shell Update.lnk~RFe57fbf4.TMP
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Update.lnk~RFe57fbf4.TMP
          • Size 1KB
          • SHA256 d8adb9fe6ef74affbc2abddbaa6d5400cf5f74df2d402eaa465a7f79ec05d75a
          • MD5 SHA1 SHA512
          Submit Download

          ~lassic Explorer Settings.tmp
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\~lassic Explorer Settings.tmp
          • Size 1KB
          • SHA256 5340d65c9b67531d5a4e90d234da33c409f8842477ea47fcc9e4ae04881e8e68
          • MD5 SHA1 SHA512
          Submit Download

          OpenShellSetup64_4_4_190.msi
          • Path C:\ProgramData\OpenShellSetup64_4_4_190.msi
          • Size 5.3MB
          • SHA256 7a22d669ffdd65e71c15f517af6c8013931a61e6da67b5642604fef61038e85e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          StartMenuHelper32.dll
          • Path C:\Windows\SysWOW64\StartMenuHelper32.dll
          • Size 350KB
          • SHA256 4677b065ed62539047f893f96691ae07570b1ac7c2172c6705c053ba6f75a277
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          StartMenuHelper64.dll
          • Path C:\Windows\System32\StartMenuHelper64.dll
          • Size 426KB
          • SHA256 84782c13c8d9fc68c2e86c204c2be99b846e39824096f64dd06b578841467d65
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.6MB
          • SHA256 885d1fb6a6ad0f7e9fca4398f98701b7fb7a51643bb6abde6ca705d0f7d30cda
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {ba5c64ac-94a0-406c-9d52-92ab82c340d5}_OnDiskSnapshotProp
          • Path \??\Volume{4627e397-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ba5c64ac-94a0-406c-9d52-92ab82c340d5}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 e528e1522270804a5e5d948217fcac95d4372224bc49b24d0103e18f00dada85
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download