Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 14:26
Behavioral task
behavioral1
Sample
Pc Fire.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pc Fire.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
Pc Fire.exe
-
Size
74KB
-
MD5
5869edd76793fdda010c3191d14a38af
-
SHA1
aacad694e1334c037e68db2201173a8347afff78
-
SHA256
9b1e17bfb91e74ba74e0b00fba0fa0c71316994cca8145207f3dd0f0e41f1ed5
-
SHA512
3a0cf7e4d6315ca2be833336f579d1d421d03dda2adcf5fc02ee8880bbb4251b8544528e5bc0c0598447dac49dd6dfb357f42b7bab55ecc792e6f82334091d82
-
SSDEEP
1536:fZno9xptw8VGHE1uWdas6vKPHvfpK3INcwqE49aSvwKxjzxt6e:f+bZPfpK3qDqP9aSvwKhzxtz
Score
10/10
Malware Config
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3176-1-0x0000000000340000-0x0000000000358000-memory.dmp disable_win_def behavioral2/files/0x0007000000023c60-19.dat disable_win_def -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 2 IoCs
resource yara_rule behavioral2/memory/3176-1-0x0000000000340000-0x0000000000358000-memory.dmp family_stormkitty behavioral2/files/0x0007000000023c60-19.dat family_stormkitty -
Stormkitty family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvidiaDValueOn = "C:\\Users\\Admin\\AppData\\Local\\NVIDIA Local Drivers\\DriversUpdateProcess_x64.exe" Pc Fire.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 checkip.dyndns.org -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3176 Pc Fire.exe Token: SeDebugPrivilege 3852 taskmgr.exe Token: SeSystemProfilePrivilege 3852 taskmgr.exe Token: SeCreateGlobalPrivilege 3852 taskmgr.exe Token: 33 3852 taskmgr.exe Token: SeIncBasePriorityPrivilege 3852 taskmgr.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe -
Suspicious use of SendNotifyMessage 58 IoCs
pid Process 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pc Fire.exe"C:\Users\Admin\AppData\Local\Temp\Pc Fire.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3852
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD55869edd76793fdda010c3191d14a38af
SHA1aacad694e1334c037e68db2201173a8347afff78
SHA2569b1e17bfb91e74ba74e0b00fba0fa0c71316994cca8145207f3dd0f0e41f1ed5
SHA5123a0cf7e4d6315ca2be833336f579d1d421d03dda2adcf5fc02ee8880bbb4251b8544528e5bc0c0598447dac49dd6dfb357f42b7bab55ecc792e6f82334091d82