Analysis
-
max time kernel
17s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 03:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CatSerialChecker.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
CatSerialChecker.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
CatSerialChecker.exe
-
Size
67KB
-
MD5
f357881daac93e98117c6b1efa94fa56
-
SHA1
e5c4070ffd47d699131cd877b883ea815b3211cc
-
SHA256
0593c8cc920d5a6084032e147d84184a99a462b9cdd6d1e8d42b9391d7611de5
-
SHA512
3a903142ec1d267b0da466d0d22f9a42cf388c79572444554921f73e5b5e20becda0b9c0f05f836d644a400562407c3a6d56a38981115a4ce12c503c0018cb6f
-
SSDEEP
768:v0harz9KDG4yX/HZp5I0I9Et1hiOT9RTw3AA:vdzQEX3+EtA
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 CatSerialChecker.exe -
Kills process with taskkill 4 IoCs
pid Process 2772 taskkill.exe 1156 taskkill.exe 2344 taskkill.exe 2744 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2744 taskkill.exe Token: SeDebugPrivilege 2772 taskkill.exe Token: SeDebugPrivilege 1156 taskkill.exe Token: SeDebugPrivilege 2344 taskkill.exe Token: SeIncreaseQuotaPrivilege 2908 WMIC.exe Token: SeSecurityPrivilege 2908 WMIC.exe Token: SeTakeOwnershipPrivilege 2908 WMIC.exe Token: SeLoadDriverPrivilege 2908 WMIC.exe Token: SeSystemProfilePrivilege 2908 WMIC.exe Token: SeSystemtimePrivilege 2908 WMIC.exe Token: SeProfSingleProcessPrivilege 2908 WMIC.exe Token: SeIncBasePriorityPrivilege 2908 WMIC.exe Token: SeCreatePagefilePrivilege 2908 WMIC.exe Token: SeBackupPrivilege 2908 WMIC.exe Token: SeRestorePrivilege 2908 WMIC.exe Token: SeShutdownPrivilege 2908 WMIC.exe Token: SeDebugPrivilege 2908 WMIC.exe Token: SeSystemEnvironmentPrivilege 2908 WMIC.exe Token: SeRemoteShutdownPrivilege 2908 WMIC.exe Token: SeUndockPrivilege 2908 WMIC.exe Token: SeManageVolumePrivilege 2908 WMIC.exe Token: 33 2908 WMIC.exe Token: 34 2908 WMIC.exe Token: 35 2908 WMIC.exe Token: SeIncreaseQuotaPrivilege 2908 WMIC.exe Token: SeSecurityPrivilege 2908 WMIC.exe Token: SeTakeOwnershipPrivilege 2908 WMIC.exe Token: SeLoadDriverPrivilege 2908 WMIC.exe Token: SeSystemProfilePrivilege 2908 WMIC.exe Token: SeSystemtimePrivilege 2908 WMIC.exe Token: SeProfSingleProcessPrivilege 2908 WMIC.exe Token: SeIncBasePriorityPrivilege 2908 WMIC.exe Token: SeCreatePagefilePrivilege 2908 WMIC.exe Token: SeBackupPrivilege 2908 WMIC.exe Token: SeRestorePrivilege 2908 WMIC.exe Token: SeShutdownPrivilege 2908 WMIC.exe Token: SeDebugPrivilege 2908 WMIC.exe Token: SeSystemEnvironmentPrivilege 2908 WMIC.exe Token: SeRemoteShutdownPrivilege 2908 WMIC.exe Token: SeUndockPrivilege 2908 WMIC.exe Token: SeManageVolumePrivilege 2908 WMIC.exe Token: 33 2908 WMIC.exe Token: 34 2908 WMIC.exe Token: 35 2908 WMIC.exe Token: SeIncreaseQuotaPrivilege 2696 WMIC.exe Token: SeSecurityPrivilege 2696 WMIC.exe Token: SeTakeOwnershipPrivilege 2696 WMIC.exe Token: SeLoadDriverPrivilege 2696 WMIC.exe Token: SeSystemProfilePrivilege 2696 WMIC.exe Token: SeSystemtimePrivilege 2696 WMIC.exe Token: SeProfSingleProcessPrivilege 2696 WMIC.exe Token: SeIncBasePriorityPrivilege 2696 WMIC.exe Token: SeCreatePagefilePrivilege 2696 WMIC.exe Token: SeBackupPrivilege 2696 WMIC.exe Token: SeRestorePrivilege 2696 WMIC.exe Token: SeShutdownPrivilege 2696 WMIC.exe Token: SeDebugPrivilege 2696 WMIC.exe Token: SeSystemEnvironmentPrivilege 2696 WMIC.exe Token: SeRemoteShutdownPrivilege 2696 WMIC.exe Token: SeUndockPrivilege 2696 WMIC.exe Token: SeManageVolumePrivilege 2696 WMIC.exe Token: 33 2696 WMIC.exe Token: 34 2696 WMIC.exe Token: 35 2696 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2740 2876 CatSerialChecker.exe 31 PID 2876 wrote to memory of 2740 2876 CatSerialChecker.exe 31 PID 2876 wrote to memory of 2740 2876 CatSerialChecker.exe 31 PID 2740 wrote to memory of 2744 2740 cmd.exe 32 PID 2740 wrote to memory of 2744 2740 cmd.exe 32 PID 2740 wrote to memory of 2744 2740 cmd.exe 32 PID 2876 wrote to memory of 2948 2876 CatSerialChecker.exe 34 PID 2876 wrote to memory of 2948 2876 CatSerialChecker.exe 34 PID 2876 wrote to memory of 2948 2876 CatSerialChecker.exe 34 PID 2948 wrote to memory of 2772 2948 cmd.exe 36 PID 2948 wrote to memory of 2772 2948 cmd.exe 36 PID 2948 wrote to memory of 2772 2948 cmd.exe 36 PID 2876 wrote to memory of 2680 2876 CatSerialChecker.exe 38 PID 2876 wrote to memory of 2680 2876 CatSerialChecker.exe 38 PID 2876 wrote to memory of 2680 2876 CatSerialChecker.exe 38 PID 2680 wrote to memory of 1156 2680 cmd.exe 39 PID 2680 wrote to memory of 1156 2680 cmd.exe 39 PID 2680 wrote to memory of 1156 2680 cmd.exe 39 PID 2876 wrote to memory of 1456 2876 CatSerialChecker.exe 41 PID 2876 wrote to memory of 1456 2876 CatSerialChecker.exe 41 PID 2876 wrote to memory of 1456 2876 CatSerialChecker.exe 41 PID 1456 wrote to memory of 2344 1456 cmd.exe 42 PID 1456 wrote to memory of 2344 1456 cmd.exe 42 PID 1456 wrote to memory of 2344 1456 cmd.exe 42 PID 2876 wrote to memory of 1944 2876 CatSerialChecker.exe 44 PID 2876 wrote to memory of 1944 2876 CatSerialChecker.exe 44 PID 2876 wrote to memory of 1944 2876 CatSerialChecker.exe 44 PID 1944 wrote to memory of 2908 1944 cmd.exe 45 PID 1944 wrote to memory of 2908 1944 cmd.exe 45 PID 1944 wrote to memory of 2908 1944 cmd.exe 45 PID 2876 wrote to memory of 2920 2876 CatSerialChecker.exe 47 PID 2876 wrote to memory of 2920 2876 CatSerialChecker.exe 47 PID 2876 wrote to memory of 2920 2876 CatSerialChecker.exe 47 PID 2920 wrote to memory of 2696 2920 cmd.exe 48 PID 2920 wrote to memory of 2696 2920 cmd.exe 48 PID 2920 wrote to memory of 2696 2920 cmd.exe 48 PID 2876 wrote to memory of 1440 2876 CatSerialChecker.exe 49 PID 2876 wrote to memory of 1440 2876 CatSerialChecker.exe 49 PID 2876 wrote to memory of 1440 2876 CatSerialChecker.exe 49 PID 1440 wrote to memory of 2032 1440 cmd.exe 50 PID 1440 wrote to memory of 2032 1440 cmd.exe 50 PID 1440 wrote to memory of 2032 1440 cmd.exe 50 PID 2876 wrote to memory of 1120 2876 CatSerialChecker.exe 51 PID 2876 wrote to memory of 1120 2876 CatSerialChecker.exe 51 PID 2876 wrote to memory of 1120 2876 CatSerialChecker.exe 51 PID 1120 wrote to memory of 1736 1120 cmd.exe 52 PID 1120 wrote to memory of 1736 1120 cmd.exe 52 PID 1120 wrote to memory of 1736 1120 cmd.exe 52 PID 2876 wrote to memory of 2376 2876 CatSerialChecker.exe 53 PID 2876 wrote to memory of 2376 2876 CatSerialChecker.exe 53 PID 2876 wrote to memory of 2376 2876 CatSerialChecker.exe 53 PID 2376 wrote to memory of 3000 2376 cmd.exe 54 PID 2376 wrote to memory of 3000 2376 cmd.exe 54 PID 2376 wrote to memory of 3000 2376 cmd.exe 54 PID 2876 wrote to memory of 1744 2876 CatSerialChecker.exe 55 PID 2876 wrote to memory of 1744 2876 CatSerialChecker.exe 55 PID 2876 wrote to memory of 1744 2876 CatSerialChecker.exe 55 PID 1744 wrote to memory of 2396 1744 cmd.exe 56 PID 1744 wrote to memory of 2396 1744 cmd.exe 56 PID 1744 wrote to memory of 2396 1744 cmd.exe 56 PID 2876 wrote to memory of 472 2876 CatSerialChecker.exe 57 PID 2876 wrote to memory of 472 2876 CatSerialChecker.exe 57 PID 2876 wrote to memory of 472 2876 CatSerialChecker.exe 57 PID 472 wrote to memory of 1556 472 cmd.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\CatSerialChecker.exe"C:\Users\Admin\AppData\Local\Temp\CatSerialChecker.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmiprv* /f /t 2>nul>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\system32\taskkill.exetaskkill /im wmiprv* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmiprv* /f /t 2>nul>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\system32\taskkill.exetaskkill /im wmiprv* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmiprv* /f /t 2>nul>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\system32\taskkill.exetaskkill /im wmiprv* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmiprv* /f /t 2>nul>nul2⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\system32\taskkill.exetaskkill /im wmiprv* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get manufacturer2⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber3⤵PID:2032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic csproduct get uuid2⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵PID:1736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic bios get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵PID:3000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic memorychip get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\System32\Wbem\WMIC.exewmic memorychip get serialnumber3⤵PID:2396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c getmac2⤵
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\system32\getmac.exegetmac3⤵PID:1556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:2588
-