Analysis
-
max time kernel
105s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 03:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CatSerialChecker.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
CatSerialChecker.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
CatSerialChecker.exe
-
Size
67KB
-
MD5
f357881daac93e98117c6b1efa94fa56
-
SHA1
e5c4070ffd47d699131cd877b883ea815b3211cc
-
SHA256
0593c8cc920d5a6084032e147d84184a99a462b9cdd6d1e8d42b9391d7611de5
-
SHA512
3a903142ec1d267b0da466d0d22f9a42cf388c79572444554921f73e5b5e20becda0b9c0f05f836d644a400562407c3a6d56a38981115a4ce12c503c0018cb6f
-
SSDEEP
768:v0harz9KDG4yX/HZp5I0I9Et1hiOT9RTw3AA:vdzQEX3+EtA
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 CatSerialChecker.exe -
Kills process with taskkill 4 IoCs
pid Process 3940 taskkill.exe 336 taskkill.exe 4560 taskkill.exe 5832 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3940 taskkill.exe Token: SeDebugPrivilege 336 taskkill.exe Token: SeDebugPrivilege 4560 taskkill.exe Token: SeDebugPrivilege 5832 taskkill.exe Token: SeIncreaseQuotaPrivilege 5552 WMIC.exe Token: SeSecurityPrivilege 5552 WMIC.exe Token: SeTakeOwnershipPrivilege 5552 WMIC.exe Token: SeLoadDriverPrivilege 5552 WMIC.exe Token: SeSystemProfilePrivilege 5552 WMIC.exe Token: SeSystemtimePrivilege 5552 WMIC.exe Token: SeProfSingleProcessPrivilege 5552 WMIC.exe Token: SeIncBasePriorityPrivilege 5552 WMIC.exe Token: SeCreatePagefilePrivilege 5552 WMIC.exe Token: SeBackupPrivilege 5552 WMIC.exe Token: SeRestorePrivilege 5552 WMIC.exe Token: SeShutdownPrivilege 5552 WMIC.exe Token: SeDebugPrivilege 5552 WMIC.exe Token: SeSystemEnvironmentPrivilege 5552 WMIC.exe Token: SeRemoteShutdownPrivilege 5552 WMIC.exe Token: SeUndockPrivilege 5552 WMIC.exe Token: SeManageVolumePrivilege 5552 WMIC.exe Token: 33 5552 WMIC.exe Token: 34 5552 WMIC.exe Token: 35 5552 WMIC.exe Token: 36 5552 WMIC.exe Token: SeIncreaseQuotaPrivilege 5552 WMIC.exe Token: SeSecurityPrivilege 5552 WMIC.exe Token: SeTakeOwnershipPrivilege 5552 WMIC.exe Token: SeLoadDriverPrivilege 5552 WMIC.exe Token: SeSystemProfilePrivilege 5552 WMIC.exe Token: SeSystemtimePrivilege 5552 WMIC.exe Token: SeProfSingleProcessPrivilege 5552 WMIC.exe Token: SeIncBasePriorityPrivilege 5552 WMIC.exe Token: SeCreatePagefilePrivilege 5552 WMIC.exe Token: SeBackupPrivilege 5552 WMIC.exe Token: SeRestorePrivilege 5552 WMIC.exe Token: SeShutdownPrivilege 5552 WMIC.exe Token: SeDebugPrivilege 5552 WMIC.exe Token: SeSystemEnvironmentPrivilege 5552 WMIC.exe Token: SeRemoteShutdownPrivilege 5552 WMIC.exe Token: SeUndockPrivilege 5552 WMIC.exe Token: SeManageVolumePrivilege 5552 WMIC.exe Token: 33 5552 WMIC.exe Token: 34 5552 WMIC.exe Token: 35 5552 WMIC.exe Token: 36 5552 WMIC.exe Token: SeIncreaseQuotaPrivilege 4572 WMIC.exe Token: SeSecurityPrivilege 4572 WMIC.exe Token: SeTakeOwnershipPrivilege 4572 WMIC.exe Token: SeLoadDriverPrivilege 4572 WMIC.exe Token: SeSystemProfilePrivilege 4572 WMIC.exe Token: SeSystemtimePrivilege 4572 WMIC.exe Token: SeProfSingleProcessPrivilege 4572 WMIC.exe Token: SeIncBasePriorityPrivilege 4572 WMIC.exe Token: SeCreatePagefilePrivilege 4572 WMIC.exe Token: SeBackupPrivilege 4572 WMIC.exe Token: SeRestorePrivilege 4572 WMIC.exe Token: SeShutdownPrivilege 4572 WMIC.exe Token: SeDebugPrivilege 4572 WMIC.exe Token: SeSystemEnvironmentPrivilege 4572 WMIC.exe Token: SeRemoteShutdownPrivilege 4572 WMIC.exe Token: SeUndockPrivilege 4572 WMIC.exe Token: SeManageVolumePrivilege 4572 WMIC.exe Token: 33 4572 WMIC.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2332 wrote to memory of 4836 2332 CatSerialChecker.exe 87 PID 2332 wrote to memory of 4836 2332 CatSerialChecker.exe 87 PID 4836 wrote to memory of 3940 4836 cmd.exe 88 PID 4836 wrote to memory of 3940 4836 cmd.exe 88 PID 2332 wrote to memory of 2492 2332 CatSerialChecker.exe 90 PID 2332 wrote to memory of 2492 2332 CatSerialChecker.exe 90 PID 2492 wrote to memory of 336 2492 cmd.exe 91 PID 2492 wrote to memory of 336 2492 cmd.exe 91 PID 2332 wrote to memory of 4248 2332 CatSerialChecker.exe 93 PID 2332 wrote to memory of 4248 2332 CatSerialChecker.exe 93 PID 4248 wrote to memory of 4560 4248 cmd.exe 94 PID 4248 wrote to memory of 4560 4248 cmd.exe 94 PID 2332 wrote to memory of 5788 2332 CatSerialChecker.exe 96 PID 2332 wrote to memory of 5788 2332 CatSerialChecker.exe 96 PID 5788 wrote to memory of 5832 5788 cmd.exe 97 PID 5788 wrote to memory of 5832 5788 cmd.exe 97 PID 2332 wrote to memory of 1440 2332 CatSerialChecker.exe 104 PID 2332 wrote to memory of 1440 2332 CatSerialChecker.exe 104 PID 1440 wrote to memory of 5552 1440 cmd.exe 105 PID 1440 wrote to memory of 5552 1440 cmd.exe 105 PID 2332 wrote to memory of 2560 2332 CatSerialChecker.exe 108 PID 2332 wrote to memory of 2560 2332 CatSerialChecker.exe 108 PID 2560 wrote to memory of 4572 2560 cmd.exe 109 PID 2560 wrote to memory of 4572 2560 cmd.exe 109 PID 2332 wrote to memory of 4776 2332 CatSerialChecker.exe 110 PID 2332 wrote to memory of 4776 2332 CatSerialChecker.exe 110 PID 4776 wrote to memory of 1228 4776 cmd.exe 111 PID 4776 wrote to memory of 1228 4776 cmd.exe 111 PID 2332 wrote to memory of 2604 2332 CatSerialChecker.exe 112 PID 2332 wrote to memory of 2604 2332 CatSerialChecker.exe 112 PID 2604 wrote to memory of 2388 2604 cmd.exe 113 PID 2604 wrote to memory of 2388 2604 cmd.exe 113 PID 2332 wrote to memory of 3312 2332 CatSerialChecker.exe 114 PID 2332 wrote to memory of 3312 2332 CatSerialChecker.exe 114 PID 3312 wrote to memory of 2056 3312 cmd.exe 115 PID 3312 wrote to memory of 2056 3312 cmd.exe 115 PID 2332 wrote to memory of 2044 2332 CatSerialChecker.exe 116 PID 2332 wrote to memory of 2044 2332 CatSerialChecker.exe 116 PID 2044 wrote to memory of 6112 2044 cmd.exe 117 PID 2044 wrote to memory of 6112 2044 cmd.exe 117 PID 2332 wrote to memory of 1812 2332 CatSerialChecker.exe 118 PID 2332 wrote to memory of 1812 2332 CatSerialChecker.exe 118 PID 1812 wrote to memory of 3672 1812 cmd.exe 119 PID 1812 wrote to memory of 3672 1812 cmd.exe 119 PID 2332 wrote to memory of 2960 2332 CatSerialChecker.exe 121 PID 2332 wrote to memory of 2960 2332 CatSerialChecker.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\CatSerialChecker.exe"C:\Users\Admin\AppData\Local\Temp\CatSerialChecker.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmiprv* /f /t 2>nul>nul2⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\system32\taskkill.exetaskkill /im wmiprv* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmiprv* /f /t 2>nul>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\system32\taskkill.exetaskkill /im wmiprv* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmiprv* /f /t 2>nul>nul2⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\system32\taskkill.exetaskkill /im wmiprv* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmiprv* /f /t 2>nul>nul2⤵
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\system32\taskkill.exetaskkill /im wmiprv* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get manufacturer2⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber3⤵PID:1228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic csproduct get uuid2⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵PID:2388
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic bios get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵PID:2056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic memorychip get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\System32\Wbem\WMIC.exewmic memorychip get serialnumber3⤵PID:6112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c getmac2⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\system32\getmac.exegetmac3⤵PID:3672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:2960
-