Analysis
-
max time kernel
70s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
01/04/2025, 15:46
General
-
Target
CCleaner64.exe
-
Size
43.8MB
-
MD5
f116a86b8e6235cc551f30e1559d8d1d
-
SHA1
0f5fd9e2d38068d58c222b6a78a7171a419e0575
-
SHA256
c3897cae08e39f70508d372e8e60b99da4490ae09139da8199a5ba70ab254725
-
SHA512
14293608ec71b50ab875421cd3cb37006957e03aae54c95131a6c212f95e11fb3120a9024e99ad9dce9d3e6feffe9e98fac6bc80cb3a6bd3cc971ccd4485c0a0
-
SSDEEP
393216:qWtZTh5KxtGKB29mUXV+OJzZU59yx2i57CszyrQxZh6V4/rqNwp3JP+R4XjXhSpK:qWDh5K2n57rqQoiJP+R4zXs1K
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 8 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
-
Drops file in Windows directory 25 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CCleaner64.exe"C:\Users\Admin\AppData\Local\Temp\CCleaner64.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Windows directory
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5e456fcad0caa8d2c1713085a1fa6a9e8
SHA16f870a4bb91b436dbe98beb96a4910256fcf3642
SHA25672ead5e24a1047427ebb2e129e21a13ae6e79d56ad659507811df6c1910c0e3d
SHA51221ce37a22a760593ae8053d019102e09ac76a7b4f7484c94821c0b6e5a29f78d5f73c3593f01e8e1b37b08a7933a4a014a5e04ab275391b90b481c4b95fd3d2f
-
Filesize
512KB
MD5e61f5abd89a3372fa131928e7de4ff47
SHA1de25aa8e349828514d894dab38bb9989e0d0dd16
SHA2568272405f12e8a733112e937ec684a2c27d35725d9196c9d8b4129ba1f537b294
SHA51209367f92059d9a81504db4403ee18c5bdcad63b6c149129fdb79db1c90eb29568f4c6f5a4922e6de57de20cb1e60430d76890e67084d4d0885eac51e5f73f8a8
-
Filesize
14.0MB
MD5a49cd0330dbaff51a5af8b298cd500e8
SHA18d5ef47805c4268d2f8fdc13ab238c2ac1bbae71
SHA2568f8bb1b9f9042f629ca7c51a040a69ab5ad41582fbd5aef8a41d6551b7c5bc46
SHA512ce0ea277a04b1b275e6edf2b34b686789e1137b8380554031ab4b444d4d60a9b1c36aa877404e469d7e9463c635316aca2dcc78738b50d7b812b4963a2da200d
-
Filesize
14.0MB
MD5776e186c2e770e31acb58d22a4dc5b8d
SHA143505d748870752dc135d34924d60fb375e8d271
SHA256cbe1bdc06e902245eee9b7c10cc39037fbf4037fdc3fffba7e69003a1e84b62a
SHA51291ded9cef3c8c2197a612c4f9a086622042fc66ce5840630048eda2ea01ec5d205aa9c5ac16b0c610b8e7afe05b465bf9d575e806d71d259fad9ad87f07cacb8
-
Filesize
14.0MB
MD51bd01e272816242f8433a1a5a2575023
SHA181e03a06ac1cf10d3499b3e0b3ae53188bb04479
SHA256a06d285e2d5de432be77146555ff195d53861ca8ce5bb9c8794b92505de62b8c
SHA51299d99cf3d5c687e201da259ec3253b5088f650236ffa9a59746c4426c8ed3041cadd16e724f07216591dad922b2f168d656568e209724578c0e88d6e08ba41ee
-
Filesize
16KB
MD58f06a75aaca7f44074cc4642402247e3
SHA1f38fbe47f0708a88732baf06b04447169945e9fb
SHA256d4817de9865f2edf5344510cc4903e62b3cf445fb2fd0eb4936d151af0265deb
SHA512c4dc16f14a30298c6f75aa037d959c597c97d84144f3121916a1104d783f43c8e851d9272acb351b7f360f0d1740ee8b67e63f117bb74e65afa83f94199aece9
-
Filesize
740KB
MD5f17f96322f8741fe86699963a1812897
SHA1a8433cab1deb9c128c745057a809b42110001f55
SHA2568b6ce3a640e2d6f36b0001be2a1abb765ae51e62c314a15911e75138cbb544bb
SHA512f10586f650a5d602287e6e7aeeaf688b275f0606e20551a70ea616999579acdf7ea2f10cebcfaa817dae4a2fc9076e7fa5b74d9c4b38878fbf590ffe0e7d81c9
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB