Overview

overview

7

Static

static

3

ccsetup639_slim.exe

windows10-2004-x64

6

ccsetup639_slim.exe

windows11-ltsc_2024-x64

7

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

$_86_/$_86...er.dll

windows10-2004-x64

3

$_86_/$_86...er.dll

windows11-ltsc_2024-x64

3

$_90_/$_90_/pfBL.dll

windows10-2004-x64

3

$_90_/$_90_/pfBL.dll

windows11-ltsc_2024-x64

3

CCUpdate.exe

windows10-2004-x64

3

CCUpdate.exe

windows11-ltsc_2024-x64

6

CCleaner.exe

windows10-2004-x64

6

CCleaner.exe

windows11-ltsc_2024-x64

6

CCleaner64.exe

windows10-2004-x64

6

CCleaner64.exe

windows11-ltsc_2024-x64

6

CCleanerBugReport.exe

windows10-2004-x64

6

CCleanerBugReport.exe

windows11-ltsc_2024-x64

6

CCleanerCrashDump.exe

windows10-2004-x64

1

CCleanerCrashDump.exe

windows11-ltsc_2024-x64

1

CCleanerDU.dll

windows10-2004-x64

1

CCleanerDU.dll

windows11-ltsc_2024-x64

1

CCleanerPe...er.dll

windows10-2004-x64

1

CCleanerPe...er.dll

windows11-ltsc_2024-x64

1

CCleanerPe...ce.exe

windows10-2004-x64

1

CCleanerPe...ce.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    ccsetup639_slim.exe
  • Size 80.8MB
  • Sample260724-wp8x2svgmb
  • SHA256 9222982ad7df508f72e16c63260b72fb8ce8922ad23ed4dfdcb0646191fab011
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencespywarestealertrojanupx

Malware Config

Targets

    • Target
      ccsetup639_slim.exe
    • Size 80.8MB
    • SHA256 9222982ad7df508f72e16c63260b72fb8ce8922ad23ed4dfdcb0646191fab011
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    bootkitdiscoverypersistencespywarestealerdefense_evasiontrojanupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Downloads MZ/PE file

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/INetC.dll
    • Size 23KB
    • SHA256 5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 7KB
    • SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $_86_/$_86_/ServiceUninstaller.dll
    • Size 497KB
    • SHA256 0b78d56aceefb4ff259660bd55bbb497ce29a5d60206b5d19d05e1442829e495
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      $_90_/$_90_/pfBL.dll
    • Size 13.7MB
    • SHA256 8afcf66963c31af70df79944fefaa2180f5a2cef055b53ec2f9a455488264c4f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      CCUpdate.exe
    • Size 3.3MB
    • SHA256 1e01ebe8c67a3a5e3bc8f7b6d4a0e3b7642e3199021295b9cbf26970f3c204ea
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoverybootkitpersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral17behavioral18
    • Target
      CCleaner.exe
    • Size 38.0MB
    • SHA256 eafac64763adb114ad3297754f635bd09458483c10c32d1f516d0ac7839e2193
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitdiscoverypersistence

    • Checks for any installed AV software in registry

    • Downloads MZ/PE file

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral19behavioral20
    • Target
      CCleaner64.exe
    • Size 43.9MB
    • SHA256 fbe66648197587bed784cebcdc5ef0334f74d09a1d324ce0e650d4ee43ce7096
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitdiscoverypersistencespywarestealer

    • Checks for any installed AV software in registry

    • Downloads MZ/PE file

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral21behavioral22
    • Target
      CCleanerBugReport.exe
    • Size 5.9MB
    • SHA256 3f7b9f2de3c43f2001870f5a934d64221b5545cf7e9828d660ae34b55cc6db9c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitpersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral23behavioral24
    • Target
      CCleanerCrashDump.exe
    • Size 3.4MB
    • SHA256 4f0ba84077ab9f6befb36dec3593f40b133cc86d253a23d7028eb35db919ee88
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      CCleanerDU.dll
    • Size 13.3MB
    • SHA256 f38a45d229b4301e10d06ab73b2a1fa1865e0cc776b698452493e1b7d5fc02b1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      CCleanerPerformanceOptimizer.dll
    • Size 13.0MB
    • SHA256 738beabc7b820b449cd697983940f2e7160e09ae8e8de5e623964cbeeb62bd55
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      CCleanerPerformanceOptimizerService.exe
    • Size 1.0MB
    • SHA256 13d9c7ed940d12eb81fc1d94e1ed63744e7848282d777425561a1be10588479b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

7
T1012

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

bootkitdiscoverypersistencespywarestealer
Score
6/10

behavioral2

bootkitdefense_evasiondiscoverypersistencespywarestealertrojanupx
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

bootkitdiscoverypersistence
Score
6/10

behavioral19

bootkitdiscoverypersistence
Score
6/10

behavioral20

bootkitdiscoverypersistence
Score
6/10

behavioral21

bootkitdiscoverypersistencespywarestealer
Score
6/10

behavioral22

bootkitdiscoverypersistencespywarestealer
Score
6/10

behavioral23

bootkitpersistence
Score
6/10

behavioral24

bootkitpersistence
Score
6/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10