Overview

overview

8

Static

static

3

ExplorerBl...ca.dll

windows11-21h2-x64

ExplorerBl...er.cmd

windows11-21h2-x64

7

ExplorerBl...ll.cmd

windows11-21h2-x64

8

Analysis

  • max time kernel
    1785s
  • max time network
    1458s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29-06-2024 11:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ExplorerBlurMica/Release/uninstall.cmd

  • Size

    297B

  • MD5

    d84e8b5fe4e5854bf299ed20f004264c

  • SHA1

    2ebabb73ef9af06c33ba1c8ce933ac83ef74f4be

  • SHA256

    ef3dc2f1b06d6268e658120376a0be63e22ad2bf51a216c4fe6575fc0adcaba3

  • SHA512

    b64e825a31fc1a1b9da740cb73f5cf4fc6c3ecae2b4163aa7a7c4d3afeca98c5543a48dcdfb75dc3bcbaced2699b3d4741f7fc0f3ece26d63630a3f1595f8b8a

Score
8/10
persistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ExplorerBlurMica\Release\uninstall.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Windows\system32\fsutil.exe
      fsutil dirty query C:
      2⤵
        PID:4776
      • C:\Windows\system32\regsvr32.exe
        regsvr32 /u "C:\Users\Admin\AppData\Local\Temp\ExplorerBlurMica\Release\ExplorerBlurMica.dll"
        2⤵
          PID:4456
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im explorer.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1028
        • C:\Windows\explorer.exe
          explorer.exe
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1920
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2640
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3300

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Active Setup

      1
      T1547.014

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Active Setup

      1
      T1547.014

      Defense Evasion

      Modify Registry

      2
      T1112

      Credential Access

      Discovery

      Query Registry

      4
      T1012

      Peripheral Device Discovery

      2
      T1120

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        Filesize

        14KB

        MD5

        0af8485806fb20d237974c659f85ce8f

        SHA1

        964fab801f3b607fbcaf04dffb63101242e1c8f3

        SHA256

        f798f90957c1e96069b70b4146d648e78f7cc527dbf3302a17bde7aa9fe456b9

        SHA512

        51d5cd1921a02f7129efa01b5430f94b9d4eac4902527208561b044cf06d01e51642e9928ac6d066992e29fbf5fceebf47a567f48cd01094b3308b2d0107b044

        Download Submit
      • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\F9VYNF5V\www.bing[1].xml
        Filesize

        17KB

        MD5

        0830bab858fbbcbbddf5a88c0e044ffd

        SHA1

        1681356c89453807404ee8256cf58ed42fd801a7

        SHA256

        359dd921b7db68034bbf9b6492e876c7e3bd11ee6068bb6ab0cd52cefcb4047c

        SHA512

        395157d558316e4c75345b6bee74323fc5530a00e4cdb4e3ed061f2217ba2dd3f721e1764fcf859e43f35d91de09a46414ae43169afe193607f474c51645a69e

        Download Submit
      • memory/3300-28-0x000001CDBEBA0000-0x000001CDBECA0000-memory.dmp
        Filesize

        1024KB

        Download
      • memory/3300-33-0x000001CDBEA00000-0x000001CDBEB00000-memory.dmp
        Filesize

        1024KB

        Download
      • memory/3300-55-0x000001CDE0180000-0x000001CDE0280000-memory.dmp
        Filesize

        1024KB

        Download
      • memory/3300-73-0x000001CDF11A0000-0x000001CDF11C0000-memory.dmp
        Filesize

        128KB

        Download
      • memory/3300-89-0x000001CDF2440000-0x000001CDF2540000-memory.dmp
        Filesize

        1024KB

        Download
      • memory/3300-122-0x000001CDF10B0000-0x000001CDF10D0000-memory.dmp
        Filesize

        128KB

        Download
      • memory/3300-124-0x000001CDF1950000-0x000001CDF1970000-memory.dmp
        Filesize

        128KB

        Download