Overview
overview
9Static
static
7HBCD/WinTo...ip.bat
windows7-x64
7HBCD/WinTo...ip.bat
windows10-2004-x64
7HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
9HBCD/WinTo...ns.bat
windows7-x64
7HBCD/WinTo...ns.bat
windows10-2004-x64
7HBCD/WinTo...un.exe
windows7-x64
7HBCD/WinTo...un.exe
windows10-2004-x64
7HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7HBCD/WinTo...Uz.bat
windows7-x64
7HBCD/WinTo...Uz.bat
windows10-2004-x64
7HBCD/WinTo...ts.bat
windows7-x64
7HBCD/WinTo...ts.bat
windows10-2004-x64
9HBCD/WinTo...ix.exe
windows7-x64
9HBCD/WinTo...ix.exe
windows10-2004-x64
9HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7HBCD/WinTo...mp.bat
windows7-x64
7HBCD/WinTo...mp.bat
windows10-2004-x64
7HBCD/WinTo...NT.exe
windows7-x64
7HBCD/WinTo...NT.exe
windows10-2004-x64
7HBCD/WinTo...ix.bat
windows7-x64
7HBCD/WinTo...ix.bat
windows10-2004-x64
7HBCD/WinTo...un.bat
windows7-x64
1HBCD/WinTo...un.bat
windows10-2004-x64
1HBCD/WinTo...es.bat
windows7-x64
1HBCD/WinTo...es.bat
windows10-2004-x64
1HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7Analysis
-
max time kernel
42s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 06:36
Behavioral task
behavioral1
Sample
HBCD/WinTools/7Zip.bat
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
HBCD/WinTools/7Zip.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
HBCD/WinTools/AsteriskLogger.bat
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
HBCD/WinTools/AsteriskLogger.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
HBCD/WinTools/AutoRuns.bat
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
HBCD/WinTools/AutoRuns.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
HBCD/WinTools/Autorun.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
HBCD/WinTools/Autorun.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
HBCD/WinTools/CCleaner.bat
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
HBCD/WinTools/CCleaner.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
HBCD/WinTools/CPUz.bat
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
HBCD/WinTools/CPUz.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
HBCD/WinTools/CPorts.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
HBCD/WinTools/CPorts.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
HBCD/WinTools/ComboFix.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
HBCD/WinTools/ComboFix.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
HBCD/WinTools/ContentAdvisorPasswordRemover.bat
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
HBCD/WinTools/ContentAdvisorPasswordRemover.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
HBCD/WinTools/CoolWebSearch_Remover.bat
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
HBCD/WinTools/CoolWebSearch_Remover.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
HBCD/WinTools/DTemp.bat
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
HBCD/WinTools/DTemp.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
HBCD/WinTools/DefragNT.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
HBCD/WinTools/DefragNT.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
HBCD/WinTools/DialAFix.bat
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
HBCD/WinTools/DialAFix.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
HBCD/WinTools/DisableAutorun.bat
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
HBCD/WinTools/DisableAutorun.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
HBCD/WinTools/DisableCompressOldFiles.bat
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
HBCD/WinTools/DisableCompressOldFiles.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
HBCD/WinTools/DoubleDriver.bat
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
HBCD/WinTools/DoubleDriver.bat
Resource
win10v2004-20240508-en
General
-
Target
HBCD/WinTools/CPUz.bat
-
Size
87B
-
MD5
e73eb157659ef46d72009227c3272a3f
-
SHA1
504a463baf84aee01becd7ac0296e66c9caa3877
-
SHA256
b24d59a8861da7c9439138fbf84883a76e03dd00c494fccf30d73a86218e41d4
-
SHA512
91bbd67f8c964049604cad10dbac67a79258d90d7c4d04114084f6ffb8d0ae0f3556ff06dae6c991843f20a5ca7fad6e714b7fce7aedeab526dfc40c2e2ef319
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
cpuz.exepid process 1728 cpuz.exe -
Processes:
resource yara_rule behavioral12/memory/4172-0-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral12/memory/4172-10-0x0000000000400000-0x000000000047D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.execpuz.exedescription pid process target process PID 4512 wrote to memory of 4172 4512 cmd.exe uharc.exe PID 4512 wrote to memory of 4172 4512 cmd.exe uharc.exe PID 4512 wrote to memory of 4172 4512 cmd.exe uharc.exe PID 4512 wrote to memory of 1728 4512 cmd.exe cpuz.exe PID 4512 wrote to memory of 1728 4512 cmd.exe cpuz.exe PID 4512 wrote to memory of 1728 4512 cmd.exe cpuz.exe PID 1728 wrote to memory of 3912 1728 cpuz.exe pcaui.exe PID 1728 wrote to memory of 3912 1728 cpuz.exe pcaui.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HBCD\WinTools\CPUz.bat"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HBCD\uharc.exe..\uharc.exe x -t"C:\Users\Admin\AppData\Local\Temp" -y+ files\cpuz.uha2⤵
-
C:\Users\Admin\AppData\Local\Temp\cpuz.exe"C:\Users\Admin\AppData\Local\Temp\cpuz.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\pcaui.exe"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {5fbd2b3e-95b1-42e7-9c39-bc25d0f4fb06} -a "CPUID CPU-Z" -v "CPUID" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 0 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\cpuz.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cpuz.exeFilesize
1.5MB
MD53a42aca239b8a27920534cda277c03c3
SHA1b9b94a592dcadc5248da8e9cf7ef4e5af213b93d
SHA256f9710d837a26020c8883712606aa38e13be3c42606f46ac16aefedf0454b1877
SHA5125d9b459cee340b181a5459ce09194d06a30a60f1fa9358191f43d5b8b47704617304616515ed148caa41b1eb2b74c9015f140810ca3e33480175af3cb7d28dc7
-
memory/4172-0-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/4172-10-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB