Overview
overview
9Static
static
7HBCD/WinTo...ip.bat
windows7-x64
7HBCD/WinTo...ip.bat
windows10-2004-x64
7HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
9HBCD/WinTo...ns.bat
windows7-x64
7HBCD/WinTo...ns.bat
windows10-2004-x64
7HBCD/WinTo...un.exe
windows7-x64
7HBCD/WinTo...un.exe
windows10-2004-x64
7HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7HBCD/WinTo...Uz.bat
windows7-x64
7HBCD/WinTo...Uz.bat
windows10-2004-x64
7HBCD/WinTo...ts.bat
windows7-x64
7HBCD/WinTo...ts.bat
windows10-2004-x64
9HBCD/WinTo...ix.exe
windows7-x64
9HBCD/WinTo...ix.exe
windows10-2004-x64
9HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7HBCD/WinTo...mp.bat
windows7-x64
7HBCD/WinTo...mp.bat
windows10-2004-x64
7HBCD/WinTo...NT.exe
windows7-x64
7HBCD/WinTo...NT.exe
windows10-2004-x64
7HBCD/WinTo...ix.bat
windows7-x64
7HBCD/WinTo...ix.bat
windows10-2004-x64
7HBCD/WinTo...un.bat
windows7-x64
1HBCD/WinTo...un.bat
windows10-2004-x64
1HBCD/WinTo...es.bat
windows7-x64
1HBCD/WinTo...es.bat
windows10-2004-x64
1HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7Analysis
-
max time kernel
120s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 06:36
Behavioral task
behavioral1
Sample
HBCD/WinTools/7Zip.bat
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
HBCD/WinTools/7Zip.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
HBCD/WinTools/AsteriskLogger.bat
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
HBCD/WinTools/AsteriskLogger.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
HBCD/WinTools/AutoRuns.bat
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
HBCD/WinTools/AutoRuns.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
HBCD/WinTools/Autorun.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
HBCD/WinTools/Autorun.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
HBCD/WinTools/CCleaner.bat
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
HBCD/WinTools/CCleaner.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
HBCD/WinTools/CPUz.bat
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
HBCD/WinTools/CPUz.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
HBCD/WinTools/CPorts.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
HBCD/WinTools/CPorts.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
HBCD/WinTools/ComboFix.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
HBCD/WinTools/ComboFix.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
HBCD/WinTools/ContentAdvisorPasswordRemover.bat
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
HBCD/WinTools/ContentAdvisorPasswordRemover.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
HBCD/WinTools/CoolWebSearch_Remover.bat
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
HBCD/WinTools/CoolWebSearch_Remover.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
HBCD/WinTools/DTemp.bat
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
HBCD/WinTools/DTemp.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
HBCD/WinTools/DefragNT.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
HBCD/WinTools/DefragNT.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
HBCD/WinTools/DialAFix.bat
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
HBCD/WinTools/DialAFix.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
HBCD/WinTools/DisableAutorun.bat
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
HBCD/WinTools/DisableAutorun.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
HBCD/WinTools/DisableCompressOldFiles.bat
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
HBCD/WinTools/DisableCompressOldFiles.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
HBCD/WinTools/DoubleDriver.bat
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
HBCD/WinTools/DoubleDriver.bat
Resource
win10v2004-20240508-en
General
-
Target
HBCD/WinTools/CPorts.bat
-
Size
101B
-
MD5
3ae8e6870c06a7415b230dddd3997680
-
SHA1
c1ff9787d53a7bd64019db22801ec34c432a0161
-
SHA256
fa57e4e2b976fa05052f14af7d8e291fb15a09ad99d1b5eeb552de02875e83eb
-
SHA512
152fabd1b301069b7a5674c94aae2343b48e7db6581e280f20bdcb9266d1f43c0534ba504a08d1673347b3eba99c700c167c7b8e1e7f75707c43dcc58780dbbb
Malware Config
Signatures
-
Nirsoft 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\cports.exe Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
cports.exepid process 208 cports.exe -
Processes:
resource yara_rule behavioral14/memory/1312-0-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral14/memory/1312-4-0x0000000000400000-0x000000000047D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cports.exedescription pid process Token: SeDebugPrivilege 208 cports.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exedescription pid process target process PID 4332 wrote to memory of 1312 4332 cmd.exe uharc.exe PID 4332 wrote to memory of 1312 4332 cmd.exe uharc.exe PID 4332 wrote to memory of 1312 4332 cmd.exe uharc.exe PID 4332 wrote to memory of 208 4332 cmd.exe cports.exe PID 4332 wrote to memory of 208 4332 cmd.exe cports.exe PID 4332 wrote to memory of 208 4332 cmd.exe cports.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HBCD\WinTools\CPorts.bat"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HBCD\uharc.exe..\uharc.exe x -t"C:\Users\Admin\AppData\Local\Temp" -y+ files\files.uha cports.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\cports.exe"C:\Users\Admin\AppData\Local\Temp\cports.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cports.exeFilesize
86KB
MD5babdd483259ad2e4d53620d426b122bd
SHA1f4717319b3773f9d1c5bdf432543796d8c5606bb
SHA2569ded40ebaae6e72f97fb787feed298eecec94e286d769fc0f3b0efad1292b549
SHA5128a3ff8864929b91ad8035d26bf3097e1a91afaa9e128a62b7fa27fdda04d52d58c3d8419ebedfbea120949e620a90092c0f23f9aaab72494b37d5a32fdbe8755
-
memory/1312-0-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/1312-4-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB