Overview
overview
9Static
static
7HBCD/WinTo...ip.bat
windows7-x64
7HBCD/WinTo...ip.bat
windows10-2004-x64
7HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
9HBCD/WinTo...ns.bat
windows7-x64
7HBCD/WinTo...ns.bat
windows10-2004-x64
7HBCD/WinTo...un.exe
windows7-x64
7HBCD/WinTo...un.exe
windows10-2004-x64
7HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7HBCD/WinTo...Uz.bat
windows7-x64
7HBCD/WinTo...Uz.bat
windows10-2004-x64
7HBCD/WinTo...ts.bat
windows7-x64
7HBCD/WinTo...ts.bat
windows10-2004-x64
9HBCD/WinTo...ix.exe
windows7-x64
9HBCD/WinTo...ix.exe
windows10-2004-x64
9HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7HBCD/WinTo...mp.bat
windows7-x64
7HBCD/WinTo...mp.bat
windows10-2004-x64
7HBCD/WinTo...NT.exe
windows7-x64
7HBCD/WinTo...NT.exe
windows10-2004-x64
7HBCD/WinTo...ix.bat
windows7-x64
7HBCD/WinTo...ix.bat
windows10-2004-x64
7HBCD/WinTo...un.bat
windows7-x64
1HBCD/WinTo...un.bat
windows10-2004-x64
1HBCD/WinTo...es.bat
windows7-x64
1HBCD/WinTo...es.bat
windows10-2004-x64
1HBCD/WinTo...er.bat
windows7-x64
7HBCD/WinTo...er.bat
windows10-2004-x64
7Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 06:36
Behavioral task
behavioral1
Sample
HBCD/WinTools/7Zip.bat
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
HBCD/WinTools/7Zip.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
HBCD/WinTools/AsteriskLogger.bat
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
HBCD/WinTools/AsteriskLogger.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
HBCD/WinTools/AutoRuns.bat
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
HBCD/WinTools/AutoRuns.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
HBCD/WinTools/Autorun.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
HBCD/WinTools/Autorun.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
HBCD/WinTools/CCleaner.bat
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
HBCD/WinTools/CCleaner.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
HBCD/WinTools/CPUz.bat
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
HBCD/WinTools/CPUz.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
HBCD/WinTools/CPorts.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
HBCD/WinTools/CPorts.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
HBCD/WinTools/ComboFix.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
HBCD/WinTools/ComboFix.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
HBCD/WinTools/ContentAdvisorPasswordRemover.bat
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
HBCD/WinTools/ContentAdvisorPasswordRemover.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
HBCD/WinTools/CoolWebSearch_Remover.bat
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
HBCD/WinTools/CoolWebSearch_Remover.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
HBCD/WinTools/DTemp.bat
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
HBCD/WinTools/DTemp.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
HBCD/WinTools/DefragNT.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
HBCD/WinTools/DefragNT.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
HBCD/WinTools/DialAFix.bat
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
HBCD/WinTools/DialAFix.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
HBCD/WinTools/DisableAutorun.bat
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
HBCD/WinTools/DisableAutorun.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
HBCD/WinTools/DisableCompressOldFiles.bat
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
HBCD/WinTools/DisableCompressOldFiles.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
HBCD/WinTools/DoubleDriver.bat
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
HBCD/WinTools/DoubleDriver.bat
Resource
win10v2004-20240508-en
General
-
Target
HBCD/WinTools/AsteriskLogger.bat
-
Size
101B
-
MD5
7ef7c686018ac499743387a191b72d47
-
SHA1
925d6476874f791d3006de07f3c274dc363473fb
-
SHA256
47881a40db65e4c0b62f60614d2d7dcd31fbf8288f3e52e6bddcc6a437a690ec
-
SHA512
7a63b5a4ef554a006efdbe5209758d63feb73d674b033be351c4d5558e084debe93503737d6661f9191e0ccc6611147c31ccd3aa06ac3d77e6c56944b1cde2a0
Malware Config
Signatures
-
Nirsoft 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\astlog.exe Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
astlog.exepid process 3492 astlog.exe -
Processes:
resource yara_rule behavioral4/memory/2944-0-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral4/memory/2944-5-0x0000000000400000-0x000000000047D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exedescription pid process target process PID 2612 wrote to memory of 2944 2612 cmd.exe uharc.exe PID 2612 wrote to memory of 2944 2612 cmd.exe uharc.exe PID 2612 wrote to memory of 2944 2612 cmd.exe uharc.exe PID 2612 wrote to memory of 3492 2612 cmd.exe astlog.exe PID 2612 wrote to memory of 3492 2612 cmd.exe astlog.exe PID 2612 wrote to memory of 3492 2612 cmd.exe astlog.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HBCD\WinTools\AsteriskLogger.bat"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HBCD\uharc.exe..\uharc.exe x -t"C:\Users\Admin\AppData\Local\Temp" -y+ files\files.uha astlog.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\astlog.exe"C:\Users\Admin\AppData\Local\Temp\astlog.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\astlog.exeFilesize
34KB
MD54a9988dbee81ee9a75532b190351b39c
SHA1952c5b398f94c5a7d501f2613f03df28bb940983
SHA256cf9f2711919037ed42324accdd9ae0d92729b00e396ab3d4447cbb59800c4910
SHA5124ac7b86be319085f52a1454ee6c86c5187083ce1a7b0156183fb70eac569251c82aeaef89563850fbb0d706a0a1eb93b34c2a9ac609446ccb3605969ad070097
-
memory/2944-0-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/2944-5-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB