Malware Sample Analysis
In this blog post-in-progress I am going to analyze the malware sample sha256:cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57 and provide beginner-friendly resources to start with malware analysis. Let's get started!
Filename: cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57.exe
Internal (Original) Name: dwm.exe
Size: 243,361 bytes
Time/date stamp: Thu Jan 01 18:12:16 1970 (UTC)
Compiler: MinGW(GCC: (GNU) 4.8.2)
MD5: 8b282ef8f441ccceb707a9ee04a541
SHA-256: cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57
Imphash: 79CF8CA8DD4DAD9D47E49BEB5C9BBD50
Ssdeep: 6144:oeLc9VV0liQ9KM5uVEgqz/ZnMmwqFlYiJB:owcDV0lilM5MqVMwbYiP
capa.exe cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57.exe
capa very verbose output
md5 8b282ef8f441ccceb707a9ee04a5413e
sha1 10fc5bbd2f801251d1228e6b3b35d24c6e018162
sha256 cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57
path C:/Users/husky/Desktop/cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57.exe
timestamp 2024-12-27 19:17:53.970541
capa version 7.4.0
os windows
format pe
arch i386
analysis static
extractor VivisectFeatureExtractor
base address 0x400000
rules C:/Users/husky/AppData/Local/Temp/_MEI70002/rules
function count 186
library function count 0
total feature count 10683
allocate or change RW memory (library rule)
author 0x534a@mailbox.org, @mr-tz
scope basic block
mbc Memory::Allocate Memory [C0007]
basic block @ 0x404916 in function 0x4048C0
and:
or:
match: change memory protection @ 0x404916
or:
api: VirtualProtect @ 0x404935
or:
number: 0x4 = PAGE_READWRITE @ 0x404956
change memory protection (2 matches, only showing first match of library rule)
author @mr-tz
scope basic block
mbc Memory::Change Memory Protection [C0008]
basic block @ 0x404916 in function 0x4048C0
or:
api: VirtualProtect @ 0x404935
contain loop (55 matches, only showing first match of library rule)
author moritz.raabe@mandiant.com
scope function
function @ 0x4013E0
or:
characteristic: loop @ 0x4013E0
create or open file (2 matches, only showing first match of library rule)
author michael.hunhoff@mandiant.com, joakim@intezer.com
scope basic block
mbc File System::Create File [C0016]
basic block @ 0x402FB0 in function 0x402FB0
or:
api: fopen @ 0x402FC7, 0x40304E
delay execution (library rule)
author michael.hunhoff@mandiant.com, @ramen0x3f
scope basic block
mbc Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]
references https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions, https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp
basic block @ 0x40A4E0 in function 0x40A4C0
or:
and:
os: windows
or:
api: Sleep @ 0x40A4E7
contain obfuscated stackstrings (17 matches)
namespace anti-analysis/obfuscation/string/stackstring
author moritz.raabe@mandiant.com
scope basic block
att&ck Defense Evasion::Obfuscated Files or Information::Indicator Removal from Tools [T1027.005]
mbc Anti-Static Analysis::Executable Code Obfuscation::Argument Obfuscation [B0032.020], Anti-Static Analysis::Executable Code Obfuscation::Stack Strings [B0032.017]
basic block @ 0x4017B0 in function 0x4017B0
characteristic: stack string @ 0x4017B0
basic block @ 0x4019FC in function 0x4019D0
characteristic: stack string @ 0x4019FC
basic block @ 0x401A55 in function 0x4019D0
characteristic: stack string @ 0x401A55
basic block @ 0x401B4A in function 0x4019D0
characteristic: stack string @ 0x401B4A
basic block @ 0x401CDC in function 0x4019D0
characteristic: stack string @ 0x401CDC
basic block @ 0x401E1B in function 0x4019D0
characteristic: stack string @ 0x401E1B
basic block @ 0x401FF8 in function 0x401F00
characteristic: stack string @ 0x401FF8
basic block @ 0x40215D in function 0x401F00
characteristic: stack string @ 0x40215D
basic block @ 0x40230D in function 0x401F00
characteristic: stack string @ 0x40230D
basic block @ 0x4025BE in function 0x401F00
characteristic: stack string @ 0x4025BE
basic block @ 0x402820 in function 0x402820
characteristic: stack string @ 0x402820
basic block @ 0x403080 in function 0x403080
characteristic: stack string @ 0x403080
basic block @ 0x403360 in function 0x403360
characteristic: stack string @ 0x403360
basic block @ 0x403640 in function 0x403640
characteristic: stack string @ 0x403640
basic block @ 0x40381B in function 0x403640
characteristic: stack string @ 0x40381B
basic block @ 0x403DD0 in function 0x403DD0
characteristic: stack string @ 0x403DD0
basic block @ 0x40B75E in function 0x40B710
characteristic: stack string @ 0x40B75E
compiled with MinGW for Windows
namespace compiler/mingw
author william.ballenthin@mandiant.com
scope file
and:
string: "Mingw runtime failure:" @ file+0xB7E8
string: "_Jv_RegisterClasses" = from GCC @ file+0xB237
encode data using XOR
namespace data-manipulation/encoding/xor
author moritz.raabe@mandiant.com
scope basic block
att&ck Defense Evasion::Obfuscated Files or Information [T1027]
mbc Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02], Data::Encode Data::XOR [C0026.002]
basic block @ 0x407008 in function 0x406ED0
and:
characteristic: tight loop @ 0x407008
characteristic: nzxor @ 0x407012
not: = filter for potential false positives
or:
or: = unsigned bitwise negation operation (~i)
number: 0xFFFFFFFF = bitwise negation for unsigned 32 bits
number: 0xFFFFFFFFFFFFFFFF = bitwise negation for unsigned 64 bits
or: = signed bitwise negation operation (~i)
number: 0xFFFFFFF = bitwise negation for signed 32 bits
number: 0xFFFFFFFFFFFFFFF = bitwise negation for signed 64 bits
or: = Magic constants used in the implementation of strings functions.
number: 0x7EFEFEFF = optimized string constant for 32 bits
number: 0x81010101 = -0x81010101 = 0x7EFEFEFF
number: 0x81010100 = 0x81010100 = ~0x7EFEFEFF
number: 0x7EFEFEFEFEFEFEFF = optimized string constant for 64 bits
number: 0x8101010101010101 = -0x8101010101010101 = 0x7EFEFEFEFEFEFEFF
number: 0x8101010101010100 = 0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF
contain a thread local storage (.tls) section
namespace executable/pe/section/tls
author michael.hunhoff@mandiant.com
scope file
section: .tls @ 0x414000
extract resource via kernel32 functions
namespace executable/resource
author william.ballenthin@mandiant.com
scope function
function @ 0x403640
or:
and:
or:
api: LoadResource @ 0x4039B4, 0x403A17, 0x403A7A, 0x403ADD, and 2 more...
api: LockResource @ 0x403967, 0x4039BF, 0x403A22, 0x403A85, and 3 more...
optional:
api: GetModuleHandle @ 0x4036D2
api: SizeofResource @ 0x40399B, 0x4039FE, 0x403A61, 0x403AC4, and 2 more...
accept command line arguments
namespace host-interaction/cli
author moritz.raabe@mandiant.com, anushka.virgaonkar@mandiant.com
scope function
att&ck Execution::Command and Scripting Interpreter [T1059]
mbc Execution::Command and Scripting Interpreter [E1059]
function @ 0x404560
or:
api: GetCommandLine @ 0x404576
query environment variable (2 matches)
namespace host-interaction/environment-variable
author michael.hunhoff@mandiant.com, @_re_fox
scope function
att&ck Discovery::System Information Discovery [T1082]
mbc Discovery::System Information Discovery [E1082]
function @ 0x403360
or:
api: GetEnvironmentVariable @ 0x4035A4
function @ 0x4074A0
or:
api: getenv @ 0x407500
get common file path
namespace host-interaction/file-system
author moritz.raabe@mandiant.com, michael.hunhoff@mandiant.com, anushka.virgaonkar@mandiant.com
scope function
att&ck Discovery::File and Directory Discovery [T1083]
mbc Discovery::File and Directory Discovery [E1083]
function @ 0x401F00
or:
api: GetSystemDirectory @ 0x4024EB
create directory
namespace host-interaction/file-system/create
author moritz.raabe@mandiant.com, michael.hunhoff@mandiant.com
scope function
mbc File System::Create Directory [C0046]
function @ 0x403080
or:
api: CreateDirectory @ 0x4032DC, 0x4032EF
get file size
namespace host-interaction/file-system/meta
author michael.hunhoff@mandiant.com, anushka.virgaonkar@mandiant.com
scope function
att&ck Discovery::File and Directory Discovery [T1083]
mbc Discovery::File and Directory Discovery [E1083]
function @ 0x401F00
or:
api: GetFileSize @ 0x402320
set file attributes
namespace host-interaction/file-system/meta
author moritz.raabe@mandiant.com, michael.hunhoff@mandiant.com, anushka.virgaonkar@mandiant.com
scope basic block
att&ck Defense Evasion::File and Directory Permissions Modification [T1222]
mbc File System::Set File Attributes [C0050]
basic block @ 0x403080 in function 0x403080
or:
api: SetFileAttributes @ 0x403302
read file on Windows (2 matches)
namespace host-interaction/file-system/read
author moritz.raabe@mandiant.com, anushka.virgaonkar@mandiant.com
scope function
mbc File System::Read File [C0051]
function @ 0x401F00
or:
and:
os: windows
or:
api: ReadFile @ 0x4023D8
function @ 0x402FB0
or:
and:
os: windows
or:
api: fread @ 0x403033
write file on Windows (2 matches)
namespace host-interaction/file-system/write
author william.ballenthin@mandiant.com, anushka.virgaonkar@mandiant.com
scope function
mbc File System::Writes File [C0052]
function @ 0x402FB0
or:
and:
os: windows
optional:
basic block:
or:
number: 0x2 = FILE_WRITE_DATA @ 0x402FCC
match: create or open file @ 0x402FB0
or:
api: fopen @ 0x402FC7, 0x40304E
or:
api: fwrite @ 0x403068
function @ 0x404870
or:
and:
os: windows
or:
api: fwrite @ 0x40489C
check Internet connectivity via WinINet (2 matches)
namespace host-interaction/network/connectivity
author matthew.williams@mandiant.com, michael.hunhoff@mandiant.com
scope basic block
att&ck Discovery::System Network Configuration Discovery::Internet Connection Discovery [T1016.001]
basic block @ 0x4041BB in function 0x403DD0
or:
and:
or:
api: InternetCheckConnection @ 0x4041EE, 0x404219
optional:
instruction:
and:
mnemonic: cmp @ 0x40423C
or:
number: 0x1 = TRUE @ 0x40423C
basic block @ 0x404246 in function 0x403DD0
or:
and:
or:
api: InternetCheckConnection @ 0x40425D
get thread local storage value
namespace host-interaction/process
author michael.hunhoff@mandiant.com
scope function
function @ 0x404C30
and:
api: TlsGetValue @ 0x404C56
allocate or change RWX memory
namespace host-interaction/process/inject
author @mr-tz
scope basic block
mbc Memory::Allocate Memory [C0007]
basic block @ 0x404916 in function 0x4048C0
and:
or:
match: change memory protection @ 0x404916
or:
api: VirtualProtect @ 0x404935
or:
number: 0x40 = PAGE_EXECUTE_READWRITE @ 0x404920
enumerate processes
namespace host-interaction/process/list
author moritz.raabe@mandiant.com, michael.hunhoff@mandiant.com
scope function
att&ck Discovery::Process Discovery [T1057], Discovery::Software Discovery [T1518]
function @ 0x402820
or:
and:
api: Process32First @ 0x402A1E
api: Process32Next @ 0x402CA7
link function at runtime on Windows (7 matches)
namespace linking/runtime-linking
author moritz.raabe@mandiant.com, michael.hunhoff@mandiant.com
scope instruction
att&ck Execution::Shared Modules [T1129]
instruction @ 0x401329
and:
os: windows
or:
api: GetProcAddress @ 0x401329
instruction @ 0x401374
and:
os: windows
or:
api: GetProcAddress @ 0x401374
instruction @ 0x4013B9
and:
os: windows
or:
api: GetProcAddress @ 0x4013B9
instruction @ 0x401D8E
and:
os: windows
or:
api: GetProcAddress @ 0x401D8E
instruction @ 0x401E90
and:
os: windows
or:
api: GetProcAddress @ 0x401E90
instruction @ 0x401FC9
and:
os: windows
or:
api: GetProcAddress @ 0x401FC9
instruction @ 0x402558
and:
os: windows
or:
api: GetProcAddress @ 0x402558
resolve function by parsing PE exports (2 matches)
namespace load-code/pe
author sara-rn
scope function
function @ 0x401760
and:
os: windows
or:
mnemonic: movzx @ 0x401798
and:
offset: 0x3C = IMAGE_DOS_HEADER.PE.e_lfanew @ 0x401769
or:
and:
arch: i386
offset: 0x78 = offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT] @ 0x40176C
3 or more:
offset: 0x24 = IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals @ 0x401770, 0x401795
offset: 0x20 = IMAGE_EXPORT_DIRECTORY.AddressOfNames @ 0x401765, 0x401785
offset: 0x18 = IMAGE_EXPORT_DIRECTORY.NumberOfNames @ 0x40177E
offset: 0x1C = IMAGE_EXPORT_DIRECTORY.AddressOfFunctions @ 0x40179E
function @ 0x4074A0
and:
os: windows
or:
characteristic: loop @ 0x4074A0
mnemonic: movzx @ 0x407569, 0x407592, 0x4075A0, 0x407617, and 20 more...
and:
offset: 0x3C = IMAGE_DOS_HEADER.PE.e_lfanew @ 0x4074DD
or:
and:
arch: i386
offset: 0x78 = offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT] @ 0x4074F0
3 or more:
offset: 0x14 = IMAGE_EXPORT_DIRECTORY.NumberOfFunctions @ 0x40755D, 0x4075A6, 0x4075FB, 0x407608, and 22 more...
offset: 0x24 = IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals @ 0x407750, 0x407758, 0x4077D3, 0x407803, and 10 more...
offset: 0x20 = IMAGE_EXPORT_DIRECTORY.AddressOfNames @ 0x407698, 0x40769C, 0x40775E, 0x407762, and 18 more...
offset: 0x18 = IMAGE_EXPORT_DIRECTORY.NumberOfNames @ 0x407571, 0x407A2C, 0x407A34, 0x407A49, and 7 more...
offset: 0x1C = IMAGE_EXPORT_DIRECTORY.AddressOfFunctions @ 0x40752C, 0x407CEE
create shortcut via IShellLink
namespace persistence
author matthew.williams@mandiant.com
scope function
att&ck Persistence::Boot or Logon Autostart Execution::Shortcut Modification [T1547.009]
references https://docs.microsoft.com/en-us/windows/win32/shell/links#creating-a-shortcut-and-a-folder-shortcut-to-a-file
function @ 0x402E10
and:
offset: 0x50 = psl->SetPath @ 0x402EAB
offset: 0x18 = ppf->Save @ 0x402F78
api: CoCreateInstance @ 0x402E52
bytes: 0114020000000000c000000000000046 = CLSID_ShellLink @ 0x402E4B
bytes: 0b01000000000000c000000000000046 = IID_IPersistFile @ 0x402F13
or:
bytes: f914020000000000c000000000000046 = IID_IShellLinkW @ 0x402E33
=======================================
Strings of interest
---------------------------------------
pestudio.exe detail - strings
GetEnvironmentVariable
InternetCheckConnection
VirtualProtect
VirtualQuery
FindFirstFile
FindNextFile
SetFileAttributes
GetCurrentProcess
Process32First
Process32Next
ShowWindow
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
InterlockedExchange
LeaveCriticalSection
LoadResource
LockResource
SizeofResource
GetSystemDirectory
WININET.DLL
VirtualQuery failed for %d bytes at address %p
LocalAlloc
malloc
memcpy
FindClose
GetFileSize
ReadFile
SHGetFolderPath
CreateDirectory
fclose
fopen
fputc
fread
fseek
ftell
fwrite
ExitProcess
TlsGetValue
GetCommandLine
Sleep
SetUnhandledExceptionFilter
GetProcAddress
GetModuleFileName
GetModuleHandle
LoadLibrary
GetLastError
GetConsoleWindow
!This program cannot be run in DOS mode.
.CRT
libgcc_s_dw2-1.dll
libgcj-13.dll
ekrn.exe
egui.exe
bitdefender_isecurity.exe
uiSeAgnt.exe
ccSvcHst.exe
nis.exe
ns.exe
apvui.exe
onlinent.exe
PSUAMain.exe
escanmon.exe
escanpro.exe
Tray.exe
Prd.EventViewer.exe
zatray.exe
AkSA.exe
\MsUpdte.exe
https://en.wikipedia.org/wiki/Main_Page
https://secure.comodo.net/CPS0C
http://ocsp.comodoca.com0
dwm.exe
0@.bss
ouemm/emm!!!!!!!!!!!!!
Vtfs43/emm
bewbqj43/emm
Tifmm43/emm
lfsofm43/emm
__register_frame_info
_Jv_RegisterClasses
__deregister_frame_info
%d is the largest prime factor !
--*****
Mo~Ysy~og]e}<>Ncxoi~exsK
aoxdof98$nff
--*****-------
--*****------
PfwSql`fppGFSSloj`z
--*****------***
%d****
AVGUI
bdagent
gziface
norton
AvkTray
AVKTray
avp
AvastUI
avg
V]cdne}y*_znk~o
_Npvsgwf-omh
ProgramData
GjoeSftpvsdfB
MpbeSftpvsdf
MpdlSftpvsdf
P}_dgkz\co}ElYoi~ced
UjqwvboSqlwf`wF{
MwTqjwfUjqwvboNfnlqz
Mingw runtime failure:
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
glob-1.0-mingw32
GCC: (GNU) 4.8.2
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Greater Manchester1
Salford1
COMODO CA Limited1#0!
COMODO RSA Code Signing CA0
$4 THE HAYLOFT, FAR PEAK, NORTHLEACH,1(0&
Accelerate Technologies Limited1(0&
admin@acceleratetech.co.uk0
Desktop Window Manager
6.1.7600.16385 (win7_rtm.090713-1255)
Microsoft Corporation. All rights reserved.
6WinUpdatr_ldrexe_19july.ex
floss.exe --no static -- cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57.exe INFO: floss.results: SeDebugPrivilege INFO: floss.results: kernel32.dllW INFO: floss.results: LoadLibraryAW INFO: floss.results: LoadLibraryA INFO: floss.results: OpenProcessTokenW INFO: floss.results: Advapi32.dllW INFO: floss.results: LookupPrivilegeValueA INFO: floss.results: AdjustTokenPrivileges INFO: floss.results: kernel32.dll INFO: floss.results: LoadLibraryA INFO: floss.results: CreateToolhelp32Snapshot INFO: floss.results: kernel32.dll INFO: floss.results: LoadLibraryA INFO: floss.results: Shell32.dll INFO: floss.results: MsUpdte.exe INFO: floss.results: kernel32.dll INFO: floss.results: LoadLibraryA INFO: floss.results: Shell32.dll INFO: floss.results: kernel32.dll INFO: floss.results: LoadLibraryA INFO: floss.results: SizeofResource INFO: floss.results: kernel32.dll INFO: floss.results: LoadLibraryA INFO: floss.results: LoadLibraryA INFO: floss.results: GetSystemWow64DirectoryA INFO: floss.results: RPCRT4.dll INFO: floss.results: ZwUnmapViewOfSection INFO: floss.results: ntdll.dll INFO: floss.results: olea INFO: floss.results: t32.dll INFO: floss.results: Kock INFO: floss.results: kernel32.dll INFO: floss.results: gdi32.dll INFO: floss.results: mfc110 INFO: floss.results: .dll INFO: floss.results: advapi32.dll INFO: floss.results: r32.dll INFO: floss.results: msvcr110.dll INFO: floss.results: \Windows Update INFO: floss.results: shell32.dll INFO: floss.results: shlwapi.dll INFO: floss.results: ser32.dll INFO: floss.results: msvcrt.dll INFO: floss.results: efefefefefefefef INFO: floss.results: efefefef INFO: floss.results: User32.dll INFO: floss.results: kernel32.dll INFO: floss.results: CreateToolhelp32Snapshot INFO: floss.results: LoadLibraryA INFO: floss.results: ntdll.dll INFO: floss.results: kernel32.dll INFO: floss.results: VirtualAlloc INFO: floss.results: Infinity FLARE FLOSS RESULTS (version v3.1.1-0-g3cd3ee6) +------------------------+------------------------------------------------------------------------------------+ | file path | cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57.exe | | identified language | unknown | | extracted strings | | | static strings | Disabled | | language strings | 0 (0 characters) | | stack strings | 24 | | tight strings | 0 | | decoded strings | 29 | +------------------------+------------------------------------------------------------------------------------+ ────────────────────────── FLOSS STACK STRINGS (24) ────────────────────────── SeDebugPrivilege kernel32.dllW LoadLibraryAW LoadLibraryA OpenProcessTokenW Advapi32.dllW LookupPrivilegeValueA AdjustTokenPrivileges kernel32.dll LoadLibraryA CreateToolhelp32Snapshot kernel32.dll LoadLibraryA Shell32.dll MsUpdte.exe kernel32.dll LoadLibraryA Shell32.dll kernel32.dll LoadLibraryA SizeofResource kernel32.dll LoadLibraryA LoadLibraryA ───────────────────────── FLOSS TIGHT STRINGS (0) ───────────────────────── ──────────────────────────── FLOSS DECODED STRINGS (29) ──────────────────────────── GetSystemWow64DirectoryA RPCRT4.dll ZwUnmapViewOfSection ntdll.dll olea t32.dll Kock kernel32.dll gdi32.dll mfc110 .dll advapi32.dll r32.dll msvcr110.dll \Windows Update shell32.dll shlwapi.dll ser32.dll msvcrt.dll efefefefefefefef efefefef User32.dll kernel32.dll CreateToolhelp32Snapshot LoadLibraryA ntdll.dll kernel32.dll VirtualAlloc Infinity
=======================================
Imports
---------------------------------------
=======================================
Exports
---------------------------------------
=======================================
Files and Registry keys created/modified/deleted
---------------------------------------
Initial detonation (w/wo Remnux and inetsim):
Malware creates a shortcut "Msupdte.lnk" in Startup directory, the shortcut targets C:\Users\husky\Desktop\sample\cc8867a5fd62b82e817afc405807f88716960af5744040999b6.exe , Size:980 bytes , sha256:3cb51f5f44954ea08641c1a13da0c8838a92fdb7ff18a58a962a3402c1f451d4 No matches found on VT
Regshot Compare report
Regshot 1.9.1 x64 Unicode (beta r321)
Comments:
Datetime: 2024-12-30 21:27:32, 2024-12-30 21:39:43
Computer: DESKTOP-V64A5T1, DESKTOP-V64A5T1
Username: husky, husky
----------------------------------
Keys deleted: 6
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\ServiceInstances\ea27fe31-4467-484a-a717-ea736d21e980
HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState
HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\CurrentState
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Group Policy\ServiceInstances\ea27fe31-4467-484a-a717-ea736d21e980
HKLM\SYSTEM\ControlSet001\Services\SmsRouter\State\Registration\Ids\{135A9849-00A9-466F-B08A-018EC1088A6F}
HKLM\SYSTEM\CurrentControlSet\Services\SmsRouter\State\Registration\Ids\{135A9849-00A9-466F-B08A-018EC1088A6F}
----------------------------------
Keys added: 8
----------------------------------
HKLM\SOFTWARE\Microsoft\Provisioning\Sessions\loyJxHVRY0myuEU7.0
HKLM\SOFTWARE\Microsoft\Provisioning\FirstBootRun
HKLM\SOFTWARE\Microsoft\Provisioning\LogonTaskCompleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\ServiceInstances\22386174-fd81-4e78-a42c-67d78ebebfaa
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Group Policy\ServiceInstances\22386174-fd81-4e78-a42c-67d78ebebfaa
HKLM\SYSTEM\ControlSet001\Services\SmsRouter\State\Registration\Ids\{E1F1ECD2-4888-4B16-A0CA-F37CC5FB10D4}
HKLM\SYSTEM\CurrentControlSet\Services\SmsRouter\State\Registration\Ids\{E1F1ECD2-4888-4B16-A0CA-F37CC5FB10D4}
HKU\S-1-5-21-914199523-3388888877-1504927903-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A01F4
----------------------------------
Values deleted: 27
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\VolatileNotifications\41C64E6DA3DC3855: 01 00 04 80 44 00 00 00 50 00 00 00 00 00 00 00 14 00 00 00 02 00 30 00 02 00 00 00 00 00 14 00 03 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 14 00 00 00 01 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 20 00 00 00
HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState\StateValue: 0x00000011
HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\CurrentState\StateValue: 0x00000011
HKLM\SYSTEM\ControlSet001\Services\SmsRouter\State\Registration\Ids\{135A9849-00A9-466F-B08A-018EC1088A6F}\Priority: 0x01000000
HKLM\SYSTEM\ControlSet001\Services\SmsRouter\State\Registration\Ids\{135A9849-00A9-466F-B08A-018EC1088A6F}\CreationTime: 0x0000000067705308
HKLM\SYSTEM\ControlSet001\Services\SmsRouter\State\Registration\Ids\{135A9849-00A9-466F-B08A-018EC1088A6F}\Transient: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\SmsRouter\State\Registration\Ids\{135A9849-00A9-466F-B08A-018EC1088A6F}\IsPackaged: 0x00000000
HKLM\SYSTEM\ControlSet001\Services\SmsRouter\State\Registration\Ids\{135A9849-00A9-466F-B08A-018EC1088A6F}\DeliveryType: 0x00000002
HKLM\SYSTEM\ControlSet001\Services\SmsRouter\State\Registration\Ids\{135A9849-00A9-466F-B08A-018EC1088A6F}\FilterXML: "
=======================================
Networking
---------------------------------------
inetsim report:
2024-11-11 15:23:09 DNS connection, type: A, class: IN, requested name: slscr.update.microsoft[.]com
2024-11-11 15:23:09 DNS connection, type: A, class: IN, requested name: ctldl.windowsupdate[.]com
2024-11-11 15:23:09 HTTP connection, method: GET, URL: hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl[.]cab?95cb98bf48371ef4, file name: /var/lib/inetsim/http/fakefiles/sample.html
2024-11-11 15:23:09 DNS connection, type: A, class: IN, requested name: fe3cr.delivery.mp.microsoft[.]com
2024-11-11 15:23:33 HTTP connection, method: GET, URL: hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl[.]cab?02ff515d0ff4a002, file name: /var/lib/inetsim/http/fakefiles/sample.html
2024-11-11 15:25:35 DNS connection, type: A, class: IN, requested name: update.googleapis[.]com
2024-11-11 15:26:09 DNS connection, type: A, class: IN, requested name: en.wikipedia[.]org
2024-11-11 15:29:00 DNS connection, type: A, class: IN, requested name: node2.feed43[.]com
2024-11-11 15:29:00 HTTP connection, method: POST, URL: hxxp://node2.feed43.com/2665675887512026[.]xml, file name: /var/lib/inetsim/http/fakefiles/sample.html --> each second from here
2024-11-11 15:29:00 DNS connection, type: A, class: IN, requested name: raw.githubusercontent[.]com
2024-11-11 15:29:00 HTTP connection, method: POST, URL: hxxp://raw.githubusercontent.com/johnhenery12/testy/master/xml[.]xml, file name: /var/lib/inetsim/http/fakefiles/sample.html --> each second from here
...
2024-11-11 15:35:17 HTTP connection, method: GET, URL: hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl[.]cab?09d5b0702e00c362, file name: /var/lib/inetsim/http/fakefiles/sample.html
..
2024-11-11 15:37:00 DNS connection, type: A, class: IN, requested name: conemu.github[.]io
2024-11-11 15:37:00 HTTP connection, method: GET, URL: hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl[.]cab?35f6e629126ba3d4, file name: /var/lib/inetsim/http/fakefiles/sample.html
...
https://www.virustotal.com/gui/domain/ctldl.windowsupdate.com/relations
=======================================
Detection rule
---------------------------------------
I scanned the malware with Loki, and created this detection rule with yarGen:
python3 yarGen.py -m C:\Users\husky\Desktop\sample\ --excludegood -o C:\Users\husky\Desktop\sample\ad_final.yar
/*
YARA Rule Set
Author: yarGen Rule Generator
Date: 2024-12-28
Identifier: cc
Reference: https://github.com/Neo23x0/yarGen
*/
/* Rule Set ----------------------------------------------------------------- */
rule cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57 {
meta:
description = "detection for dwm johnhenery12 malware"
author = "AD added - yarGen Rule Generator"
reference = "https://github.com/Neo23x0/yarGen"
date = "2024-12-28"
hash1 = "cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57"
strings:
$s1 = "escanmon.exe" fullword ascii
$s2 = "escanpro.exe" fullword ascii
$s3 = "AkSA.exe" fullword ascii
$s4 = "Tray.exe" fullword ascii
$s5 = "apvui.exe" fullword ascii
$s6 = "onlinent.exe" fullword ascii
$s7 = "Prd.EventViewer.exe" fullword ascii
$s8 = "zatray.exe" fullword ascii
$s9 = "uiSeAgnt.exe" fullword ascii
$s10 = "egui.exe" fullword ascii
$s11 = "PSUAMain.exe" fullword ascii
$s12 = "norton" fullword ascii /* reversed goodware string 'notron' */
$s13 = "bitdefender_isecurity.exe" fullword ascii
$s14 = "nis.exe" fullword ascii
$s15 = "ns.exe" fullword ascii
$s16 = "\\MsUpdte.exe" fullword ascii
$s17 = " VirtualQuery failed for %d bytes at address %p" fullword ascii
$s18 = "bdagent" fullword ascii
$s19 = "ouemm/emm!!!!!!!!!!!!!" fullword ascii
$s20 = "vakn.jUt p" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 700KB and
8 of them
}
=======================================
* Analysis notes
---------------------------------------
Malware enumerates processes on the system:
ekrn.exe
egui.exe
avg
AVGUI
bdagent
gziface
bitdefender_isecurity.exe
uiSeAgnt.exe
ccSvcHst.exe
norton
AvkTray
apvui.exe
avp
AvastUI
onlinent.exe
PSUAMain.exe
escanmon.exe
escanpro.exe
Tray.exe
Prd.EventViewer.exe
zatray.exe
AkSA.exe
Decompile: FUN_00402820
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
int FUN_00402820(void)
{
HMODULE pHVar1;
HANDLE hObject;
char *pcVar2;
int iVar3;
undefined4 *puVar4;
undefined4 local_20c;
undefined local_208;
undefined local_207;
undefined local_206;
undefined local_205;
undefined local_204;
undefined local_203;
undefined local_202;
undefined local_201;
undefined4 local_1a8;
undefined local_1a4;
undefined local_1a3;
undefined local_1a2;
undefined local_1a1;
undefined local_1a0;
undefined local_19f;
undefined local_19e;
undefined local_19d;
undefined local_19c;
undefined local_19b;
undefined local_19a;
undefined local_199;
undefined local_198;
undefined local_197;
undefined local_196;
undefined local_195;
undefined local_194;
undefined local_193;
undefined local_192;
undefined local_191;
undefined local_190;
undefined4 local_144 [9];
CHAR local_120 [272];
puVar4 = &local_20c;
for (iVar3 = 0x19; iVar3 != 0; iVar3 = iVar3 + -1) {
*puVar4 = 0;
puVar4 = puVar4 + 1;
}
local_20c._0_1_ = 'k';
local_20c._1_1_ = 0x65;
local_20c._2_1_ = 0x72;
local_20c._3_1_ = 0x6e;
puVar4 = &local_1a8;
for (iVar3 = 0x19; iVar3 != 0; iVar3 = iVar3 + -1) {
*puVar4 = 0;
puVar4 = puVar4 + 1;
}
local_208 = 0x65;
local_207 = 0x6c;
local_206 = 0x33;
local_205 = 0x32;
local_204 = 0x2e;
local_203 = 100;
local_202 = 0x6c;
local_201 = 0x6c;
pHVar1 = GetModuleHandleA((LPCSTR)&local_20c);
local_1a8._0_1_ = 'L';
local_1a8._1_1_ = 0x6f;
local_1a8._2_1_ = 0x61;
local_1a8._3_1_ = 100;
local_1a4 = 0x4c;
local_1a3 = 0x69;
local_1a2 = 0x62;
local_1a1 = 0x72;
local_1a0 = 0x61;
local_19f = 0x72;
local_19e = 0x79;
local_19d = 0x41;
local_19c = 0;
DAT_0041104c = (code *)FUN_00401760((int)pHVar1,(LPCSTR)&local_1a8);
iVar3 = (*DAT_0041104c)(&local_20c);
local_1a8._0_1_ = 'C';
local_1a8._1_1_ = 0x72;
local_1a8._2_1_ = 0x65;
local_1a8._3_1_ = 0x61;
local_1a4 = 0x74;
local_1a3 = 0x65;
local_1a2 = 0x54;
local_1a1 = 0x6f;
local_1a0 = 0x6f;
local_19f = 0x6c;
local_19e = 0x68;
local_19d = 0x65;
local_19c = 0x6c;
local_19b = 0x70;
local_19a = 0x33;
local_199 = 0x32;
local_198 = 0x53;
local_197 = 0x6e;
local_196 = 0x61;
local_195 = 0x70;
local_194 = 0x73;
local_193 = 0x68;
local_192 = 0x6f;
local_191 = 0x74;
local_190 = 0;
_DAT_00411048 = (code *)FUN_00401760(iVar3,(LPCSTR)&local_1a8);
hObject = (HANDLE)(*_DAT_00411048)(2,0);
if (hObject == (HANDLE)0xffffffff) {
return 0;
}
local_144[0] = 0x128;
iVar3 = Process32First(hObject,local_144);
if (iVar3 != 0) {
do {
iVar3 = lstrcmpA(local_120,"ekrn.exe");
if ((iVar3 == 0) || (iVar3 = lstrcmpA(local_120,"egui.exe"), iVar3 == 0)) {
CloseHandle(hObject);
return 1;
}
pcVar2 = strstr(local_120,"avg");
if ((pcVar2 != (char *)0x0) || (pcVar2 = strstr(local_120,"AVGUI"), pcVar2 != (char *)0x0)) {
CloseHandle(hObject);
return 2;
}
pcVar2 = strstr(local_120,"bdagent");
if (((pcVar2 != (char *)0x0) || (pcVar2 = strstr(local_120,"gziface"), pcVar2 != (char *)0x0))
|| (pcVar2 = strstr(local_120,"bitdefender_isecurity.exe"), pcVar2 != (char *)0x0)) {
CloseHandle(hObject);
return 3;
}
pcVar2 = strstr(local_120,"uiSeAgnt.exe");
if (pcVar2 != (char *)0x0) {
CloseHandle(hObject);
return 4;
}
pcVar2 = strstr(local_120,"ccSvcHst.exe");
if (((pcVar2 != (char *)0x0) || (pcVar2 = strstr(local_120,"norton"), pcVar2 != (char *)0x0))
|| ((pcVar2 = strstr(local_120,"nis.exe"), pcVar2 != (char *)0x0 ||
(pcVar2 = strstr(local_120,"ns.exe"), pcVar2 != (char *)0x0)))) {
CloseHandle(hObject);
return 5;
}
pcVar2 = strstr(local_120,"AvkTray");
if ((pcVar2 != (char *)0x0) || (pcVar2 = strstr(local_120,"AVKTray"), pcVar2 != (char *)0x0))
{
CloseHandle(hObject);
return 6;
}
pcVar2 = strstr(local_120,"apvui.exe");
if ((pcVar2 != (char *)0x0) || (pcVar2 = strstr(local_120,"avp"), pcVar2 != (char *)0x0)) {
CloseHandle(hObject);
return 7;
}
pcVar2 = strstr(local_120,"AvastUI");
if (pcVar2 != (char *)0x0) {
CloseHandle(hObject);
return 8;
}
pcVar2 = strstr(local_120,"onlinent.exe");
if (pcVar2 != (char *)0x0) {
CloseHandle(hObject);
return 10;
}
pcVar2 = strstr(local_120,"PSUAMain.exe");
if (pcVar2 != (char *)0x0) {
CloseHandle(hObject);
return 9;
}
pcVar2 = strstr(local_120,"escanmon.exe");
if ((pcVar2 != (char *)0x0) ||
(pcVar2 = strstr(local_120,"escanpro.exe"), pcVar2 != (char *)0x0)) {
CloseHandle(hObject);
return 0xb;
}
pcVar2 = strstr(local_120,"Tray.exe");
if ((pcVar2 != (char *)0x0) ||
(pcVar2 = strstr(local_120,"Prd.EventViewer.exe"), pcVar2 != (char *)0x0)) {
CloseHandle(hObject);
return 0xd;
}
pcVar2 = strstr(local_120,"zatray.exe");
if ((pcVar2 != (char *)0x0) || (pcVar2 = strstr(local_120,"AkSA.exe"), pcVar2 != (char *)0x0))
{
CloseHandle(hObject);
return 0xc;
}
iVar3 = Process32Next(hObject,local_144);
} while (iVar3 != 0);
iVar3 = 0;
}
CloseHandle(hObject);
return iVar3;
Capa detected XOR encoded data, I found the XOR keys with Ghidra: 0x03, 0x0A
=======================================
Online research
---------------------------------------
- Sandboxes:
https://bazaar.abuse.ch/sample/cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57/
https://app.any.run/tasks/0c22d364-518a-46bd-a82b-8c454c459cb3?p=67714d1b7bc927e79eaaff39
https://tria.ge/200829-srk9q9pera
https://www.virustotal.com/gui/file/cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57/details
https://www.hybrid-analysis.com/sample/cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57/677187644771dbe8bd0f38d0
https://www.useragents.me/
https://useragentstring.com/index.php
- Relevant Info to review:
https://bazaar.abuse.ch/browse/tag/BozokRAT/
https://x.com/arkbird_solg/status/1299450788163575808 "#APT #Patchwork Edited BozokRAT with the same Xor keys (0x3, 0xA) that the last BozokRAT sample ... "
https://otx.alienvault.com/pulse/60f02c152b68bec1ace00c85 "#Patchwork #APT maldoc is dropping #BozokRAT ... "
https://malpedia.caad.fkie.fraunhofer.de/details/win.bozok
https://malpedia.caad.fkie.fraunhofer.de/details/win.badnews
https://attack.mitre.org/software/S0128/ "BADNEWS is malware that has been used by the actors responsible for the Patchwork campaign. Its name was given due to its use of RSS feeds, forums, and blogs for command and control ... "
https://openhunting.io/threat-library-detail?data=bozok
https://apt.etda.or.th/cgi-bin/showcard.cgi?g=Patchwork%2C%20Dropping%20Elephant
https://www.virusbulletin.com/conference/vb2023/abstracts/dropping-elephant-never-dropped/
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf#page=121 "Kaspersky Crimeware Reports Common TTPs of the modern ransomware groups"
https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/
=======================================
Learning Resources
---------------------------------------
- TCM Security [referral link]: Practical Malware Analysis & Triage (PMAT) course (Practical Malware Research Professional (PMRP) exam)
- Infosec Skills: Reverse Engineering path, Hands-on Ransomware Mitigation path
- TryHackMe: Malware Analysis module, Yara room
- HackTheBox Academy [referral link]: Introduction to Malware Analysis, YARA & Sigma for SOC Analysts
- Rangeforce Community Theme: Reverse Engineering
- Practical Malware Analysis ebook + Jai Minton Practical Malware Analysis - Lab Write-up
- SANS Digital Forensics and Incident Response
* to be continued
Learning Resources
---------------------------------------