Overview

overview

10

Static

static

Install.exe

windows7_x64

8

Install.exe

windows10_x64

10

Install2.exe

windows7_x64

8

Install2.exe

windows10_x64

8

keygen-step-4.exe

windows7_x64

10

keygen-step-4.exe

windows10_x64

8

keygen-step-4d.exe

windows7_x64

10

keygen-step-4d.exe

windows10_x64

8

Resubmissions

08-07-2021 12:18

210708-8z6d5h8z2n 10

06-07-2021 17:53

210706-g6we6sa7sa 10

19-06-2021 18:17

210619-vr8bj2dzfn 10

17-06-2021 21:39

210617-a9cvlnmrbx 10

11-06-2021 17:26

210611-wvab1yw2tj 10

08-06-2021 06:47

210608-qrbpch3y46 10

08-06-2021 06:47

210608-64tndgm1ln 10

05-06-2021 18:40

210605-cd6qpr55sx 10

04-06-2021 11:56

210604-5c416rs3ns 10

04-06-2021 08:52

210604-jy9885jen2 10

Analysis

  • max time kernel
    1698s
  • max time network
    1705s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    17-06-2021 21:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Install.exe

  • Size

    497KB

  • MD5

    41a5f4fd1ea7cac4aa94a87aebccfef0

  • SHA1

    0d0abf079413a4c773754bf4fda338dc5b9a8ddc

  • SHA256

    97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9

  • SHA512

    5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3092
      • C:\Users\Admin\AppData\Local\Temp\Install.exe
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:648
        • C:\Users\Admin\AppData\Local\Temp\is-RDLN1.tmp\Install.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-RDLN1.tmp\Install.tmp" /SL5="$201DE,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:796
      • C:\Windows\system32\SystemSettingsAdminFlows.exe
        "C:\Windows\system32\SystemSettingsAdminFlows.exe" FeedbackOptinLevel 1
        2⤵
          PID:2376
        • C:\Windows\system32\SystemSettingsAdminFlows.exe
          "C:\Windows\system32\SystemSettingsAdminFlows.exe" FeedbackOptinLevel 3
          2⤵
            PID:1320
        • C:\Windows\ImmersiveControlPanel\SystemSettings.exe
          "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
          1⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2480
        • C:\Windows\system32\wwahost.exe
          "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:592
        • C:\Windows\system32\wermgr.exe
          "C:\Windows\system32\wermgr.exe" -outproc 1 592 416 364 424 0 0 0 0 0 0 0 0
          1⤵
            PID:2052
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
            1⤵
              PID:3340
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
              1⤵
                PID:3772
              • C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
                "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:2984
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 2984 -s 1652
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2148
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                1⤵
                • Drops file in Windows directory
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:2960
              • C:\Windows\system32\browser_broker.exe
                C:\Windows\system32\browser_broker.exe -Embedding
                1⤵
                • Modifies Internet Explorer settings
                PID:3772
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:304
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:2036

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Initial Access

              Execution

              Persistence

              Privilege Escalation

              Defense Evasion

              Modify Registry

              1
              T1112

              Credential Access

              Discovery

              Query Registry

              3
              T1012

              Peripheral Device Discovery

              1
              T1120

              System Information Discovery

              3
              T1082

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\is-RDLN1.tmp\Install.tmp
                MD5

                45ca138d0bb665df6e4bef2add68c7bf

                SHA1

                12c1a48e3a02f319a3d3ca647d04442d55e09265

                SHA256

                3960a0597104fc5bbf82bf6c03564a1eb6a829c560d1f50d0a63b4772fafbe37

                SHA512

                cd1a0493c26798eb70b3dabb8a439de7792c4676905cad21c6b3f372213ce9f6b65648245defcd36d4f19285160f41c62e1025e772e6b9f11aa126388ea8364f

                Download Submit
              • \Users\Admin\AppData\Local\Temp\is-9TR2P.tmp\idp.dll
                MD5

                8f995688085bced38ba7795f60a5e1d3

                SHA1

                5b1ad67a149c05c50d6e388527af5c8a0af4343a

                SHA256

                203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                SHA512

                043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                Download Submit
              • memory/592-122-0x000001AFA1D20000-0x000001AFA1D22000-memory.dmp
                Filesize

                8KB

                Download
              • memory/592-123-0x000001AFA1D20000-0x000001AFA1D23000-memory.dmp
                Filesize

                12KB

                Download
              • memory/648-114-0x0000000000400000-0x000000000042B000-memory.dmp
                Filesize

                172KB

                Download
              • memory/796-115-0x0000000000000000-mapping.dmp
                Download
              • memory/796-119-0x00000000001E0000-0x00000000001E1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1320-126-0x0000000000000000-mapping.dmp
                Download
              • memory/2376-125-0x0000000000000000-mapping.dmp
                Download