Overview
overview
8Static
static
1base/DAutils.dll
windows7-x64
1base/DAutils.dll
windows10-2004-x64
1base/FCUI.exe
windows7-x64
6base/FCUI.exe
windows10-2004-x64
6base/FCUI.exe.xml
windows7-x64
1base/FCUI.exe.xml
windows10-2004-x64
1base/Insta...ls.bat
windows7-x64
1base/Insta...ls.bat
windows10-2004-x64
1base/Insta...xp.bat
windows7-x64
1base/Insta...xp.bat
windows10-2004-x64
1base/Inter...Vw.dll
windows7-x64
1base/Inter...Vw.dll
windows10-2004-x64
1base/Loader.exe
windows7-x64
1base/Loader.exe
windows10-2004-x64
1base/Newto...on.dll
windows7-x64
1base/Newto...on.dll
windows10-2004-x64
1base/Regis...rt.exe
windows7-x64
3base/Regis...rt.exe
windows10-2004-x64
3base/Regis...ll.exe
windows7-x64
6base/Regis...ll.exe
windows10-2004-x64
6base/Regis...xe.xml
windows7-x64
1base/Regis...xe.xml
windows10-2004-x64
1base/RunAp...or.bat
windows7-x64
6base/RunAp...or.bat
windows10-2004-x64
6base/openThankYou.bat
windows7-x64
1base/openThankYou.bat
windows10-2004-x64
6base/runApp.bat
windows7-x64
6base/runApp.bat
windows10-2004-x64
6base/uninst.exe
windows7-x64
8base/uninst.exe
windows10-2004-x64
8base/verif...ll.bat
windows7-x64
1base/verif...ll.bat
windows10-2004-x64
1Analysis
-
max time kernel
45s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 22:04
Static task
static1
Behavioral task
behavioral1
Sample
base/DAutils.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
base/DAutils.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
base/FCUI.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
base/FCUI.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
base/FCUI.exe.xml
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
base/FCUI.exe.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
base/InstallAddiotionals.bat
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
base/InstallAddiotionals.bat
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
base/InstallNet35xp.bat
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
base/InstallNet35xp.bat
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
base/Interop.SHDocVw.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
base/Interop.SHDocVw.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
base/Loader.exe
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
base/Loader.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
base/Newtonsoft.Json.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
base/Newtonsoft.Json.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
base/RegisterInstallStart.exe
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
base/RegisterInstallStart.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
base/RegisterUninstall.exe
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
base/RegisterUninstall.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
base/RegisterUninstall.exe.xml
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
base/RegisterUninstall.exe.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
base/RunAppMonitor.bat
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
base/RunAppMonitor.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
base/openThankYou.bat
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
base/openThankYou.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
base/runApp.bat
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
base/runApp.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
base/uninst.exe
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
base/uninst.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral31
Sample
base/verifyUninstall.bat
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
base/verifyUninstall.bat
Resource
win10v2004-20221111-en
General
-
Target
base/RegisterInstallStart.exe
-
Size
7KB
-
MD5
79b26d6c53a451c96454bcee611350bd
-
SHA1
7975573dcf8654d954b21601474dad433905093b
-
SHA256
d5d24d8e0fe89d082881966bd5e03a6a784a8db8c5b05c47dd6b512c37466e7b
-
SHA512
75669c2b56f4c0ad03eb7d98e3ac4aa7ae4f93e1e18777a01651468eed78e976e06ece555f91e58c0ce300c73cf76af19d8f0b2d53d016473cf9c3d9e2cf44ce
-
SSDEEP
96:A3bKpIrljiVFzlJnKpvlyxPMoaR2zNnVkFDvIikTZN0ADrzBUWZwiW4dzzNt:ebSIrNiVdlkpvwhMNRlxv8L0QzBUW+W
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 668 1128 WerFault.exe RegisterInstallStart.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegisterInstallStart.exepid process 1128 RegisterInstallStart.exe 1128 RegisterInstallStart.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegisterInstallStart.exedescription pid process Token: SeDebugPrivilege 1128 RegisterInstallStart.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
RegisterInstallStart.exedescription pid process target process PID 1128 wrote to memory of 668 1128 RegisterInstallStart.exe WerFault.exe PID 1128 wrote to memory of 668 1128 RegisterInstallStart.exe WerFault.exe PID 1128 wrote to memory of 668 1128 RegisterInstallStart.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\base\RegisterInstallStart.exe"C:\Users\Admin\AppData\Local\Temp\base\RegisterInstallStart.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1128 -s 11442⤵
- Program crash
PID:668
-