8fc521653d7167d4339a6a158def934c8fa46d7f3c75eb1d3420f53069128561

General

Target

Driver Booster/IObit Driver Booster Pro 9.0.1.104/driver_booster_setup.exe
Size

25.6MB
MD5

2239050b84ccb221ee934b3f70e95a37
SHA1

18ebfc24a9078646d915aafba7f3b741dcee9540
SHA256

ce7419d681ced5a78e17a8e0253a495268e1b226e89663e094b5cea462380731
SHA512

556924369e2f3e8e78c56d9d4f5372be021a2edd2484daa2882663564bc90516ce1539ce6e5e3db0b493d5fc50875e5a5c667468857ab5bb0084eb81332caa60
SSDEEP

786432:jwly9Z49ItYMHxLuuA/BCPSaMNeC+SogJEEb7X9bM:jwlykL2uuKBC6aMN22EEC

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1636	driver_booster_setup.tmp
1568	setup.exe

Loads dropped DLL 4 IoCs

pid	Process
1468	driver_booster_setup.exe
1636	driver_booster_setup.tmp
1636	driver_booster_setup.tmp
1636	driver_booster_setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1636	driver_booster_setup.tmp
1636	driver_booster_setup.tmp
1568	setup.exe
1568	setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	driver_booster_setup.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	setup.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1636	1468	driver_booster_setup.exe	28
PID 1468 wrote to memory of 1636	1468	driver_booster_setup.exe	28
PID 1468 wrote to memory of 1636	1468	driver_booster_setup.exe	28
PID 1468 wrote to memory of 1636	1468	driver_booster_setup.exe	28
PID 1468 wrote to memory of 1636	1468	driver_booster_setup.exe	28
PID 1468 wrote to memory of 1636	1468	driver_booster_setup.exe	28
PID 1468 wrote to memory of 1636	1468	driver_booster_setup.exe	28
PID 1636 wrote to memory of 1568	1636	driver_booster_setup.tmp	29
PID 1636 wrote to memory of 1568	1636	driver_booster_setup.tmp	29
PID 1636 wrote to memory of 1568	1636	driver_booster_setup.tmp	29
PID 1636 wrote to memory of 1568	1636	driver_booster_setup.tmp	29
PID 1636 wrote to memory of 1568	1636	driver_booster_setup.tmp	29
PID 1636 wrote to memory of 1568	1636	driver_booster_setup.tmp	29
PID 1636 wrote to memory of 1568	1636	driver_booster_setup.tmp	29

C:\Users\Admin\AppData\Local\Temp\Driver Booster\IObit Driver Booster Pro 9.0.1.104\driver_booster_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Driver Booster\IObit Driver Booster Pro 9.0.1.104\driver_booster_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\is-DJSLS.tmp\driver_booster_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DJSLS.tmp\driver_booster_setup.tmp" /SL5="$80122,26073627,139264,C:\Users\Admin\AppData\Local\Temp\Driver Booster\IObit Driver Booster Pro 9.0.1.104\driver_booster_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\is-5K2NH.tmp-dbinst\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-5K2NH.tmp-dbinst\setup.exe" "C:\Users\Admin\AppData\Local\Temp\Driver Booster\IObit Driver Booster Pro 9.0.1.104\driver_booster_setup.exe" /title="Driver Booster 9" /dbver=9.0.1.104 /eula="C:\Users\Admin\AppData\Local\Temp\is-5K2NH.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmt
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-5K2NH.tmp-dbinst\setup.exe

Filesize
8.0MB

MD5
21529fbac4ff8cbd6c7bfbed738688a3

SHA1
7c34b3ffa84b9db355777c2ad0f2c4fb706ce01b

SHA256
bd1aa026c9309700a831a4052673c59651a082fc5a7bf7fcae515d4e2a6556fd

SHA512
45a2b7f5fe96b1e47977d01dd62ec9027207d5cfe455247ae17f0bd550a374df77aa99fd7ed3919754883312fb18f656f920e35715bce51797a3c4f8015b68b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5K2NH.tmp-dbinst\setup.exe

Filesize
8.0MB

MD5
21529fbac4ff8cbd6c7bfbed738688a3

SHA1
7c34b3ffa84b9db355777c2ad0f2c4fb706ce01b

SHA256
bd1aa026c9309700a831a4052673c59651a082fc5a7bf7fcae515d4e2a6556fd

SHA512
45a2b7f5fe96b1e47977d01dd62ec9027207d5cfe455247ae17f0bd550a374df77aa99fd7ed3919754883312fb18f656f920e35715bce51797a3c4f8015b68b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DJSLS.tmp\driver_booster_setup.tmp

Filesize
1.2MB

MD5
68b52a0b8e3d45bf3b520a0e7f16dad1

SHA1
e50408326eafb5ca8adc70db29c33b64e25bbbbd

SHA256
b409d6d6f8896dc2afd1774479c741ca253c0e9b4732daaa08af84aa9c96888b

SHA512
b8e0b486e2b9652831eb8efe48cf9575eef49204e827a64d69ae7c9c30304b2d98a66c28f1072fe8596847c15f13bbf7ec39d7708684ff64051bbae7ed063faf

Download Submit
\Users\Admin\AppData\Local\Temp\is-5K2NH.tmp-dbinst\setup.exe

Filesize
8.0MB

MD5
21529fbac4ff8cbd6c7bfbed738688a3

SHA1
7c34b3ffa84b9db355777c2ad0f2c4fb706ce01b

SHA256
bd1aa026c9309700a831a4052673c59651a082fc5a7bf7fcae515d4e2a6556fd

SHA512
45a2b7f5fe96b1e47977d01dd62ec9027207d5cfe455247ae17f0bd550a374df77aa99fd7ed3919754883312fb18f656f920e35715bce51797a3c4f8015b68b8

Download Submit
\Users\Admin\AppData\Local\Temp\is-5K2NH.tmp\DriverBooster.exe

Filesize
7.9MB

MD5
2b994e42e6f79965a135777883d5313e

SHA1
f3cb6bd1bc12ff7a82a0da03faa133f812ba17ab

SHA256
bc71d94d6e1e0270b41b771dcff18c6e9c7de5a0e8115e0b5cdeb021c1430f10

SHA512
3d7897c2220963530c62379cc5951c7e60da430601cf79cef99719bb9ed77845057eb236c1a9312da6147066ad678edbd0d74e7f3be9f23bc081d49e42fd9537

Download Submit
\Users\Admin\AppData\Local\Temp\is-5K2NH.tmp\DriverBooster.exe

Filesize
7.9MB

MD5
2b994e42e6f79965a135777883d5313e

SHA1
f3cb6bd1bc12ff7a82a0da03faa133f812ba17ab

SHA256
bc71d94d6e1e0270b41b771dcff18c6e9c7de5a0e8115e0b5cdeb021c1430f10

SHA512
3d7897c2220963530c62379cc5951c7e60da430601cf79cef99719bb9ed77845057eb236c1a9312da6147066ad678edbd0d74e7f3be9f23bc081d49e42fd9537

Download Submit
\Users\Admin\AppData\Local\Temp\is-DJSLS.tmp\driver_booster_setup.tmp

Filesize
1.2MB

MD5
68b52a0b8e3d45bf3b520a0e7f16dad1

SHA1
e50408326eafb5ca8adc70db29c33b64e25bbbbd

SHA256
b409d6d6f8896dc2afd1774479c741ca253c0e9b4732daaa08af84aa9c96888b

SHA512
b8e0b486e2b9652831eb8efe48cf9575eef49204e827a64d69ae7c9c30304b2d98a66c28f1072fe8596847c15f13bbf7ec39d7708684ff64051bbae7ed063faf

Download Submit
memory/1468-61-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1468-54-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1468-68-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1468-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1568-70-0x0000000074141000-0x0000000074143000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing