Analysis
-
max time kernel
86s -
max time network
83s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
06/02/2023, 06:42
General
-
Target
VID_0810&PID_0001 Twin USB Gamepad 64Bit Setup2.exe
-
Size
2.3MB
-
MD5
d011cadd7194bfb7b3bcaa5b68bf3369
-
SHA1
32811e5155f00cc50e191d54334be9c9d8b67e8d
-
SHA256
952b032de2c7d60459747c29546f5a6327803534e06a0e704c1147783b06e350
-
SHA512
3b7c92bc1ab9d8ba63d31f0216fdf6ac2c4ced4812990263e7acee711b625da181b5be4c07ca35946802da5e6b33357397c23446926e5e34eb80f824b0548823
-
SSDEEP
49152:johTR5c9CsOBSGzJmdTd92PnLPaAU8Tnma8ohTR5c9CsOhZq:8THc9le1zJmdr2Dajmn9ZTHc9lz
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 6 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 18 IoCs
-
Registers COM server for autorun 1 TTPs 6 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 27 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VID_0810&PID_0001 Twin USB Gamepad 64Bit Setup2.exe"C:\Users\Admin\AppData\Local\Temp\VID_0810&PID_0001 Twin USB Gamepad 64Bit Setup2.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{B6C9BBF7-5177-49F4-9D5D-C2A3E8D845D4}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{B6C9BBF7-5177-49F4-9D5D-C2A3E8D845D4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{19029EFC-95DF-4EB9-BBDD-E11C590EED6E}2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5982fdf0a4ee8588d481021ff49c3f5ab
SHA1b2af7474556fd27dbe4a6f550d852c88ae3c4bb5
SHA2566d63a921e550ffdc7fb1574d7323bf3c670da2a53814236988b0e76948135133
SHA512377a53f54fa487ed9ea31ccdb59f567a96c65cb4a5e41efc562968008b1ec5b2c618f5f102a86df4e6a9a7616a948816e8d49d10767ab3f5f4c9c8247d079c42
-
Filesize
58KB
MD5982fdf0a4ee8588d481021ff49c3f5ab
SHA1b2af7474556fd27dbe4a6f550d852c88ae3c4bb5
SHA2566d63a921e550ffdc7fb1574d7323bf3c670da2a53814236988b0e76948135133
SHA512377a53f54fa487ed9ea31ccdb59f567a96c65cb4a5e41efc562968008b1ec5b2c618f5f102a86df4e6a9a7616a948816e8d49d10767ab3f5f4c9c8247d079c42
-
Filesize
42KB
MD516537c9fb23151ec8a6e303c6f6a0ee4
SHA184cc8b7eb9e9c0b6fac3ff49425b42658c2e425a
SHA256d1c830e55b710bb6f66a9178c95b0e3235ff1927fb4e577160b05fc6da5bde87
SHA51263dfdcecdc5c2edd703fa4bedd59f4887be8a33c6f8608cc437dc68e9c5bb852e6fa0db7020c9b4e17ccdb71a8aa352c7d806363f97eb5711da4b9af070848b7
-
Filesize
42KB
MD516537c9fb23151ec8a6e303c6f6a0ee4
SHA184cc8b7eb9e9c0b6fac3ff49425b42658c2e425a
SHA256d1c830e55b710bb6f66a9178c95b0e3235ff1927fb4e577160b05fc6da5bde87
SHA51263dfdcecdc5c2edd703fa4bedd59f4887be8a33c6f8608cc437dc68e9c5bb852e6fa0db7020c9b4e17ccdb71a8aa352c7d806363f97eb5711da4b9af070848b7
-
Filesize
79KB
MD567b559c01904760a095abf22561e68e5
SHA13ce8e1b78bffb6637adcf0242825a8ecbf5217eb
SHA256bf23b0de818711af4c1c77cd004fd5ff20eeb45829673003e2ff1ded2fe83484
SHA512ffbb6347f0ae6203d2e3383091b17c7865111652a8d4176321ef75aeb2196f25044b5ac3a0a3e66f5846e98043986937cf87d9549da709bb413f3f9e7a554acc
-
Filesize
79KB
MD567b559c01904760a095abf22561e68e5
SHA13ce8e1b78bffb6637adcf0242825a8ecbf5217eb
SHA256bf23b0de818711af4c1c77cd004fd5ff20eeb45829673003e2ff1ded2fe83484
SHA512ffbb6347f0ae6203d2e3383091b17c7865111652a8d4176321ef75aeb2196f25044b5ac3a0a3e66f5846e98043986937cf87d9549da709bb413f3f9e7a554acc
-
Filesize
79KB
MD567b559c01904760a095abf22561e68e5
SHA13ce8e1b78bffb6637adcf0242825a8ecbf5217eb
SHA256bf23b0de818711af4c1c77cd004fd5ff20eeb45829673003e2ff1ded2fe83484
SHA512ffbb6347f0ae6203d2e3383091b17c7865111652a8d4176321ef75aeb2196f25044b5ac3a0a3e66f5846e98043986937cf87d9549da709bb413f3f9e7a554acc
-
Filesize
79KB
MD567b559c01904760a095abf22561e68e5
SHA13ce8e1b78bffb6637adcf0242825a8ecbf5217eb
SHA256bf23b0de818711af4c1c77cd004fd5ff20eeb45829673003e2ff1ded2fe83484
SHA512ffbb6347f0ae6203d2e3383091b17c7865111652a8d4176321ef75aeb2196f25044b5ac3a0a3e66f5846e98043986937cf87d9549da709bb413f3f9e7a554acc
-
Filesize
57KB
MD5c135522aa3b501e243d2776c314ac2c8
SHA1adc4732a2c63d6301541a9bb26b8fecce08237b2
SHA25631313e18a0e3789de0afa192d97583639099f70bef3b8fbe17f4f7bc1756949d
SHA512318ca8913eb928f69403a78a744f97222e3e13db6780f76a6d0b8977dad1df80d5c11f23e6b2ed6443ccee4c6fe6c6c03efd6e317de6a3a2bc5d524c356f0cae
-
Filesize
57KB
MD5c135522aa3b501e243d2776c314ac2c8
SHA1adc4732a2c63d6301541a9bb26b8fecce08237b2
SHA25631313e18a0e3789de0afa192d97583639099f70bef3b8fbe17f4f7bc1756949d
SHA512318ca8913eb928f69403a78a744f97222e3e13db6780f76a6d0b8977dad1df80d5c11f23e6b2ed6443ccee4c6fe6c6c03efd6e317de6a3a2bc5d524c356f0cae
-
Filesize
57KB
MD5c135522aa3b501e243d2776c314ac2c8
SHA1adc4732a2c63d6301541a9bb26b8fecce08237b2
SHA25631313e18a0e3789de0afa192d97583639099f70bef3b8fbe17f4f7bc1756949d
SHA512318ca8913eb928f69403a78a744f97222e3e13db6780f76a6d0b8977dad1df80d5c11f23e6b2ed6443ccee4c6fe6c6c03efd6e317de6a3a2bc5d524c356f0cae
-
Filesize
57KB
MD5c135522aa3b501e243d2776c314ac2c8
SHA1adc4732a2c63d6301541a9bb26b8fecce08237b2
SHA25631313e18a0e3789de0afa192d97583639099f70bef3b8fbe17f4f7bc1756949d
SHA512318ca8913eb928f69403a78a744f97222e3e13db6780f76a6d0b8977dad1df80d5c11f23e6b2ed6443ccee4c6fe6c6c03efd6e317de6a3a2bc5d524c356f0cae
-
Filesize
52KB
MD59cf7faee57a20bf15a2fc9b423ebc512
SHA112cbf4d0a941bd5a8f847754fdaf4841e7751cce
SHA256d34f26d85bfb94a5f017fdaf58b94ecf9553919d2aa9a9955ff0a2e3d7c11e4a
SHA51244c715be4a98b9ce99c6d926500be3e365f8a08a4d8c85ae9342dc9ce76de29544f14acbf42d69f7f9e40ebdf0c6faa8cb5d4b3fc9d523479b12cf0823678672
-
Filesize
539KB
MD5a06ed9fcd8f114e270aa64c46063d8c3
SHA1e091914d4e2ba90e468ef4e13420bed24146bac6
SHA2564663e033c1f188ed66d3c413064bfa104f6c307ed10a918afd2b8373130a779a
SHA51246393550796bc8211ecd96e31ccb5bf65c437d6d1857d548dbd8836192aa6b299feefb617b59fc9c7a251cb259c6dc477f17d044d201621ad315b06db5749102
-
Filesize
539KB
MD5a06ed9fcd8f114e270aa64c46063d8c3
SHA1e091914d4e2ba90e468ef4e13420bed24146bac6
SHA2564663e033c1f188ed66d3c413064bfa104f6c307ed10a918afd2b8373130a779a
SHA51246393550796bc8211ecd96e31ccb5bf65c437d6d1857d548dbd8836192aa6b299feefb617b59fc9c7a251cb259c6dc477f17d044d201621ad315b06db5749102
-
Filesize
160KB
MD530ebd4e80b1dda05eac709a1dc5965b4
SHA12418232370026574baabc84b105f6dd9e458ad86
SHA2568802e54ce01babf7bb22d0da5c83bebc5c05d0ccd73566a5f836690e9278a696
SHA5125115afea66734fe53c9479a6569b7fbc1ef395432781367cd68c7f4878ca3884bad0a960f76db2a40314484f329c4288a6ecf4a93cc49642c5e412448c5a2557
-
Filesize
160KB
MD530ebd4e80b1dda05eac709a1dc5965b4
SHA12418232370026574baabc84b105f6dd9e458ad86
SHA2568802e54ce01babf7bb22d0da5c83bebc5c05d0ccd73566a5f836690e9278a696
SHA5125115afea66734fe53c9479a6569b7fbc1ef395432781367cd68c7f4878ca3884bad0a960f76db2a40314484f329c4288a6ecf4a93cc49642c5e412448c5a2557
-
Filesize
68KB
MD54b56c021299344676f123fcb48f53c1e
SHA1cbef3152c477c9176120030b164a4a807b527d8e
SHA2560444971c7c19df0c4e5f8ad75c12ac277638470460eb7747122539960ed5e99f
SHA512097bbc9f0140e9a14e494b6569e38b88ad390d6befa03e75a8c671e2e5fd93ee55ad50994733c957c32c85f2061d6f4d32b4b8257b3b44d5924ca10e940f779a
-
Filesize
68KB
MD54b56c021299344676f123fcb48f53c1e
SHA1cbef3152c477c9176120030b164a4a807b527d8e
SHA2560444971c7c19df0c4e5f8ad75c12ac277638470460eb7747122539960ed5e99f
SHA512097bbc9f0140e9a14e494b6569e38b88ad390d6befa03e75a8c671e2e5fd93ee55ad50994733c957c32c85f2061d6f4d32b4b8257b3b44d5924ca10e940f779a
-
Filesize
120KB
MD5e54601d8a464a455de081d63d4b7927d
SHA10ff6da399c123394cca3b4cc64a41d8037787b73
SHA2561e154a29673d129414ab56b995d04afcfa1a02af47dabaa28cd11c25f7d6026a
SHA5125a213430fb8dc6a19c24122f8d9cd03479ee7ae421eac77d1026f16bf520a1f113d43380e2a60d5f0133e09aa7ad323a7ef9d1cccc3eea1e905f09701b118e05
-
Filesize
120KB
MD5e54601d8a464a455de081d63d4b7927d
SHA10ff6da399c123394cca3b4cc64a41d8037787b73
SHA2561e154a29673d129414ab56b995d04afcfa1a02af47dabaa28cd11c25f7d6026a
SHA5125a213430fb8dc6a19c24122f8d9cd03479ee7ae421eac77d1026f16bf520a1f113d43380e2a60d5f0133e09aa7ad323a7ef9d1cccc3eea1e905f09701b118e05
-
Filesize
203KB
MD5b35dde51d14f9400e73196693148734e
SHA19410c5268f5558e57d044780d0d5dcc7aa181299
SHA25670fa7f0aa2feb397597b2785a4bfdb2c9cd36e0edb51f4f0dfe6ac086290ac86
SHA5126bb24c8864078c923007c1818bb0a590ebe84e2fbe6f2642dc951b05c42da1c33861f150c4ea8943657259c1c309a69b8cb1817b6a207cb9e577bc3aa8bfa79d
-
Filesize
203KB
MD5b35dde51d14f9400e73196693148734e
SHA19410c5268f5558e57d044780d0d5dcc7aa181299
SHA25670fa7f0aa2feb397597b2785a4bfdb2c9cd36e0edb51f4f0dfe6ac086290ac86
SHA5126bb24c8864078c923007c1818bb0a590ebe84e2fbe6f2642dc951b05c42da1c33861f150c4ea8943657259c1c309a69b8cb1817b6a207cb9e577bc3aa8bfa79d
-
Filesize
576KB
-
Filesize
1.6MB
-
Filesize
56KB
-
Filesize
568KB
-
Filesize
100KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
56KB
-
Filesize
76KB
-
Filesize
52KB
-
Filesize
68KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB