Overview

overview

10

Static

static

1

MBSetup.exe

windows10-1703-x64

8

MBSetup.exe

windows7-x64

8

MBSetup.exe

windows10-2004-x64

Analysis

  • max time kernel
    233s
  • max time network
    237s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-02-2023 01:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MBSetup.exe

  • Size

    2.4MB

  • MD5

    e8a9e2ba85ba4a91c714e25f97227bb6

  • SHA1

    175bbcda38deb982ebc12ae4589445ff98eb1851

  • SHA256

    d3e21e607c9b4e4c1d9cc08d38aca37b91544fbfd5a9b7aca3485215ef41fbef

  • SHA512

    c240b644fe77972982924d7347fa6f874fafdc97938dc20988d7d20edc8051059f7ca102bfddb2d5d7ebd69c6664d9ee793f1f26ba8c15eddc0e43e1b7015f58

  • SSDEEP

    49152:ViT6ISa9C/5BirX0wxZN2DxiIq2d4BW3y3LP:VpISa0u/WRq2

Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 5 IoCs
  • Modifies data under HKEY_USERS 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MBSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Program Files directory
    PID:2248
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    PID:3988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
    Filesize

    8.6MB

    MD5

    f72076a37f16ee94d1d743703530f8c5

    SHA1

    a06165df6ef5eca3f768056f310d6db53fc70748

    SHA256

    82778f81a4bbbbdebad965e41f4d918a55ad8c1e035627739b1f14cb2b984fab

    SHA512

    62b838f552ce8a3fe97cd8de2e616eda821624de223efe27a8b901fffc2dfe1deff4b622a2a8ebaffa8395810f01a84b23744754b7cebe7404ea0bd5e399a763

    Download Submit
  • memory/2248-116-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-117-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-118-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-119-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-120-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-121-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-122-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-123-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-124-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-125-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-126-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-127-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-129-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-130-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-131-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-128-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-132-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-133-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-134-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-135-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-136-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-137-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-138-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-139-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-140-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-141-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-143-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-142-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-144-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-145-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-146-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-147-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-148-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-150-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-149-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-151-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-152-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-153-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-154-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-155-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-156-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-157-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-158-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-159-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-160-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-161-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-162-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-163-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-164-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-165-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-166-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-167-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-168-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-170-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-169-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-172-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-171-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-173-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-174-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-175-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-176-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-177-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-178-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2248-179-0x0000000077470000-0x00000000775FE000-memory.dmp
    Filesize

    1.6MB

    Download