Analysis Overview
SHA256
40a3561b321f01b715274144fb75d79e4d3437cf10dcee86818b9a02f8849d20
Threat Level: Known bad
The file innosetup-6.2.1.exe was found to be: Known bad.
Malicious Activity Summary
Aurora
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-02-26 09:27
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-02-26 09:27
Reported
2023-02-26 09:29
Platform
win7-20230220-en
Max time kernel
31s
Max time network
34s
Command Line
Signatures
Aurora
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1992 set thread context of 1756 | N/A | C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe | C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"
C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 94.142.138.71:8081 | tcp |
Files
memory/1756-54-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-55-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-56-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-57-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-58-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-59-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-60-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-61-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-62-0x000007FFFFFDE000-0x000007FFFFFDF000-memory.dmp
memory/1756-63-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-65-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-66-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-67-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-68-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-69-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-70-0x0000000000400000-0x000000000075D000-memory.dmp
memory/1756-71-0x0000000000400000-0x000000000075D000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-02-26 09:27
Reported
2023-02-26 09:29
Platform
win10v2004-20230220-en
Max time kernel
55s
Max time network
73s
Command Line
Signatures
Aurora
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3816 set thread context of 2080 | N/A | C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe | C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"
C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"
C:\Windows\System32\Wbem\wmic.exe
wmic os get Caption
C:\Windows\system32\cmd.exe
cmd /C "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
cmd /C "wmic cpu get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 199.176.139.52.in-addr.arpa | udp |
| NL | 94.142.138.71:8081 | tcp | |
| US | 8.8.8.8:53 | 71.138.142.94.in-addr.arpa | udp |
| IE | 20.54.89.15:443 | tcp | |
| US | 8.8.8.8:53 | 151.122.125.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.36.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.8.109.52.in-addr.arpa | udp |
Files
memory/2080-133-0x0000000000440000-0x000000000079D000-memory.dmp
memory/2080-139-0x0000000000440000-0x000000000079D000-memory.dmp
memory/2080-145-0x0000000000440000-0x000000000079D000-memory.dmp
memory/2080-146-0x0000000000440000-0x000000000079D000-memory.dmp
memory/2080-147-0x0000000000440000-0x000000000079D000-memory.dmp
memory/2080-148-0x0000000000440000-0x000000000079D000-memory.dmp
memory/2080-149-0x0000000000440000-0x000000000079D000-memory.dmp
memory/2080-150-0x0000000000440000-0x000000000079D000-memory.dmp
memory/2080-151-0x0000000000440000-0x000000000079D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
| MD5 | 53bf804f75123ed2339305be1d298398 |
| SHA1 | 33a337e3e219da8ecd237b44fbcaf4864124a012 |
| SHA256 | 7d6155b8b6c9a78a70af6be7df47f1dac5f40215f4a6ae431d1ee27c021888f8 |
| SHA512 | 7611c75031b77b6098f1e70c1b27e0a95f259616f8b2f8acc734e371998badf321c10c9fb8669d61615673f0fb65787f0398966bda38cd430e009c83df00e16e |
C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL
| MD5 | b2446d155f77cf70a33bb0c25172fa3f |
| SHA1 | c20d68dad9e872b4607a5677c4851f863c28daf7 |
| SHA256 | 0faba9ea9b88b2982372c66b2eea8d6a5d99fc565c37db53ba6a4075619cfffb |
| SHA512 | 5d38e78c38f64a989570b431f7d2ef660c0678b3dc25baf3244499308535492de861a244e262720e36eeb4f8127eca62679c0b0383350c302783246191e82654 |
memory/2080-204-0x0000000000440000-0x000000000079D000-memory.dmp