Overview

overview

8

Static

static

1

Setup_File...22.exe

windows7-x64

7

Setup_File...22.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    79s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    03-03-2023 15:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup_FileViewPro_2022.exe

  • Size

    1.3MB

  • MD5

    5cb079f8ec885592c5538dbe0362d593

  • SHA1

    a5702ea5dfd73c619ad2625e645b93e0a39b1451

  • SHA256

    532a7d66259842f4a710ea7bc6dc48547de371bb69fc842f53934876e787efb8

  • SHA512

    8787a51f3e7eacfd5f507abdfacd58aef34a704d01f84c05ec8074cb77318d3b14223ff2ca3da399633ef82d3529266bcf3bb174bf746450697117915641fb90

  • SSDEEP

    24576:Ch6SVFzDl6eZmL4v9IoYOlrQ14T1+G05hKwzlXX8l8whkwBY2/+WLHkOU:q6UXtvDz85hK8XM8rcY/OU

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup_FileViewPro_2022.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup_FileViewPro_2022.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Users\Admin\AppData\Local\Temp\{36285A4D-4BF8-4FFC-8B23-A6E8BDD8E47C}\FileViewPro-S-1.9.8.19.exe
      "C:\Users\Admin\AppData\Local\Temp\{36285A4D-4BF8-4FFC-8B23-A6E8BDD8E47C}\FileViewPro-S-1.9.8.19.exe" /verysilent /norestart /LANG es
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:588
      • C:\Users\Admin\AppData\Local\Temp\is-CV97E.tmp\FileViewPro-S-1.9.8.19.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-CV97E.tmp\FileViewPro-S-1.9.8.19.tmp" /SL5="$20192,60311066,131584,C:\Users\Admin\AppData\Local\Temp\{36285A4D-4BF8-4FFC-8B23-A6E8BDD8E47C}\FileViewPro-S-1.9.8.19.exe" /verysilent /norestart /LANG es
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:1516

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\FileViewPro\Wps\is-1G6TT.tmp
    Filesize

    133KB

    MD5

    4348b879e87211ca9059ff090a6872c9

    SHA1

    048c395296eeb2af3fda21c820e33e7a06fae82a

    SHA256

    ed016605bded2acc91854d33ffdefa6ec92dfbc84313d086a250cf75e891e659

    SHA512

    89d60cd3cf71e8f9132b81c917038b0702299851f2b3656a4f408d2845e4b52062f64390392a0ee43a3533a6f92d38f805f0b2a45db1be4f3eb660c4851d61a7

    Download Submit

  • C:\Program Files\FileViewPro\unins000.exe
    Filesize

    1.1MB

    MD5

    1a81372fd72743199f885cfed00c8e34

    SHA1

    7bb1a83593d07b3833c58150a0a678fc5898aca2

    SHA256

    fa6030367c0645fe9856ab1b75910c94e4ef32fdcede0ccd2805c6b2cef5f5ab

    SHA512

    ec79c5efaf4ff5288cca4c9ab7ddc962f17e6b1d92a8b63463ee0fbad889229eae5f3af3af831f209bc8a322a73cafa783d7aef698663bbe288bdda6cd3e5c0b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-CV97E.tmp\FileViewPro-S-1.9.8.19.tmp
    Filesize

    1.1MB

    MD5

    1a81372fd72743199f885cfed00c8e34

    SHA1

    7bb1a83593d07b3833c58150a0a678fc5898aca2

    SHA256

    fa6030367c0645fe9856ab1b75910c94e4ef32fdcede0ccd2805c6b2cef5f5ab

    SHA512

    ec79c5efaf4ff5288cca4c9ab7ddc962f17e6b1d92a8b63463ee0fbad889229eae5f3af3af831f209bc8a322a73cafa783d7aef698663bbe288bdda6cd3e5c0b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-CV97E.tmp\FileViewPro-S-1.9.8.19.tmp
    Filesize

    1.1MB

    MD5

    1a81372fd72743199f885cfed00c8e34

    SHA1

    7bb1a83593d07b3833c58150a0a678fc5898aca2

    SHA256

    fa6030367c0645fe9856ab1b75910c94e4ef32fdcede0ccd2805c6b2cef5f5ab

    SHA512

    ec79c5efaf4ff5288cca4c9ab7ddc962f17e6b1d92a8b63463ee0fbad889229eae5f3af3af831f209bc8a322a73cafa783d7aef698663bbe288bdda6cd3e5c0b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{36285A4D-4BF8-4FFC-8B23-A6E8BDD8E47C}\FileViewPro-S-1.9.8.19.exe
    Filesize

    58.1MB

    MD5

    35bc3d926698c1f580603e7a5c4b0cc6

    SHA1

    7aaacafbf325c08b4ef577994505fbf0cce87fc6

    SHA256

    b3a64b2c2d3292de9a9e9f590bf3ce04aecc8483af8f181f57aee1dad375e1be

    SHA512

    1e77629bba2eda9c4b7d0701785561c2326953b924984d08db177d02ef3f4e752ed1f37005e63aaa1b327db9294c076aa0447ed71c974da4410f4bee10872652

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{36285A4D-4BF8-4FFC-8B23-A6E8BDD8E47C}\FileViewPro-S-1.9.8.19.exe
    Filesize

    58.1MB

    MD5

    35bc3d926698c1f580603e7a5c4b0cc6

    SHA1

    7aaacafbf325c08b4ef577994505fbf0cce87fc6

    SHA256

    b3a64b2c2d3292de9a9e9f590bf3ce04aecc8483af8f181f57aee1dad375e1be

    SHA512

    1e77629bba2eda9c4b7d0701785561c2326953b924984d08db177d02ef3f4e752ed1f37005e63aaa1b327db9294c076aa0447ed71c974da4410f4bee10872652

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{36285A4D-4BF8-4FFC-8B23-A6E8BDD8E47C}\FileViewPro-S-1.9.8.19.exe
    Filesize

    58.1MB

    MD5

    35bc3d926698c1f580603e7a5c4b0cc6

    SHA1

    7aaacafbf325c08b4ef577994505fbf0cce87fc6

    SHA256

    b3a64b2c2d3292de9a9e9f590bf3ce04aecc8483af8f181f57aee1dad375e1be

    SHA512

    1e77629bba2eda9c4b7d0701785561c2326953b924984d08db177d02ef3f4e752ed1f37005e63aaa1b327db9294c076aa0447ed71c974da4410f4bee10872652

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{D03703EA-62DE-4CE6-AFF7-801191BB8238}\resources.1.0.0.34s
    Filesize

    1.6MB

    MD5

    65a9517b73bcfc01b3d46f715bf92c36

    SHA1

    444bbd5cdd8f9e4fe1be79a7c5dbcd2164765226

    SHA256

    835a6309713ce9102456ed8ce3b211cc1055fc17c981205e263859b21d6031f2

    SHA512

    7dcf27a044323485d93cef39e920acfb4cce24f2a09b55bcbfac174aa98f580d8c8078beb74b99886061b18be14ae38e452dd0187431820beebbf760db8a7496

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-CV97E.tmp\FileViewPro-S-1.9.8.19.tmp
    Filesize

    1.1MB

    MD5

    1a81372fd72743199f885cfed00c8e34

    SHA1

    7bb1a83593d07b3833c58150a0a678fc5898aca2

    SHA256

    fa6030367c0645fe9856ab1b75910c94e4ef32fdcede0ccd2805c6b2cef5f5ab

    SHA512

    ec79c5efaf4ff5288cca4c9ab7ddc962f17e6b1d92a8b63463ee0fbad889229eae5f3af3af831f209bc8a322a73cafa783d7aef698663bbe288bdda6cd3e5c0b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-J43P3.tmp\isxdl.dll
    Filesize

    121KB

    MD5

    48ad1a1c893ce7bf456277a0a085ed01

    SHA1

    803997ef17eedf50969115c529a2bf8de585dc91

    SHA256

    b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

    SHA512

    7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

    Download Submit

  • \Users\Admin\AppData\Local\Temp\{36285A4D-4BF8-4FFC-8B23-A6E8BDD8E47C}\FileViewPro-S-1.9.8.19.exe
    Filesize

    58.1MB

    MD5

    35bc3d926698c1f580603e7a5c4b0cc6

    SHA1

    7aaacafbf325c08b4ef577994505fbf0cce87fc6

    SHA256

    b3a64b2c2d3292de9a9e9f590bf3ce04aecc8483af8f181f57aee1dad375e1be

    SHA512

    1e77629bba2eda9c4b7d0701785561c2326953b924984d08db177d02ef3f4e752ed1f37005e63aaa1b327db9294c076aa0447ed71c974da4410f4bee10872652

    Download Submit

  • \Users\Admin\AppData\Local\Temp\{36285A4D-4BF8-4FFC-8B23-A6E8BDD8E47C}\FileViewPro-S-1.9.8.19.exe
    Filesize

    58.1MB

    MD5

    35bc3d926698c1f580603e7a5c4b0cc6

    SHA1

    7aaacafbf325c08b4ef577994505fbf0cce87fc6

    SHA256

    b3a64b2c2d3292de9a9e9f590bf3ce04aecc8483af8f181f57aee1dad375e1be

    SHA512

    1e77629bba2eda9c4b7d0701785561c2326953b924984d08db177d02ef3f4e752ed1f37005e63aaa1b327db9294c076aa0447ed71c974da4410f4bee10872652

    Download Submit

  • \Users\Admin\AppData\Local\Temp\{36285A4D-4BF8-4FFC-8B23-A6E8BDD8E47C}\FileViewPro-S-1.9.8.19.exe
    Filesize

    58.1MB

    MD5

    35bc3d926698c1f580603e7a5c4b0cc6

    SHA1

    7aaacafbf325c08b4ef577994505fbf0cce87fc6

    SHA256

    b3a64b2c2d3292de9a9e9f590bf3ce04aecc8483af8f181f57aee1dad375e1be

    SHA512

    1e77629bba2eda9c4b7d0701785561c2326953b924984d08db177d02ef3f4e752ed1f37005e63aaa1b327db9294c076aa0447ed71c974da4410f4bee10872652

    Download Submit

  • \Users\Admin\AppData\Local\Temp\{36285A4D-4BF8-4FFC-8B23-A6E8BDD8E47C}\FileViewPro-S-1.9.8.19.exe
    Filesize

    58.1MB

    MD5

    35bc3d926698c1f580603e7a5c4b0cc6

    SHA1

    7aaacafbf325c08b4ef577994505fbf0cce87fc6

    SHA256

    b3a64b2c2d3292de9a9e9f590bf3ce04aecc8483af8f181f57aee1dad375e1be

    SHA512

    1e77629bba2eda9c4b7d0701785561c2326953b924984d08db177d02ef3f4e752ed1f37005e63aaa1b327db9294c076aa0447ed71c974da4410f4bee10872652

    Download Submit

  • memory/588-81-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/588-115-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/588-89-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/1516-92-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1516-116-0x0000000000400000-0x0000000000530000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1516-143-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1516-151-0x0000000000400000-0x0000000000530000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1516-362-0x0000000000400000-0x0000000000530000-memory.dmp

    Filesize

    1.2MB

    Download