Analysis
-
max time kernel
72s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
09/03/2023, 07:29
General
-
Target
systeminformer-3.0.6264-setup.exe
-
Size
11.0MB
-
MD5
89b57d6f8e581102346b4fb85d0a7379
-
SHA1
ece482717d5ad32d49b1dd2db0352582ebcea67c
-
SHA256
484f3226f4f4f231ba4043f144417d3f480bc23825ddcabcef24ef9ec359bfde
-
SHA512
e00ed80dbcc8bb117dbb02c98e2f4671c2100911c9bbd347b4d553d2d6b23cfc7c5bd3dd791ffc514f487acc14fc6202ac6061eb806b3f4bbfb84b1437f74a79
-
SSDEEP
196608:wYarIzzZuo1UsEI/AejOIGkoBgK5PgsuF25w8hBnFsVJ1LvHuTwrIzzZqW5b6Oxy:wYmIson5o4RK5Pq26+BnFK7qoIPeOx2H
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 11 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 35 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 51 IoCs
-
Suspicious use of SendNotifyMessage 51 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\systeminformer-3.0.6264-setup.exe"C:\Users\Admin\AppData\Local\Temp\systeminformer-3.0.6264-setup.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\SystemInformer\SystemInformer.exe"C:\Program Files\SystemInformer\SystemInformer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD563391d94bcb87c3625ea1814eb346d13
SHA1a8bd5e7ee38378cbb6d7817cdaa3dd62c57eb687
SHA2563be170bb981a40451da7828ce425e658c2a6951c8ae40f60e34e2105fe22f8e6
SHA5124c3e526dee35991846b35e7d3be3545c722c402cf99a8f1eef5fccd03b21cdd9d9f2756bb74bf71923b0dc7c6307cce8988876b37a7b7b8bf036148f30cc7c22
-
Filesize
2.8MB
MD563391d94bcb87c3625ea1814eb346d13
SHA1a8bd5e7ee38378cbb6d7817cdaa3dd62c57eb687
SHA2563be170bb981a40451da7828ce425e658c2a6951c8ae40f60e34e2105fe22f8e6
SHA5124c3e526dee35991846b35e7d3be3545c722c402cf99a8f1eef5fccd03b21cdd9d9f2756bb74bf71923b0dc7c6307cce8988876b37a7b7b8bf036148f30cc7c22
-
Filesize
2.8MB
MD563391d94bcb87c3625ea1814eb346d13
SHA1a8bd5e7ee38378cbb6d7817cdaa3dd62c57eb687
SHA2563be170bb981a40451da7828ce425e658c2a6951c8ae40f60e34e2105fe22f8e6
SHA5124c3e526dee35991846b35e7d3be3545c722c402cf99a8f1eef5fccd03b21cdd9d9f2756bb74bf71923b0dc7c6307cce8988876b37a7b7b8bf036148f30cc7c22
-
Filesize
188KB
MD51ead08b1a837baae220337acfb94de9d
SHA1bbbea6a2ff5ce48c0f939ef53eb89eaf358c3d3b
SHA256b699650dc5c7e1af70abd39bd04b694e0f5e90a3426dc44703410d636ded564e
SHA5125067787a96511c4f3428279b91c986fc0dd68fe4d34f3de5bf83f3436605868ac13f9764be655cccc8b8ce61893ade34f2d58a1f09ad64d41e6c4392962da500
-
Filesize
188KB
MD51ead08b1a837baae220337acfb94de9d
SHA1bbbea6a2ff5ce48c0f939ef53eb89eaf358c3d3b
SHA256b699650dc5c7e1af70abd39bd04b694e0f5e90a3426dc44703410d636ded564e
SHA5125067787a96511c4f3428279b91c986fc0dd68fe4d34f3de5bf83f3436605868ac13f9764be655cccc8b8ce61893ade34f2d58a1f09ad64d41e6c4392962da500
-
Filesize
136KB
MD5dddbf56d64af18b9f800457a59ff3f98
SHA189ae27d771346a8866f8aa12c2e80fd260cda4cd
SHA256a0710dd6e11942af3ecfee66c6d1b96c1bdaf9ff5826219111529f638e32553e
SHA51227b095715436f8c7c08211eabe17db0da06a7d79d9032cee619b0ca3b1cba604d4866d15b1e760a89b5eb4edee94b2440efe33e048e0f8559165a47a5628bfac
-
Filesize
136KB
MD5dddbf56d64af18b9f800457a59ff3f98
SHA189ae27d771346a8866f8aa12c2e80fd260cda4cd
SHA256a0710dd6e11942af3ecfee66c6d1b96c1bdaf9ff5826219111529f638e32553e
SHA51227b095715436f8c7c08211eabe17db0da06a7d79d9032cee619b0ca3b1cba604d4866d15b1e760a89b5eb4edee94b2440efe33e048e0f8559165a47a5628bfac
-
Filesize
184KB
MD59c5bd655935a575a0a7fd1902da436e9
SHA1d17587ca553c9003a7534bd2fb1d5f546f2963ba
SHA2567af19258a5dab7e8459cb1a9c4b61af45fc4270e8ed128f823f1812f72501a3f
SHA5129f83f723e9f48ad64ced38ecdf2386cb82858ca1f02472f98b30f33de45615c10dc2b3e3807316b31a59f6006c3b622fab591ff8f0622a5dee944eb1c4147e26
-
Filesize
184KB
MD59c5bd655935a575a0a7fd1902da436e9
SHA1d17587ca553c9003a7534bd2fb1d5f546f2963ba
SHA2567af19258a5dab7e8459cb1a9c4b61af45fc4270e8ed128f823f1812f72501a3f
SHA5129f83f723e9f48ad64ced38ecdf2386cb82858ca1f02472f98b30f33de45615c10dc2b3e3807316b31a59f6006c3b622fab591ff8f0622a5dee944eb1c4147e26
-
Filesize
1.4MB
MD556ffaa20a40e2488718f9dceed3c48d6
SHA1e17a54bca4f51c62feb8e0e332bc19a83e7d850c
SHA256e23586f5357de3c3a2cd902cfb10b003645f1edcc9be3c334e9ad0d1eccf1a90
SHA51281cf44587accb4e821e080aa590665e3253fdd577918836f6d8a3dcb40cf436062bc021d2e863f10bb160d539602b2f98fa17b62856a8fd014446a8fa21d2274
-
Filesize
1.4MB
MD556ffaa20a40e2488718f9dceed3c48d6
SHA1e17a54bca4f51c62feb8e0e332bc19a83e7d850c
SHA256e23586f5357de3c3a2cd902cfb10b003645f1edcc9be3c334e9ad0d1eccf1a90
SHA51281cf44587accb4e821e080aa590665e3253fdd577918836f6d8a3dcb40cf436062bc021d2e863f10bb160d539602b2f98fa17b62856a8fd014446a8fa21d2274
-
Filesize
328KB
MD51ec2c6af41f31bbde7e039ee10049940
SHA1abf17686f88fb2efec64585b883ef010375ec9c0
SHA2566f0b09880db4a5f0b8a26b64bb09a903e418359673a25131da15ad9ebd581fbd
SHA51277e120e7eefb8ce4bdccfc0a2e48ab0eae9001d6c99c254f6a8313fc4b0a4bb56f6cec2855873a03872570b7de5688fa5da02659ebd5669d634cb9ba7aa64862
-
Filesize
328KB
MD51ec2c6af41f31bbde7e039ee10049940
SHA1abf17686f88fb2efec64585b883ef010375ec9c0
SHA2566f0b09880db4a5f0b8a26b64bb09a903e418359673a25131da15ad9ebd581fbd
SHA51277e120e7eefb8ce4bdccfc0a2e48ab0eae9001d6c99c254f6a8313fc4b0a4bb56f6cec2855873a03872570b7de5688fa5da02659ebd5669d634cb9ba7aa64862
-
Filesize
616KB
MD5c9497ba47af3776e43bf4d8358e8b8f5
SHA12caa55327bdb640317223c406f3d413404c1852c
SHA2562b209cf9762dd21578433ffac309bfee1199dc2ca1dba2b9aa11b643eb0ba281
SHA512c164650a16c3207d934c8156686359b47c6243fa770e5c2690ac3f5ac131426ccf8a267775d181e4a01132ecc58a194d461a834934abe5751137680731b77990
-
Filesize
616KB
MD5c9497ba47af3776e43bf4d8358e8b8f5
SHA12caa55327bdb640317223c406f3d413404c1852c
SHA2562b209cf9762dd21578433ffac309bfee1199dc2ca1dba2b9aa11b643eb0ba281
SHA512c164650a16c3207d934c8156686359b47c6243fa770e5c2690ac3f5ac131426ccf8a267775d181e4a01132ecc58a194d461a834934abe5751137680731b77990
-
Filesize
200KB
MD55f650488a49e51f412179f16fab58faf
SHA1faaca15ccc7b6cc662909c2c9d75b8043d39b483
SHA2560fa70be8354525cb131b2a7d1d3dad2b532e3aadc452f444e4ec0078de49b5c0
SHA5127f032f8c74e0561f29dc6cdec95b07d120f74e1625d8dab9efb26cb6ab1de8a6a937cc1f666ed49015cb7feded1fdf7379c1b73e38739bbdd6cbd1cf32aa991b
-
Filesize
200KB
MD55f650488a49e51f412179f16fab58faf
SHA1faaca15ccc7b6cc662909c2c9d75b8043d39b483
SHA2560fa70be8354525cb131b2a7d1d3dad2b532e3aadc452f444e4ec0078de49b5c0
SHA5127f032f8c74e0561f29dc6cdec95b07d120f74e1625d8dab9efb26cb6ab1de8a6a937cc1f666ed49015cb7feded1fdf7379c1b73e38739bbdd6cbd1cf32aa991b
-
Filesize
384KB
MD513e6431c0ff29f503472b85c2336122c
SHA1f97f2a7310baeb04dd4fbfb262106f64306c008e
SHA256f841bd49c57824902d002f6b908ae027360a960dd9ea1db59de3e1c32c4340a3
SHA512a98b8c3f396e14ff752bd47bcc389d2031296b4eb17e75e4aa986f09b802dd0238fcd55d69d725c841ce3a6d1078c1793c8c9e6b652a24f56f846aa1de58bd01
-
Filesize
384KB
MD513e6431c0ff29f503472b85c2336122c
SHA1f97f2a7310baeb04dd4fbfb262106f64306c008e
SHA256f841bd49c57824902d002f6b908ae027360a960dd9ea1db59de3e1c32c4340a3
SHA512a98b8c3f396e14ff752bd47bcc389d2031296b4eb17e75e4aa986f09b802dd0238fcd55d69d725c841ce3a6d1078c1793c8c9e6b652a24f56f846aa1de58bd01
-
Filesize
192KB
MD58c191ae6c1903e0c788d3124f39d5b8e
SHA139f3ce959e2b749a4cc14927cb911db7c6b0b7e5
SHA256d07b1de90be3452e7ad34ca66a8dd67aab417027c600a282ab8ca07597efa7d3
SHA51282c8b6685de7ad0b7c9b8d04403db23b6378afff02655be8e68c3c8c6c9864c8d58a2ef020cd162fa2603cd037ca9a93b65b340fa2e7ced395cd529b1770dd72
-
Filesize
192KB
MD58c191ae6c1903e0c788d3124f39d5b8e
SHA139f3ce959e2b749a4cc14927cb911db7c6b0b7e5
SHA256d07b1de90be3452e7ad34ca66a8dd67aab417027c600a282ab8ca07597efa7d3
SHA51282c8b6685de7ad0b7c9b8d04403db23b6378afff02655be8e68c3c8c6c9864c8d58a2ef020cd162fa2603cd037ca9a93b65b340fa2e7ced395cd529b1770dd72
-
Filesize
172KB
MD5aa1c4bae485c850e479a60c569ee9433
SHA1a18c75d28e73ba939ad06c5d7fdf42eb3ecbc0c1
SHA256ac2ed082273466c15c517f47fd26b795596c080756dadcb42597a934d99d4472
SHA5126a0552ec8393a7d3a8c006f2ead1028a11d889d1da8dfae27b96c2493f26987b8a7c1f66599cf493a9323a86ddbe801d50469120abd28ab0e1e370b96db7935b
-
Filesize
172KB
MD5aa1c4bae485c850e479a60c569ee9433
SHA1a18c75d28e73ba939ad06c5d7fdf42eb3ecbc0c1
SHA256ac2ed082273466c15c517f47fd26b795596c080756dadcb42597a934d99d4472
SHA5126a0552ec8393a7d3a8c006f2ead1028a11d889d1da8dfae27b96c2493f26987b8a7c1f66599cf493a9323a86ddbe801d50469120abd28ab0e1e370b96db7935b
-
Filesize
188KB
MD5ffdc5c67ddbf5703e37f4ba047038b79
SHA15ba48f652fe9568dced1160dd012ef823b226fef
SHA256ebf93512848a6b289be789fbcf9b52e4094a21fc6a207b8deb3f889f3c8232dd
SHA512df7965b0e1ef18bb6c691b45cf40c38efe796f298efa0fb00ce4a733d581a270c8fec8c304e749ae099ce5831d99178263a66cd0a2a94772daf810d304e088a9
-
Filesize
188KB
MD5ffdc5c67ddbf5703e37f4ba047038b79
SHA15ba48f652fe9568dced1160dd012ef823b226fef
SHA256ebf93512848a6b289be789fbcf9b52e4094a21fc6a207b8deb3f889f3c8232dd
SHA512df7965b0e1ef18bb6c691b45cf40c38efe796f298efa0fb00ce4a733d581a270c8fec8c304e749ae099ce5831d99178263a66cd0a2a94772daf810d304e088a9
-
Filesize
620KB
-
Filesize
392KB
-
Filesize
196KB
-
Filesize
140KB
-
Filesize
192KB
-
Filesize
208KB
-
Filesize
180KB
-
Filesize
196KB
-
Filesize
1.4MB
-
Filesize
332KB
-
Filesize
196KB