Analysis
-
max time kernel
81s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
14-03-2023 14:30
General
-
Target
inno-setup-5.6.0-installer_M1-nMK1.exe
-
Size
1.7MB
-
MD5
41ae06d18ed5af6e6a0a4568b6bb7cc4
-
SHA1
b5d5e7e8a951e96e88215ca140c04b892e2d53de
-
SHA256
a350cd18e1b18c350088512a4baeaeb0ce8ae7e2bfae80636c61c5ba17103b04
-
SHA512
81228bac5babd3c602804bea5e1c1f9c4d97ddb7896aec6bcea14ef8cd34b83c5ddcc63a6c3a257698910663e2dfd85355a461ea5d02ceefaa2e25cead16c166
-
SSDEEP
24576:Y7FUDowAyrTVE3U5Fmi05np8tydyPaJPfrT90eKc4cgFLNPfs8duMpmsDGB:YBuZrEUOp8odywPH9RHgFLRdp/M
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 47 IoCs
-
Modifies system certificate store 2 TTPs 13 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\inno-setup-5.6.0-installer_M1-nMK1.exe"C:\Users\Admin\AppData\Local\Temp\inno-setup-5.6.0-installer_M1-nMK1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-O3CSS.tmp\inno-setup-5.6.0-installer_M1-nMK1.tmp"C:\Users\Admin\AppData\Local\Temp\is-O3CSS.tmp\inno-setup-5.6.0-installer_M1-nMK1.tmp" /SL5="$70124,879088,832512,C:\Users\Admin\AppData\Local\Temp\inno-setup-5.6.0-installer_M1-nMK1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /select,"C:\Users\Admin\Downloads\inno-setup-5.6.0-installer.exe"3⤵
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\inno-setup-5.6.0-installer.exe"C:\Users\Admin\Downloads\inno-setup-5.6.0-installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6JP7T.tmp\inno-setup-5.6.0-installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-6JP7T.tmp\inno-setup-5.6.0-installer.tmp" /SL5="$90122,1617805,58368,C:\Users\Admin\Downloads\inno-setup-5.6.0-installer.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
712KB
MD599ec3280ffd7fe50b11b198b57534dd1
SHA115e99feb98b5318b480b0abb626ecf59798ed3d6
SHA256fc581ec80b0b43376432220af7610d784ac63d040449ce8809f06b8d06eb1cd3
SHA5128b59f6577cc94b42db23b999ecfa1eb9eeaa7b52a0fb653f6a4e3d3ba036af99c9e7bfdccafc9ef777c84de728a941aecf25693d47abbdcc188e0b1ce9b1eb80
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
304B
MD536efd0e10565494dc626d0285e799ac5
SHA13b1224a9e33f8a6a9fbde70989af03ab77c6a441
SHA2569f8f9f386e676f718ee41938e7fb920e9483b6ca5daf52bf892070c4a0ba61a9
SHA51236e1c9351eecde8c942fc82a8c17891b701cd3ac4598604799dce3cbf3acfbba34543d3c47a4283114954e23c7457bef4160e369d97dfbefba38c53efd241925
-
Filesize
304B
MD5543d17fc9926461594ad05df2b485edb
SHA1a075618ad9a1ed7018aed2f1ef5a4fec1a69b0d9
SHA2561b9a6e242e0a94f2094d51eea3903837822ee01a43c06b12464c917a09fc43ab
SHA5129f5869d39023c98d66288bf207fcb230cc33204ef46d07c02096c5058e906081e0a2b02dfd0b55214e52c4ceeb6fcf1d0369c20550cf1633dac0f1835087fc1e
-
Filesize
304B
MD54022e5f72990985b699d89e752ceabc3
SHA1d927e2e27ba62a5878bd80a69f3d398fd14002df
SHA2568c4c0f3328507c093131ae2041d0b2054b44abf6aa3cdf7518f56abf0920bb84
SHA5125c836de43f887969fe4f8bee160c5a960b85f3869d419661345d8c5e7289c9bae2f4af047fd7b0d9c746504a8cd8af6cddc98fabbb6e456634b828973a20ded7
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
712KB
MD599ec3280ffd7fe50b11b198b57534dd1
SHA115e99feb98b5318b480b0abb626ecf59798ed3d6
SHA256fc581ec80b0b43376432220af7610d784ac63d040449ce8809f06b8d06eb1cd3
SHA5128b59f6577cc94b42db23b999ecfa1eb9eeaa7b52a0fb653f6a4e3d3ba036af99c9e7bfdccafc9ef777c84de728a941aecf25693d47abbdcc188e0b1ce9b1eb80
-
Filesize
712KB
MD599ec3280ffd7fe50b11b198b57534dd1
SHA115e99feb98b5318b480b0abb626ecf59798ed3d6
SHA256fc581ec80b0b43376432220af7610d784ac63d040449ce8809f06b8d06eb1cd3
SHA5128b59f6577cc94b42db23b999ecfa1eb9eeaa7b52a0fb653f6a4e3d3ba036af99c9e7bfdccafc9ef777c84de728a941aecf25693d47abbdcc188e0b1ce9b1eb80
-
Filesize
2KB
MD5308ad34a86d32a4a2249f1740076f1b7
SHA157ed4188e01ee82c572fa327e41e1704f8cf0fc1
SHA25636f2488f3eb5c3af6e94cb382460dca9cc8f9865dd6d12932ca4bd6f8cc0f2a2
SHA512dbb107a454d31651e7089f1f55f1c30da9a0bc08527071a9b943dcacc0a63f1a1550edc7975f4edb3b13c460b80988e1f30c1adfa488f71e65fd416dd03415ef
-
Filesize
1KB
MD5a0f78df30ebc15bda8858e4c490a5eb1
SHA107140fdad7c7415fbb23461e243d7b576eb08749
SHA2560c679e463254ec4652917110ca1387fb3663d464e4bd792d97c2d853e156d900
SHA512f5539152f7faf5fa3505a2ebd1ccbe3145ee46564b814549a96b63f385a73b7e69176ca853d07adef386ea0cc7c0cea4989c74bd4334997b389d85a2f8db1508
-
Filesize
4KB
MD53aa7f8322b5d9fac04fd5181b7c11e9c
SHA10680431457273982543a228a05df9964358b672c
SHA2564da1ac3689166164e0bedbb5bb2f7f1f0306c27fb044620da9c0960dabb5c395
SHA51285069124bcddb346acea73d68368c666083a0020bf51907344a94316a6a1e97ab960b8841e70839d9fc6d9117157226787dae8d4816840397ac28a1cfef9764f
-
Filesize
3.0MB
MD5570ac7dec62a51b18b9359d1e9f3e23b
SHA10791494b26ba013034c5861c4b006cb6a9f66a36
SHA2568c5ffa58d84d9d8eef793c780c20297f0ca93db40ea40fe0c15150718b9f046a
SHA51244d68db3a30b99093db264b21ff680a6c74c4b6dcb7d1d49df4eaf0124dd52ad726dd0dd9419f89b89fe841852d6fda68c9383fbe80a681b15577f80e8bc617a
-
Filesize
1.9MB
MD5d7489fc8b9b1ee4e642da490d33366ba
SHA1fef2fe89615584dc874f8a6b0fcf180df77db139
SHA2561f941a91d93048476a6af05a836689042aa75f03ea91802a30f327e6a6f465d2
SHA512a22f9a1110ec2d355e6250598febacde7a7893916417dd9691eb733ab368040466b25d51d6597bdb1bf0680e48b2c0a24ab01d1b19cb0b09be4abd1872e29f7a
-
Filesize
1.9MB
MD5d7489fc8b9b1ee4e642da490d33366ba
SHA1fef2fe89615584dc874f8a6b0fcf180df77db139
SHA2561f941a91d93048476a6af05a836689042aa75f03ea91802a30f327e6a6f465d2
SHA512a22f9a1110ec2d355e6250598febacde7a7893916417dd9691eb733ab368040466b25d51d6597bdb1bf0680e48b2c0a24ab01d1b19cb0b09be4abd1872e29f7a
-
Filesize
1.9MB
MD5d7489fc8b9b1ee4e642da490d33366ba
SHA1fef2fe89615584dc874f8a6b0fcf180df77db139
SHA2561f941a91d93048476a6af05a836689042aa75f03ea91802a30f327e6a6f465d2
SHA512a22f9a1110ec2d355e6250598febacde7a7893916417dd9691eb733ab368040466b25d51d6597bdb1bf0680e48b2c0a24ab01d1b19cb0b09be4abd1872e29f7a
-
Filesize
712KB
MD599ec3280ffd7fe50b11b198b57534dd1
SHA115e99feb98b5318b480b0abb626ecf59798ed3d6
SHA256fc581ec80b0b43376432220af7610d784ac63d040449ce8809f06b8d06eb1cd3
SHA5128b59f6577cc94b42db23b999ecfa1eb9eeaa7b52a0fb653f6a4e3d3ba036af99c9e7bfdccafc9ef777c84de728a941aecf25693d47abbdcc188e0b1ce9b1eb80
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
3.0MB
MD5570ac7dec62a51b18b9359d1e9f3e23b
SHA10791494b26ba013034c5861c4b006cb6a9f66a36
SHA2568c5ffa58d84d9d8eef793c780c20297f0ca93db40ea40fe0c15150718b9f046a
SHA51244d68db3a30b99093db264b21ff680a6c74c4b6dcb7d1d49df4eaf0124dd52ad726dd0dd9419f89b89fe841852d6fda68c9383fbe80a681b15577f80e8bc617a
-
Filesize
4KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
4KB
-
Filesize
60KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
60KB
-
Filesize
3.1MB
-
Filesize
60KB
-
Filesize
3.1MB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
64KB
