Analysis
-
max time kernel
103s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
14-03-2023 14:30
General
-
Target
inno-setup-5.6.0-installer_M1-nMK1.exe
-
Size
1.7MB
-
MD5
41ae06d18ed5af6e6a0a4568b6bb7cc4
-
SHA1
b5d5e7e8a951e96e88215ca140c04b892e2d53de
-
SHA256
a350cd18e1b18c350088512a4baeaeb0ce8ae7e2bfae80636c61c5ba17103b04
-
SHA512
81228bac5babd3c602804bea5e1c1f9c4d97ddb7896aec6bcea14ef8cd34b83c5ddcc63a6c3a257698910663e2dfd85355a461ea5d02ceefaa2e25cead16c166
-
SSDEEP
24576:Y7FUDowAyrTVE3U5Fmi05np8tydyPaJPfrT90eKc4cgFLNPfs8duMpmsDGB:YBuZrEUOp8odywPH9RHgFLRdp/M
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\inno-setup-5.6.0-installer_M1-nMK1.exe"C:\Users\Admin\AppData\Local\Temp\inno-setup-5.6.0-installer_M1-nMK1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DVE0C.tmp\inno-setup-5.6.0-installer_M1-nMK1.tmp"C:\Users\Admin\AppData\Local\Temp\is-DVE0C.tmp\inno-setup-5.6.0-installer_M1-nMK1.tmp" /SL5="$701C8,879088,832512,C:\Users\Admin\AppData\Local\Temp\inno-setup-5.6.0-installer_M1-nMK1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\inno-setup-5.6.0-installer.exe"C:\Users\Admin\Downloads\inno-setup-5.6.0-installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OHH9C.tmp\inno-setup-5.6.0-installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-OHH9C.tmp\inno-setup-5.6.0-installer.tmp" /SL5="$80182,1617805,58368,C:\Users\Admin\Downloads\inno-setup-5.6.0-installer.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5570ac7dec62a51b18b9359d1e9f3e23b
SHA10791494b26ba013034c5861c4b006cb6a9f66a36
SHA2568c5ffa58d84d9d8eef793c780c20297f0ca93db40ea40fe0c15150718b9f046a
SHA51244d68db3a30b99093db264b21ff680a6c74c4b6dcb7d1d49df4eaf0124dd52ad726dd0dd9419f89b89fe841852d6fda68c9383fbe80a681b15577f80e8bc617a
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
2KB
MD5308ad34a86d32a4a2249f1740076f1b7
SHA157ed4188e01ee82c572fa327e41e1704f8cf0fc1
SHA25636f2488f3eb5c3af6e94cb382460dca9cc8f9865dd6d12932ca4bd6f8cc0f2a2
SHA512dbb107a454d31651e7089f1f55f1c30da9a0bc08527071a9b943dcacc0a63f1a1550edc7975f4edb3b13c460b80988e1f30c1adfa488f71e65fd416dd03415ef
-
Filesize
1KB
MD5a0f78df30ebc15bda8858e4c490a5eb1
SHA107140fdad7c7415fbb23461e243d7b576eb08749
SHA2560c679e463254ec4652917110ca1387fb3663d464e4bd792d97c2d853e156d900
SHA512f5539152f7faf5fa3505a2ebd1ccbe3145ee46564b814549a96b63f385a73b7e69176ca853d07adef386ea0cc7c0cea4989c74bd4334997b389d85a2f8db1508
-
Filesize
4KB
MD53aa7f8322b5d9fac04fd5181b7c11e9c
SHA10680431457273982543a228a05df9964358b672c
SHA2564da1ac3689166164e0bedbb5bb2f7f1f0306c27fb044620da9c0960dabb5c395
SHA51285069124bcddb346acea73d68368c666083a0020bf51907344a94316a6a1e97ab960b8841e70839d9fc6d9117157226787dae8d4816840397ac28a1cfef9764f
-
Filesize
712KB
MD599ec3280ffd7fe50b11b198b57534dd1
SHA115e99feb98b5318b480b0abb626ecf59798ed3d6
SHA256fc581ec80b0b43376432220af7610d784ac63d040449ce8809f06b8d06eb1cd3
SHA5128b59f6577cc94b42db23b999ecfa1eb9eeaa7b52a0fb653f6a4e3d3ba036af99c9e7bfdccafc9ef777c84de728a941aecf25693d47abbdcc188e0b1ce9b1eb80
-
Filesize
712KB
MD599ec3280ffd7fe50b11b198b57534dd1
SHA115e99feb98b5318b480b0abb626ecf59798ed3d6
SHA256fc581ec80b0b43376432220af7610d784ac63d040449ce8809f06b8d06eb1cd3
SHA5128b59f6577cc94b42db23b999ecfa1eb9eeaa7b52a0fb653f6a4e3d3ba036af99c9e7bfdccafc9ef777c84de728a941aecf25693d47abbdcc188e0b1ce9b1eb80
-
Filesize
1.9MB
MD5d7489fc8b9b1ee4e642da490d33366ba
SHA1fef2fe89615584dc874f8a6b0fcf180df77db139
SHA2561f941a91d93048476a6af05a836689042aa75f03ea91802a30f327e6a6f465d2
SHA512a22f9a1110ec2d355e6250598febacde7a7893916417dd9691eb733ab368040466b25d51d6597bdb1bf0680e48b2c0a24ab01d1b19cb0b09be4abd1872e29f7a
-
Filesize
1.9MB
MD5d7489fc8b9b1ee4e642da490d33366ba
SHA1fef2fe89615584dc874f8a6b0fcf180df77db139
SHA2561f941a91d93048476a6af05a836689042aa75f03ea91802a30f327e6a6f465d2
SHA512a22f9a1110ec2d355e6250598febacde7a7893916417dd9691eb733ab368040466b25d51d6597bdb1bf0680e48b2c0a24ab01d1b19cb0b09be4abd1872e29f7a
-
Filesize
1.9MB
MD5d7489fc8b9b1ee4e642da490d33366ba
SHA1fef2fe89615584dc874f8a6b0fcf180df77db139
SHA2561f941a91d93048476a6af05a836689042aa75f03ea91802a30f327e6a6f465d2
SHA512a22f9a1110ec2d355e6250598febacde7a7893916417dd9691eb733ab368040466b25d51d6597bdb1bf0680e48b2c0a24ab01d1b19cb0b09be4abd1872e29f7a
-
Filesize
4KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
4KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
60KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
60KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
60KB
-
Filesize
3.1MB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
