Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
29-04-2023 09:55
General
-
Target
Inno/InnoInstaller.exe
-
Size
1019.0MB
-
MD5
801879d5b7a0c86a30552dafbbf1460d
-
SHA1
d1aca891358f0fd24e12a759e4cafbcd7be909b7
-
SHA256
9c98187745a94a9687536aac12711617c55a411c9ba231791924236f3627cde5
-
SHA512
fc8b64f350c1bf6a9a516f9a80906c4ecbf5b75f9982a596cf946aa88c7b338e62824811484afeeaa539567e0b19d0e319a764eaf21764b332408760a14b420d
-
SSDEEP
98304:XHpb2umYIoREUsoGytV4n0oj8tb3gCHg1dWmX:Xdlm7AEQGyD4E39AvtX
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inno\InnoInstaller.exe"C:\Users\Admin\AppData\Local\Temp\Inno\InnoInstaller.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 22762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1376 -ip 13761⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5b75603636bc871960d41e22c3173308a
SHA160fb77539012f9c1e8e9e6cd686a52336c69eb74
SHA256e75e110a95d80455633054d9a790c2a4e64b52c5cafc3c48cfa2e71f1a8cedc2
SHA51297095a067f82d1d482b4d3a21810632ada6f1600725be70b8d3f48925898450f02d8987cdf2f36bd6e72739f102756ee28733c41bbacbe46b885669e000aef57
-
Filesize
4KB
MD5ba677776671f5a143438935d549bccc2
SHA1cb4efbb91ae2dfc3ddc24a5e242619168ac57587
SHA256df5b6d7f6f0fbcc13b3bb8f168cb5cc0c9e80f6c5845f844c8ea675221e7e2c1
SHA5127099cacb87ca621e8eb9c60253d307efb614afe1de5f0c3966eecf0da64d8b54acc7847069ba2d9bf44bd39ad270e6fe79ae1b9c6b296cdb137a1b1a9aedc721
-
Filesize
13B
MD58df468ebecf57381e4d623a08ab62a77
SHA145140edb8d215b55150332da494c9b4a6a5c7457
SHA256c8154e8715a09482b9a936070b700fa180f2057343eb03c122e1d4e316e59a08
SHA512b1d830027b90948a277d6f8b40230ab57bbb3edd103d4c9b5b7cc2a4d5a6a162c218b9de25f9ee042eddf079b25097a686040be1be214199b6bea3ff1989c7f0
-
Filesize
5.6MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
9.7MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
9.7MB
-
Filesize
64KB
-
Filesize
9.7MB