Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
02-05-2023 03:49
General
-
Target
MacroRecorderSetup.exe
-
Size
40.0MB
-
MD5
1d15e6a7b5de88e713bf0c43da23c4fb
-
SHA1
f66b4f6899d79a9deab6eb1a0563084b14c877b2
-
SHA256
3fede8c9d41af5866fc7f2f615cd0bced16061fc577c8e262097031d34fd35c4
-
SHA512
f2f87f780cf13efffc34edf345ee6432b991f1c942c02c8a2809e60a0bc4104973018cb62f90a7af3db4efff311ce4d27c90db1dbbe61b4b9ca438d2fb1e0ef1
-
SSDEEP
786432:JQZcwv7vc5iWucdCIMeUaSutnaX+c82tftuc+nipj6y/lW+xY6K71OPSV/+Pq3Ah:LwDc5VVMcSuB2Ac+n1y9p3vqVmPqwXgm
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 25 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MacroRecorderSetup.exe"C:\Users\Admin\AppData\Local\Temp\MacroRecorderSetup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-4GQOB.tmp\MacroRecorderSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-4GQOB.tmp\MacroRecorderSetup.tmp" /SL5="$9005C,41013136,845312,C:\Users\Admin\AppData\Local\Temp\MacroRecorderSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh" advfirewall firewall add rule name="MacroRecorder" dir=in action=allow program="C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe" enable=yes3⤵
- Modifies Windows Firewall
-
-
C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe"C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.3MB
MD5418fbd5d9c4a05e5f8061300ebaaa1db
SHA1306cafc9071c3e75ee066fd52ea54d1d69d9eaa6
SHA2569426b81ea606756154aeb51e54100f3d4022dc6790c7a89f7b4b81e6367ed0de
SHA5120bac61aad0896b06b0686cda573c8a249aaf420a97db478ea48f67665794fc37cc1a9250573bcca5e1fc5298aa284cc4fa008e2ddc4e7aff3e99d5abb2122b7b
-
Filesize
14.3MB
MD5418fbd5d9c4a05e5f8061300ebaaa1db
SHA1306cafc9071c3e75ee066fd52ea54d1d69d9eaa6
SHA2569426b81ea606756154aeb51e54100f3d4022dc6790c7a89f7b4b81e6367ed0de
SHA5120bac61aad0896b06b0686cda573c8a249aaf420a97db478ea48f67665794fc37cc1a9250573bcca5e1fc5298aa284cc4fa008e2ddc4e7aff3e99d5abb2122b7b
-
Filesize
14.3MB
MD5418fbd5d9c4a05e5f8061300ebaaa1db
SHA1306cafc9071c3e75ee066fd52ea54d1d69d9eaa6
SHA2569426b81ea606756154aeb51e54100f3d4022dc6790c7a89f7b4b81e6367ed0de
SHA5120bac61aad0896b06b0686cda573c8a249aaf420a97db478ea48f67665794fc37cc1a9250573bcca5e1fc5298aa284cc4fa008e2ddc4e7aff3e99d5abb2122b7b
-
Filesize
156KB
MD51d01aa12abca7c2405abb863ae670305
SHA1452b72fd0d41f008be8e2f8bdbcb3d727da885dc
SHA256e92e12209048ffdca0c9e8bbbbf0616ce3e83dc66152c727f1758cd711dc529a
SHA51236fdf55268418da1f09a22f284bf3b4d63b88af998d80d41ca9e7558b498143e5babc8329504c0e4c44d0a3edfc9692e612fb90e27d78f88cb92994181e1b550
-
Filesize
156KB
MD51d01aa12abca7c2405abb863ae670305
SHA1452b72fd0d41f008be8e2f8bdbcb3d727da885dc
SHA256e92e12209048ffdca0c9e8bbbbf0616ce3e83dc66152c727f1758cd711dc529a
SHA51236fdf55268418da1f09a22f284bf3b4d63b88af998d80d41ca9e7558b498143e5babc8329504c0e4c44d0a3edfc9692e612fb90e27d78f88cb92994181e1b550
-
Filesize
156KB
MD51d01aa12abca7c2405abb863ae670305
SHA1452b72fd0d41f008be8e2f8bdbcb3d727da885dc
SHA256e92e12209048ffdca0c9e8bbbbf0616ce3e83dc66152c727f1758cd711dc529a
SHA51236fdf55268418da1f09a22f284bf3b4d63b88af998d80d41ca9e7558b498143e5babc8329504c0e4c44d0a3edfc9692e612fb90e27d78f88cb92994181e1b550
-
Filesize
3.0MB
MD56866b7783f72e33430a53f153cdda471
SHA121ff5e8db17df6103c39bf86387b86697a9ca3cb
SHA256817843f3509a830b705a8a0a52dfa6f7669af2c6ac2de466cdd8aa2acf6fed35
SHA512ca113f3c1d9ec09a2cd75fb70a321f81331174bab412fdbc278a1cbdc7fbc94a08b961cf5528107fb087942d8139c1d345ce9d6328e377e9aaf7f764e881e2ea
-
Filesize
3.0MB
MD56866b7783f72e33430a53f153cdda471
SHA121ff5e8db17df6103c39bf86387b86697a9ca3cb
SHA256817843f3509a830b705a8a0a52dfa6f7669af2c6ac2de466cdd8aa2acf6fed35
SHA512ca113f3c1d9ec09a2cd75fb70a321f81331174bab412fdbc278a1cbdc7fbc94a08b961cf5528107fb087942d8139c1d345ce9d6328e377e9aaf7f764e881e2ea
-
Filesize
28KB
MD5077cb4461a2767383b317eb0c50f5f13
SHA1584e64f1d162398b7f377ce55a6b5740379c4282
SHA2568287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
SHA512b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
-
Filesize
28KB
MD5077cb4461a2767383b317eb0c50f5f13
SHA1584e64f1d162398b7f377ce55a6b5740379c4282
SHA2568287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
SHA512b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
196KB
-
Filesize
4KB
-
Filesize
14.5MB
-
Filesize
196KB
-
Filesize
4KB