Resubmissions

12/05/2023, 14:29

230512-rtwq3add85 7

12/05/2023, 14:29

230512-rtmhdsff4y 7

Analysis

  • max time kernel
    487s
  • max time network
    491s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2023, 14:29

General

  • Target

    setup.exe

  • Size

    780KB

  • MD5

    e3d0c2a49f23dc150348dccc644e61b2

  • SHA1

    0143c07dabe75b771367d38e345dbfd5d47e1d82

  • SHA256

    d48ad2ccf063ce4606b04ffeb0468af44eec3fe0a42a969a51673547b22d8e58

  • SHA512

    14fd7b78e10427b2669ea01c1bc19ba5f8d32439ddf514950e76aa2cbb0fc443d18d54229b6e7451081828275357e9425e82f1494b54e87d1b24c1b0f184fb34

  • SSDEEP

    12288:cuGj5je69oqAmj5oMqKyKAuqOAP0wukeMb01JQntLOCHOYo0H:cXhe29AmjkKuukemHOYx

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\AltInstaller.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1992
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3440

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads