Analysis
-
max time kernel
93s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2023, 22:45
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
General
-
Target
setup.exe
-
Size
2.2MB
-
MD5
fd131de76098e6886213931f64d972c1
-
SHA1
0308427cb705e2a1d9e831f167b3fae76e3062e4
-
SHA256
f9adce5f6db5fc7533204a37cf684b8a6c8bddb227b9347a7bf706498fa93319
-
SHA512
91483ee00687318c24d170d566dfb848d7ca421aebcfbfac78cd4688e132fa1e61bdf24f0cd3111ab8d4fa099d19b6a3d802d48cf0bbe4a6ca24f4005e8a1516
-
SSDEEP
49152:sxmwD7TFj71/IoKxeBZHq9M5FJnNBZBJX/BtG/AKfoGkcx5h7njGbhzRy3AetH/:mmwD75lglcq2JnpBJX/edhv5h2bH6H/
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3620 setup.tmp 1508 unins000.exe 1888 _iu14D2N.tmp -
Loads dropped DLL 6 IoCs
pid Process 3620 setup.tmp 3620 setup.tmp 3620 setup.tmp 3620 setup.tmp 3620 setup.tmp 3620 setup.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3620 setup.tmp 3620 setup.tmp -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3620 setup.tmp 3620 setup.tmp 1888 _iu14D2N.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 980 wrote to memory of 3620 980 setup.exe 77 PID 980 wrote to memory of 3620 980 setup.exe 77 PID 980 wrote to memory of 3620 980 setup.exe 77 PID 3620 wrote to memory of 1508 3620 setup.tmp 88 PID 3620 wrote to memory of 1508 3620 setup.tmp 88 PID 3620 wrote to memory of 1508 3620 setup.tmp 88 PID 1508 wrote to memory of 1888 1508 unins000.exe 89 PID 1508 wrote to memory of 1888 1508 unins000.exe 89 PID 1508 wrote to memory of 1888 1508 unins000.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\is-DMUKM.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-DMUKM.tmp\setup.tmp" /SL5="$D0052,1563952,384512,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Games\Mega Man 11\unins000.exe"C:\Games\Mega Man 11\unins000.exe" /VERYSILENT /NODELSAVE3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\Mega Man 11\unins000.exe" /FIRSTPHASEWND=$20226 /VERYSILENT /NODELSAVE4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1888
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD51389688220c93eb4234a850e3121d186
SHA1b7a09cb03175043d10ee9ab3739ffb61281c15c8
SHA2565cd2f610752485e0b7f436ac74c938727e113150d12b7786e330d22c233e37a6
SHA5121dc3d43b88c0ba3c6f729efb8cba16e4d56688010e7914d6a2f56befe8c25674a5186038aea1d24c0b0642a58054c795b681a9321586921a1404333b0a6e69a2
-
Filesize
1.4MB
MD5b6adf48dfdf9402f3b46770e516f787b
SHA1bced70d35c00cd12a84dec8456ef41abdd108c55
SHA2560fe92f7b8d636f597218266f070ee8883f5924fe6f48b6baca9b4d39d54db2d3
SHA512ab5a1547b7e51a7ed64aabb54d37254088536e5bac37d982b0eefee5ee7c659e04fd0872c52d772b04d2f4a22a31fe1f71a5dfd25e177352ac4e8fcd835acad1
-
Filesize
1.4MB
MD5b6adf48dfdf9402f3b46770e516f787b
SHA1bced70d35c00cd12a84dec8456ef41abdd108c55
SHA2560fe92f7b8d636f597218266f070ee8883f5924fe6f48b6baca9b4d39d54db2d3
SHA512ab5a1547b7e51a7ed64aabb54d37254088536e5bac37d982b0eefee5ee7c659e04fd0872c52d772b04d2f4a22a31fe1f71a5dfd25e177352ac4e8fcd835acad1
-
Filesize
1.4MB
MD5b6adf48dfdf9402f3b46770e516f787b
SHA1bced70d35c00cd12a84dec8456ef41abdd108c55
SHA2560fe92f7b8d636f597218266f070ee8883f5924fe6f48b6baca9b4d39d54db2d3
SHA512ab5a1547b7e51a7ed64aabb54d37254088536e5bac37d982b0eefee5ee7c659e04fd0872c52d772b04d2f4a22a31fe1f71a5dfd25e177352ac4e8fcd835acad1
-
Filesize
1.4MB
MD5b6adf48dfdf9402f3b46770e516f787b
SHA1bced70d35c00cd12a84dec8456ef41abdd108c55
SHA2560fe92f7b8d636f597218266f070ee8883f5924fe6f48b6baca9b4d39d54db2d3
SHA512ab5a1547b7e51a7ed64aabb54d37254088536e5bac37d982b0eefee5ee7c659e04fd0872c52d772b04d2f4a22a31fe1f71a5dfd25e177352ac4e8fcd835acad1
-
Filesize
1.4MB
MD5b6adf48dfdf9402f3b46770e516f787b
SHA1bced70d35c00cd12a84dec8456ef41abdd108c55
SHA2560fe92f7b8d636f597218266f070ee8883f5924fe6f48b6baca9b4d39d54db2d3
SHA512ab5a1547b7e51a7ed64aabb54d37254088536e5bac37d982b0eefee5ee7c659e04fd0872c52d772b04d2f4a22a31fe1f71a5dfd25e177352ac4e8fcd835acad1
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
-
Filesize
1.4MB
MD508577dd7c560ae4e18df622ce329a918
SHA1bc523802bbf705cd0ddec252ffb757cd23dfaa36
SHA2563ed3de8c705f9557c6dc85448e9ccc9a4f34b17c02d3a92f1c0898abd3c00440
SHA5125a23059342ae608c1e639388ce0c435666800a0331185a671fffb58c999a0614263e123a7c60534b93073bcfa89a9a8e40e0f5818be424cf1a19c725057c9a6d
-
Filesize
1.4MB
MD508577dd7c560ae4e18df622ce329a918
SHA1bc523802bbf705cd0ddec252ffb757cd23dfaa36
SHA2563ed3de8c705f9557c6dc85448e9ccc9a4f34b17c02d3a92f1c0898abd3c00440
SHA5125a23059342ae608c1e639388ce0c435666800a0331185a671fffb58c999a0614263e123a7c60534b93073bcfa89a9a8e40e0f5818be424cf1a19c725057c9a6d
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3