Analysis
-
max time kernel
72s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
27-05-2023 17:08
General
-
Target
NTLite_setup_x64.exe
-
Size
23.5MB
-
MD5
391907fdc98797abccc1718767f736ef
-
SHA1
7471f0c2be722b6943f70cd1e16b8051d6bb195d
-
SHA256
64a6b8d85dcbe4a5a30d8cb381778043179cadb3044e7d3d418a9aebb29b360b
-
SHA512
76ecb4d249af88fba9753b278d1cb750603aa93c6c36e0ba02ab1b5680407d287c59a696f8b29f50732ebaa4a7f5b203f9ff72aa1c2ce0b4b9d0004c15848a90
-
SSDEEP
393216:pul8cgRtT0C6zhmTodWoDPJMr9a9zKNuHjRCLoyAzveL:pZcgRtIpzhmTaWozJr10Loywvg
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 39 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NTLite_setup_x64.exe"C:\Users\Admin\AppData\Local\Temp\NTLite_setup_x64.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8JOTC.tmp\NTLite_setup_x64.tmp"C:\Users\Admin\AppData\Local\Temp\is-8JOTC.tmp\NTLite_setup_x64.tmp" /SL5="$1A0022,23634002,832512,C:\Users\Admin\AppData\Local\Temp\NTLite_setup_x64.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\NTLite\NTLite.exe"C:\Program Files\NTLite\NTLite.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
366KB
MD52c9f6dd071bf0c16fedcbb3fb0425fd8
SHA1237ffedd396d96c9b7df5587b04a258dc8510af6
SHA2560a380c3669c1fa4ce040fa00dc8d1bafbaa4b1cd63b1e924a12b7bd501aca762
SHA512b5440184c16c78bb7397f5c28d1f9978959d0db09bb952c3e174cc2fb2ac60bcd5a28ed83a0eab9bc6b6c61a81723f88cf7b79c7ebabd35109a1663713ef3849
-
Filesize
310KB
MD54c8c7dac079034ab4c6dc539bdfb8540
SHA1d9039d38d673f27b8a8da270bd85e33d125cf7da
SHA256877e505dbef36311179b95614a2c980be6d5ff2828a05788895e477dbff92136
SHA512668c6ce16b91c003c682f627d838f475ac9b217361f9b0e1df04550cab02f06978a58588a882842942ab1597a580f39a7aed1d3deb16b905d3419dafdc4d3311
-
Filesize
176KB
MD5c89052e7fd174e6dc284a4bca1aef3cc
SHA108a0aa9a2f0f0b4fbc47df0fd4673bfd59d2e6a9
SHA2568fdfe0ae7a15c609f2085730aac9a4eeff989cd2e5a672aa477bd170c320ed83
SHA51283d01732f959eef7f87a6551bc3a7e0a92108d68b9317729f3a452b350b22450c59bdf6ecdf3b56da074bd9d9985e282c033de1ee9f9d5e230f664f039f14cfe
-
Filesize
176KB
MD5b867123cf95cc8eea1324945dcc8cfa6
SHA1b86612bc8e3d3db8352d5b5949d489b7ed214f6e
SHA25670a7ed3bf0ddb31d09703bf6fdcecfec6839deb747279018d956bf9459ccc261
SHA512bd7aff4a3ffc9c8d69c2951694d7c8df15314d8c2bb8d5843a1950d4dfdf42c2837130c1ca26ba65c122f78b6bb5b58f6402e8ae6db134f218d443f3f7604b91
-
Filesize
179KB
MD5942e8dba0bd45f5a0e0ce4642a6947b3
SHA13a58f70d4dd72cad4e1eafb675192e0555336c71
SHA2561a28405b6c1e85d6eb629d7ba9269496a03edd2bb6a639d4308f483dd833acb8
SHA5122cf4727a71b7423658078d5ec59e3d086c258c426619cfc2b7a24719162b4cd7fcbc5d1695df6262eb21d0ed1c6dc6ebec94d11e22de9782e2f12612c8ca3d63
-
Filesize
247KB
MD524a0a443d60558d5a3ee5745ba30af57
SHA1dafbf13721fa912ac3203c44e57c066ae5501cc9
SHA2566e177b90db711e52c6a0e165f2df01ba8b9c0faa06861098e398ddddf598cd66
SHA51206dc212c102918f072bdf63cc2fb912824b661f4d1f2ae51a1ca32af92f71b95662ae2ad0ec070f0ef1410d28c7863808575a8c71ef3437b6c61c0caa54d94ae
-
Filesize
221KB
MD5bdbabe017ea40da5ec6057dce3183b6d
SHA1ddaa733bc9384dc0c66244b89e25e0863619309c
SHA256111a43cf081bf8edfa338b1440ce6b340895ddf3293a4354eb2809778bcb7162
SHA5123cf095b757372ca6fa26a9cff7ca9f583d91ccb4af49aeeea7311f6e41719a68419dd8e2987aed4a84630fce05270f597062df3d6eed3d468021df6809af6774
-
Filesize
218KB
MD5c4499c7a97604fe0c465359f5e6eaf90
SHA1d5599e829b31f8850cee0cc9725522978178444c
SHA256ec99bfe3000e6be6881caa9489ce1c6d55df07094fe31a0e89c1282a06c2fd74
SHA512e05412f85a6948bbdc5ecc825e4e358a0f4be344d7ae1c86dafaf9f80c9ff23664711020748e258b596accab98e3d0f61f830eb2dc62b7f277fdb55bc7b3233d
-
Filesize
316KB
MD511dead5d399aee0696d8e43e3b83a4f0
SHA1555697d70278ccfa8a8fc6794e8a934516a57d12
SHA2563137e88e64f21f1a3674b51f30efccfb7f485958c153afe672960f559d3bcb29
SHA51242f71ce90a6e833b73810a683b9dce32031439de6ac2e42371ec757849fce45526831e23b2cd332baf8091a4e0c2f352975f616e4e3c88b9769c264e260b6159
-
Filesize
203KB
MD54f2057b3a8841f06c78a43263737c01c
SHA14da1dbc7bd9e3059ee5ca5b0a998af9dd65d7b4d
SHA25675be2210420078e16d853d54e6465702cc23245a2a93b3387cc97a1018a94088
SHA512443dd6c70ccb3aed5803e93428ea2c9762badab472f6b0c84f90d2d5815f70b09374489a810555ada736d50f4fa0dd61d89cfbe07a5758c8b96cc0ba73d727c7
-
Filesize
211KB
MD59a4045f0555ec26cdc30edb3f9a086d1
SHA108f65229ed18c956fedc00beb045834d8c7341ba
SHA256803ac4f1331046eeff47d3d5c910198e9649e742ed5f108046a950d85046648b
SHA512d7659585857efc9bb4ece9a4384be82053eb3a47153f7b60b0de1146a55da60f9b473505b1079986c49a14227206bbd0723334de9930da295de2376c17a36f4e
-
Filesize
247KB
MD57ccb14204110779745049fc12f45a534
SHA1679314e4ab9cc337ea5400c20916f89c4a88705d
SHA2562a58e86331562cd075b45356981033c94726960f8b494ae9acf1533e8bb0734a
SHA5126f0519b577e2f3b52caeb473a3eaf0905b0279be94821a99555cc181db0ea987431415606709cbb0bffb449ca171c6965f7df62cef419592c4f9019737d1919a
-
Filesize
219KB
MD5f5d2de635e3d990bee4bb040acd1850e
SHA14d7f2d026c73dfab1c06cd8694d771f25153e05b
SHA25691fbe3de6f5ab890f4e99b903c514ba7a1c22e33c38f347e730e0be3dafb2473
SHA5124a21e57c0fa3495634ac2362cf95a9c6f235fc2ca01d050bb8b15236ffc4b9dc2cedf78a1732f3e3b17cdb1ff96201ab6f0030d86c8e94d3f2c0d1bd86761b10
-
Filesize
199KB
MD5fdb474b006addefe3cb713c2cdce96e4
SHA1b214c94a740a58d6b373bd4966d0370a2dbd8ef8
SHA256e61840d706513446f280eb06e5f991160e15aa1d63dea99c32faea493218e998
SHA5122b65adad1a5d8c58cf502cf177d518ffeb0f63dc55ce69cf37f76ea8dd0eee5083aad52bc220e4860f30ad47e4e833dffda1cc1ece53a649a7d029c28952da36
-
Filesize
198KB
MD5f524a149dadff38a7bbe9bb558265453
SHA1d63490a2ae469d7308d4d3f7f47a0659c54d3641
SHA256445bfbddd618de1a09717e6ed622a4e7b0e15b91a5c3cc27df5eabf1307080ff
SHA51262082ba938da522581aa150353c5e906ab032573fa9992b148f9359e30d457c641196405d866712db90ec3bdba5850020d718bf959cab949af015b0940d700be
-
Filesize
212KB
MD56145d9d8dbec3a4e76b8e29a8ec23576
SHA1879b3bf22f03278fe48af45691450da464455429
SHA2563fda9d86f5ddb8338e6e4f309ebb94d81c0c2e52899a1ea0936fab8939b2d236
SHA5125eb3280b22cc4a320ce03d624210b0656629c06f01ca2bca5ca5ffec292926303de50951bed11d6a8c968254f4dd868c654e4d1c559af3b67ca80cb4be4f0b4b
-
Filesize
280KB
MD57f9f039c97e43f589226110c1e0e79c7
SHA167664367ce3345f7cab72e395673106a5c45f7c0
SHA25663a7ec048c25a4c7ef09c199288835720372a3dc724e9665530889309459c344
SHA512ddfd7c7cde2ef8274649fafa3325e6ef49c1e0a63c655ed53139109cfbb76d263543110b44186f0e3769a4582c421b1b42ec58885354dec743ccd01e84cb59c4
-
Filesize
185KB
MD50977933e739d5e1e86d6803f3868a02b
SHA1a11994b489d2447bb07c05c7b6e31eff89c81dfe
SHA2564f922532b4f92ca5fb6262865ff2ee902783be37ece2def08b5d4ab99f5fab68
SHA512cfa6d6d84da55794a3c884c35f100bf4179d324e8c2216b1b0440436edad779c792d9668a6ff751789496e0aebe2800c2dd5f75788e6144825f18394cba4f66f
-
Filesize
191KB
MD58ab0a8e1754f72d82112ed5ea85720ab
SHA1a3122dd3f1ab34780fa6f852b5457d8617c7d58e
SHA25602e0e8a61e37ba486d63dad60a5720bb774b371208ab1bd47f51b65cf698c3d8
SHA5127afb5dff007f59920efe56c625a0f37b7046e6b80bca4455e98dde4c04bb147dada3b85282adcae5cb2d994320a9a9c3be3410930006ecf7dc08d0ffe04bcdef
-
Filesize
202KB
MD570d9062ab88f73e0774ce9977af5c434
SHA1d940c16c9d7ef3960fa34c1b27bf2677342b87ba
SHA25677a69baa71a3f75f37e5801acec46fa516371b92ba938ebdb913110eaf1fc431
SHA51271165808792f8ba91149fd46d829e6fcac6a86b7fa8ff4f8a4b845d87aae0abb095dfe5478d0cb5c8c9fff5a27adb1b904da5e3e21d7848defda2619b1068f79
-
Filesize
193KB
MD5d432c19fab005f1510174ad1cae9afbd
SHA1f249667425e3d2f9c9d2b6f684c5d320d918223d
SHA2563a080fe171feeca3491daa011b581d3d6bc50da1a769409ebd613bcbb5e8982e
SHA512961a23d7fd20e4d5fb808f986339ee030a0e3b390414f41050c3057dd173cdbbcb5a3e7395e676b77318ea10ea3c70db07bafc14b645756d17671ec27f46eb06
-
Filesize
314KB
MD5374acfad9985500dd21b805600c9262d
SHA196b21ba69700d8600f01df14b216d5cc6ac9ac1d
SHA2561c4ced85a790c7b39c92ca3ddcb5feb33300ca4ab0bd293ed56e4c8b221de467
SHA5124cd06d623f99763ac3c23cc3c576c45fe0a057342de958dd76b31a1a6bfab86b38cda765925b1d91c489e30139f166fb6ea698bdd8b5e4cb91d1ce5da2c63674
-
Filesize
6KB
MD57753df2f6faf71ca9b58b17c2d9da71a
SHA1951cd3856f76d14329fa9f0c3fb3491ff8ef2c51
SHA256ac8d7aba4d4d857ecd30d21f33c2fb63783829524b765391824cacf7695ddce1
SHA512b9835b0df64e6429f353753a687d827c38451255431caef616a2cae02d1c1060d6dd969e35f8c46e887f7d0a226ca803188445d99976fefcb5439c2e265c4591
-
Filesize
20.0MB
MD5eed787aac7b2204e13953bc5f4cf23e4
SHA1f2ecb95a1a71b6036cb2aa699f816cad5eb6675a
SHA25615dac1b8b387339e8760fad2d84d8d50a3a6780e50bbf01f68be5281b6dff60f
SHA512792c9fc8eb833011b62e8c790264dd4773cd220e97ae0258447fb6720598db17d2dc8eb1e2327ab773efc8405e69d4ef4ab8e7b33f2b04ba45227f15ec219388
-
Filesize
20.0MB
MD5eed787aac7b2204e13953bc5f4cf23e4
SHA1f2ecb95a1a71b6036cb2aa699f816cad5eb6675a
SHA25615dac1b8b387339e8760fad2d84d8d50a3a6780e50bbf01f68be5281b6dff60f
SHA512792c9fc8eb833011b62e8c790264dd4773cd220e97ae0258447fb6720598db17d2dc8eb1e2327ab773efc8405e69d4ef4ab8e7b33f2b04ba45227f15ec219388
-
Filesize
20.0MB
MD5eed787aac7b2204e13953bc5f4cf23e4
SHA1f2ecb95a1a71b6036cb2aa699f816cad5eb6675a
SHA25615dac1b8b387339e8760fad2d84d8d50a3a6780e50bbf01f68be5281b6dff60f
SHA512792c9fc8eb833011b62e8c790264dd4773cd220e97ae0258447fb6720598db17d2dc8eb1e2327ab773efc8405e69d4ef4ab8e7b33f2b04ba45227f15ec219388
-
Filesize
1.8MB
MD523aace4fa7f82ccc64a9ce7de9611f9f
SHA129559b38b11bd86056e7b619eb0f42441e8ed49a
SHA2563691b02252068bce59c26e73ef70acaea67b892ab8e079514d50153b3a8fd14c
SHA512eac8e4617fd245ed52482c2e1d105d48c0d91130a5989eba4966c792c0237e06dbf7db09333f32d800a8e62d5cc1c7427f71ef33d29d035a7bb137b54498370d
-
Filesize
1.8MB
MD523aace4fa7f82ccc64a9ce7de9611f9f
SHA129559b38b11bd86056e7b619eb0f42441e8ed49a
SHA2563691b02252068bce59c26e73ef70acaea67b892ab8e079514d50153b3a8fd14c
SHA512eac8e4617fd245ed52482c2e1d105d48c0d91130a5989eba4966c792c0237e06dbf7db09333f32d800a8e62d5cc1c7427f71ef33d29d035a7bb137b54498370d
-
Filesize
48B
MD53f6713c2c90a49b6951187bac3a0bda5
SHA149705ac5adcb9de49d48aa312a96247e9caba262
SHA256f6e868955cb011851aecb86832537efa74c58107368fcc56c62e80429f47ebe6
SHA512bde848d158b4ef06506d58ef6bed42d3a39d7444e6e983ad3103bfb1a9a50122a7b4c82f58033b443b9ddf5ca7fc1bbe246d17b4181c946da0ac8ed5c379588e
-
Filesize
3.1MB
MD539b0f74f30db22b0c8969a0d990f9f9d
SHA11597fe464fcb835bfea66377a694dbab7573dbd3
SHA2563a4c4954883d473bb90b10ae2a8ee5409dbcb39672440fdae12fd15c62153fc5
SHA512da1b907b7ffeaf4b1732d86892a063f5e396dc301392a2f088cec1e7d9a20e6c3b4aa11cae195e3196eb2e1a1944b9e042a22c3cdd7f3571e0ba3af3c2a58ac6
-
Filesize
28KB
MD5e3f4768541e1c6a6a2e232251f283052
SHA163c163962651ab59c3d8cf9613cddca1717df312
SHA2561b880b97504aeacb9e72466a59df20c64b9be86713da879eb1f41c1a1f780121
SHA51249749a5647c817170410dbd19786c26b371bade104723a8acabe343fd615c0729734fc57af59ea6d5cc415370e2a217db9d780b67d1f4938926668179221c9cd
-
Filesize
281B
MD525942a628bf904d16cd1f97c6fbe507c
SHA1d952f12abf00cb71fc4a998cd5c72b716c56f393
SHA256faef20afeb94202736ffa7f1bc73a437e2937f434608318dc7ff69943efe603a
SHA5120a62fe6cddc367310796d96c89f37adccfa44113b1dbc3e716f192643197136e5c6dad1b9743e30b7fcddb9cab6d52ae4abcf2c8ad2bb485a4e58b85848b4c12
-
Filesize
451B
MD5662f695479f2f02445764091ef76b9e4
SHA1fc069f82430ff47dcd6eaffd4a229f07e6817464
SHA256c751a5c58a2fe1c31128730767c547ec0dc266970adf309a0f8fd630bf9cbe4f
SHA5124e93671b4fa13f9b012388f15c0dbf30152a3426deba92e813f8d87876623d41140c778f59ec47fcc48208d8ffafe7da81f5604da04827d32ae15a8f80698327
-
Filesize
3.1MB
MD539b0f74f30db22b0c8969a0d990f9f9d
SHA11597fe464fcb835bfea66377a694dbab7573dbd3
SHA2563a4c4954883d473bb90b10ae2a8ee5409dbcb39672440fdae12fd15c62153fc5
SHA512da1b907b7ffeaf4b1732d86892a063f5e396dc301392a2f088cec1e7d9a20e6c3b4aa11cae195e3196eb2e1a1944b9e042a22c3cdd7f3571e0ba3af3c2a58ac6
-
Filesize
3.1MB
MD539b0f74f30db22b0c8969a0d990f9f9d
SHA11597fe464fcb835bfea66377a694dbab7573dbd3
SHA2563a4c4954883d473bb90b10ae2a8ee5409dbcb39672440fdae12fd15c62153fc5
SHA512da1b907b7ffeaf4b1732d86892a063f5e396dc301392a2f088cec1e7d9a20e6c3b4aa11cae195e3196eb2e1a1944b9e042a22c3cdd7f3571e0ba3af3c2a58ac6
-
Filesize
65B
MD5370c147a11528605819c28a1dbb002fd
SHA18012cd5716012b58aff716e8c9211a0cb713302e
SHA2569e4310aa199dff8a5cd4d66539c7945c614283aea8e9d2621da82340953646eb
SHA5125a21bbd89ad062c2bdbf1a3ab8fcf8867e30acfbcecedab0e5cc9c67318a76d03d507f1b676e23cc6cef193f6c0070c4d9d7aec80f1638bfe638eb174271878d
-
Filesize
65B
MD51ef5e829303a139ce967440e0cdca10c
SHA1f0fa45906bd0f4c3668fcd0d8f68d4b298b30e5b
SHA25698ce42deef51d40269d542f5314bef2c7468d401ad5d85168bfab4c0108f75f7
SHA51219dc6ae12de08b21b36c1ec7f353ce9e7cef73fa4d1354c436234167f0847bc9e2b85e2f36208f773ef324e2d79e6af1beca4470e44b8672b47d077efe33a1f8
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
23.6MB
-
Filesize
23.6MB
-
Filesize
20.5MB
-
Filesize
64KB
-
Filesize
20.5MB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
20.5MB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB