Analysis
-
max time kernel
107s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
12-06-2023 09:57
General
-
Target
DriverToolkitInstaller.exe
-
Size
2.3MB
-
MD5
ade449592745b54724fa70ec488b99fd
-
SHA1
9aa32c2a67da99465f6b4c8c88cd52b109a243c4
-
SHA256
2097cfcef072f6b12370139d94a171073df2255807c01ad6d747f0d24a190aa6
-
SHA512
9675264caea44f30c035013f617591679b0802f8d7bc552b0091b944720db67ebc7ec3d1e9536ba7f13dcb07ef591d20e5c063de6e3979540c34d2b0963156ed
-
SSDEEP
49152:khg3LcSpYqQLyUf42fy6A4OeOqdAIjtYKmbaS/0GfVfcDi9r:JLcSpd8yEzvPlK1JODiN
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 10 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 23 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DriverToolkitInstaller.exe"C:\Users\Admin\AppData\Local\Temp\DriverToolkitInstaller.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RJD4T.tmp\DriverToolkitInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-RJD4T.tmp\DriverToolkitInstaller.tmp" /SL5="$80022,2034942,134144,C:\Users\Admin\AppData\Local\Temp\DriverToolkitInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe"C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5b35bcdc8758f44bb092590d92a8e744c
SHA1ed9f80437bd8c6de9a5d5969432574711d054eaa
SHA256a32a89ecbe1047c8644acbc85bb5306dfb9abcb8213e8c5253e68b196093a53a
SHA512afa694298870d736d44f99707e0b69f42e3f423c345e44d4ad089ad6295296b18a1a0bcbf2110ef244045983e797b862f8576d5fc63c4e64d86aa03737049516
-
Filesize
1.2MB
MD5b35bcdc8758f44bb092590d92a8e744c
SHA1ed9f80437bd8c6de9a5d5969432574711d054eaa
SHA256a32a89ecbe1047c8644acbc85bb5306dfb9abcb8213e8c5253e68b196093a53a
SHA512afa694298870d736d44f99707e0b69f42e3f423c345e44d4ad089ad6295296b18a1a0bcbf2110ef244045983e797b862f8576d5fc63c4e64d86aa03737049516
-
Filesize
411KB
MD5bc83108b18756547013ed443b8cdb31b
SHA179bcaad3714433e01c7f153b05b781f8d7cb318d
SHA256b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
SHA5126e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
187KB
MD50596b14e74b80af026915b15276eee59
SHA17c2d01ed093039be7e25307dd1fda12ee4ecd0b9
SHA256f13fbad53d5f392c2fc6361003da7127d57d6a6b2a10113e3b1247251f0b7898
SHA512ad74c3637cfca02effa31aaeafdad1671d15d0cd776cd5fdc0d0b41a83984ab6b9c8b2b13bf67b239b4ec99412579a529245b2424f7826194e43b4fb8235efec
-
Filesize
90KB
MD5f59ad5e4b0cc94ae0089f633df6bb0cf
SHA19862043ab406a84ee88dfe619c42f1bc55a1d983
SHA25686560fbce53b50200dc26f55de0c73d36f2cdba6533ce581232f4b6c1033c81d
SHA512c1ac9c30a632fdb9d7ef8a5ad31d7426f701cfaec88e95120f20dd9075876df229ae5de0ffd17f651f6c50da6d00287215675eb810917034310a99bb994e6d6c
-
Filesize
1.1MB
MD54fec953b2903ca1dc503a08db5dfd8b7
SHA14d1ae35ce801b19abe2ffa48c972a6c416b92644
SHA25625a03caed8ced6b4aff82ac86106bf1401f6c780c7719d821e8b44c2b7496680
SHA5121baf114e41190c4acf436d39ae3db424f9fafb64a0219a580a33f70f5c24e117710830f29a6c2b06c977055644d764c83820e55d49c8d49d0a894e6ab133a85a
-
Filesize
1.1MB
MD54fec953b2903ca1dc503a08db5dfd8b7
SHA14d1ae35ce801b19abe2ffa48c972a6c416b92644
SHA25625a03caed8ced6b4aff82ac86106bf1401f6c780c7719d821e8b44c2b7496680
SHA5121baf114e41190c4acf436d39ae3db424f9fafb64a0219a580a33f70f5c24e117710830f29a6c2b06c977055644d764c83820e55d49c8d49d0a894e6ab133a85a
-
Filesize
1.2MB
MD5b35bcdc8758f44bb092590d92a8e744c
SHA1ed9f80437bd8c6de9a5d5969432574711d054eaa
SHA256a32a89ecbe1047c8644acbc85bb5306dfb9abcb8213e8c5253e68b196093a53a
SHA512afa694298870d736d44f99707e0b69f42e3f423c345e44d4ad089ad6295296b18a1a0bcbf2110ef244045983e797b862f8576d5fc63c4e64d86aa03737049516
-
Filesize
1.2MB
MD5b35bcdc8758f44bb092590d92a8e744c
SHA1ed9f80437bd8c6de9a5d5969432574711d054eaa
SHA256a32a89ecbe1047c8644acbc85bb5306dfb9abcb8213e8c5253e68b196093a53a
SHA512afa694298870d736d44f99707e0b69f42e3f423c345e44d4ad089ad6295296b18a1a0bcbf2110ef244045983e797b862f8576d5fc63c4e64d86aa03737049516
-
Filesize
411KB
MD5bc83108b18756547013ed443b8cdb31b
SHA179bcaad3714433e01c7f153b05b781f8d7cb318d
SHA256b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
SHA5126e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
187KB
MD50596b14e74b80af026915b15276eee59
SHA17c2d01ed093039be7e25307dd1fda12ee4ecd0b9
SHA256f13fbad53d5f392c2fc6361003da7127d57d6a6b2a10113e3b1247251f0b7898
SHA512ad74c3637cfca02effa31aaeafdad1671d15d0cd776cd5fdc0d0b41a83984ab6b9c8b2b13bf67b239b4ec99412579a529245b2424f7826194e43b4fb8235efec
-
Filesize
1.2MB
MD5b1d6153b48e44d135fe52764dfbf9ee5
SHA170d81552cce6295120d956b3a93958dd8ace9dd1
SHA25650869791dc0b586891f406ef19f89a90041dd7c8458ba68622a24f834fe2d0da
SHA5128bcf4eac7158dfb33674691edb1c6ca286cb1010b8ef3fd12ddaeaf6be9e707e6ecc4dddd1426648e1193b436bab25d30a1c6607b2197d8944d6767ad8c187fc
-
Filesize
90KB
MD5f59ad5e4b0cc94ae0089f633df6bb0cf
SHA19862043ab406a84ee88dfe619c42f1bc55a1d983
SHA25686560fbce53b50200dc26f55de0c73d36f2cdba6533ce581232f4b6c1033c81d
SHA512c1ac9c30a632fdb9d7ef8a5ad31d7426f701cfaec88e95120f20dd9075876df229ae5de0ffd17f651f6c50da6d00287215675eb810917034310a99bb994e6d6c
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.1MB
MD54fec953b2903ca1dc503a08db5dfd8b7
SHA14d1ae35ce801b19abe2ffa48c972a6c416b92644
SHA25625a03caed8ced6b4aff82ac86106bf1401f6c780c7719d821e8b44c2b7496680
SHA5121baf114e41190c4acf436d39ae3db424f9fafb64a0219a580a33f70f5c24e117710830f29a6c2b06c977055644d764c83820e55d49c8d49d0a894e6ab133a85a
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB