Analysis
-
max time kernel
558s -
max time network
524s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-it -
resource tags
arch:x64arch:x86image:win10v2004-20230703-itlocale:it-itos:windows10-2004-x64systemwindows -
submitted
15/07/2023, 13:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
USBHelperInstaller.exe
Resource
win7-20230712-it
windows7-x64
14 signatures
1800 seconds
Behavioral task
behavioral2
Sample
USBHelperInstaller.exe
Resource
win10v2004-20230703-it
windows10-2004-x64
11 signatures
1800 seconds
General
-
Target
USBHelperInstaller.exe
-
Size
282KB
-
MD5
d387c6c808a9ab80f0d8e843500f903d
-
SHA1
b14fc2a27c1e215d74d8cb6f01729855c1dbd8f4
-
SHA256
43d9426874eea0bb56c3feac25d20bc35fb3ddaa9447e1ca5f0ba3de1d194382
-
SHA512
e60b8d2ffebb9bbb27c31b52b0d6c597e0a72486a7865ecee84b40a84f8e9e102353990314d28cf01227a30c5fc3c1f407f38c95c68ec69ca075549dc9ce2085
-
SSDEEP
6144:F5GZq/Z1IVfA1AbKowcNj/CGYSx3YT+tT8:iZGZ05fwcNj/CDYoCV8
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1432 USBHelperInstaller.exe 1432 USBHelperInstaller.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Kills process with taskkill 1 IoCs
pid Process 3124 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4336 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4336 taskmgr.exe Token: SeSystemProfilePrivilege 4336 taskmgr.exe Token: SeCreateGlobalPrivilege 4336 taskmgr.exe Token: SeDebugPrivilege 3124 taskkill.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe 4336 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1808 wrote to memory of 3124 1808 cmd.exe 108 PID 1808 wrote to memory of 3124 1808 cmd.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\USBHelperInstaller.exe"C:\Users\Admin\AppData\Local\Temp\USBHelperInstaller.exe"1⤵
- Loads dropped DLL
PID:1432
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4336
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\taskkill.exetaskkill /f /im svchost.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5fbe295e5a1acfbd0a6271898f885fe6a
SHA1d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA5122cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
-
Filesize
9KB
MD5ab101f38562c8545a641e95172c354b4
SHA1ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
SHA2563cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
SHA51272d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037