f88a5a49bcf052cbd2f42bbc3765b9637ec118a031f85dbf587eca0eb9c9409b

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

2.6MB
MD5

a95e963284fb2069ef458b635142f8e4
SHA1

1926ee4416b34cf9073f5bb2f1ed586539750d55
SHA256

f88a5a49bcf052cbd2f42bbc3765b9637ec118a031f85dbf587eca0eb9c9409b
SHA512

791af568e8edf9d6641f2f9dc02688c55ec31b916eb070559059c74c3e1aa48be6df15d104a7bb53693b5fc58acc6f4e6c8097bf9a497746f6c525c7fc4fca27
SSDEEP

49152:HC2HOqRgFMJSpp2V7uRZyJK1j1mlebFPsaXcmC:i2XR9VgRZ51j1Bjcx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2724	setup.tmp
2576	unins000.exe
2424	_iu14D2N.tmp

Loads dropped DLL 11 IoCs

pid	Process
2056	setup.exe
2724	setup.tmp
2724	setup.tmp
2724	setup.tmp
2724	setup.tmp
2724	setup.tmp
2724	setup.tmp
2724	setup.tmp
2576	unins000.exe
2424	_iu14D2N.tmp
2424	_iu14D2N.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	setup.tmp
2724	setup.tmp

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2724	setup.tmp
2724	setup.tmp
2724	setup.tmp
2424	_iu14D2N.tmp

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2724	2056	setup.exe	30
PID 2056 wrote to memory of 2724	2056	setup.exe	30
PID 2056 wrote to memory of 2724	2056	setup.exe	30
PID 2056 wrote to memory of 2724	2056	setup.exe	30
PID 2056 wrote to memory of 2724	2056	setup.exe	30
PID 2056 wrote to memory of 2724	2056	setup.exe	30
PID 2056 wrote to memory of 2724	2056	setup.exe	30
PID 2724 wrote to memory of 2576	2724	setup.tmp	31
PID 2724 wrote to memory of 2576	2724	setup.tmp	31
PID 2724 wrote to memory of 2576	2724	setup.tmp	31
PID 2724 wrote to memory of 2576	2724	setup.tmp	31
PID 2724 wrote to memory of 2576	2724	setup.tmp	31
PID 2724 wrote to memory of 2576	2724	setup.tmp	31
PID 2724 wrote to memory of 2576	2724	setup.tmp	31
PID 2576 wrote to memory of 2424	2576	unins000.exe	32
PID 2576 wrote to memory of 2424	2576	unins000.exe	32
PID 2576 wrote to memory of 2424	2576	unins000.exe	32
PID 2576 wrote to memory of 2424	2576	unins000.exe	32
PID 2576 wrote to memory of 2424	2576	unins000.exe	32
PID 2576 wrote to memory of 2424	2576	unins000.exe	32
PID 2576 wrote to memory of 2424	2576	unins000.exe	32

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\is-4KIVE.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4KIVE.tmp\setup.tmp" /SL5="$80120,2219508,677376,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Games\Cuphead\unins000.exe
    "C:\Games\Cuphead\unins000.exe" /VERYSILENT /NODELSAVE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\Cuphead\unins000.exe" /FIRSTPHASEWND=$6019E /VERYSILENT /NODELSAVE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Games\Cuphead\unins000.dat

Filesize
25KB

MD5
6f80bd6ac3952dc332730b1e203848f3

SHA1
7ad9677098e320f42cc6201ebd56d08ef148acb0

SHA256
64fc397b0fc444870d32544e88f4bc036bf034230fc340cf809bd4ceffa98259

SHA512
57302a64177e7150033ffd3bac4805467691e5b2cdc54b962b90890270d21541f57ccc2aba1a0f42fd370f17c8c887dd5c295b09fb80b4e9c0c37efa4296ff21

Download Submit
C:\Games\Cuphead\unins000.exe

Filesize
1.7MB

MD5
88e39bf40004bdf0c2a0ade429d0dd1c

SHA1
29f3ffff900b0a774a8ac2887bea95a18f58cba8

SHA256
63db08a24b32f04245b4126bfd892788d38c812eb2fc4a489e2c9e8727d64e41

SHA512
8800afc561100dcb2051b7a1a3eab7cba96a8590249cd22202d222656a59c49d5f905131c986cc5059309ffbcf412858376d1f5c1baf8295cecc871d4084b98a

Download Submit
C:\Games\Cuphead\unins000.exe

Filesize
1.7MB

MD5
88e39bf40004bdf0c2a0ade429d0dd1c

SHA1
29f3ffff900b0a774a8ac2887bea95a18f58cba8

SHA256
63db08a24b32f04245b4126bfd892788d38c812eb2fc4a489e2c9e8727d64e41

SHA512
8800afc561100dcb2051b7a1a3eab7cba96a8590249cd22202d222656a59c49d5f905131c986cc5059309ffbcf412858376d1f5c1baf8295cecc871d4084b98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
1.7MB

MD5
88e39bf40004bdf0c2a0ade429d0dd1c

SHA1
29f3ffff900b0a774a8ac2887bea95a18f58cba8

SHA256
63db08a24b32f04245b4126bfd892788d38c812eb2fc4a489e2c9e8727d64e41

SHA512
8800afc561100dcb2051b7a1a3eab7cba96a8590249cd22202d222656a59c49d5f905131c986cc5059309ffbcf412858376d1f5c1baf8295cecc871d4084b98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
1.7MB

MD5
88e39bf40004bdf0c2a0ade429d0dd1c

SHA1
29f3ffff900b0a774a8ac2887bea95a18f58cba8

SHA256
63db08a24b32f04245b4126bfd892788d38c812eb2fc4a489e2c9e8727d64e41

SHA512
8800afc561100dcb2051b7a1a3eab7cba96a8590249cd22202d222656a59c49d5f905131c986cc5059309ffbcf412858376d1f5c1baf8295cecc871d4084b98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
1.7MB

MD5
88e39bf40004bdf0c2a0ade429d0dd1c

SHA1
29f3ffff900b0a774a8ac2887bea95a18f58cba8

SHA256
63db08a24b32f04245b4126bfd892788d38c812eb2fc4a489e2c9e8727d64e41

SHA512
8800afc561100dcb2051b7a1a3eab7cba96a8590249cd22202d222656a59c49d5f905131c986cc5059309ffbcf412858376d1f5c1baf8295cecc871d4084b98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4KIVE.tmp\setup.tmp

Filesize
1.7MB

MD5
a5faf7e2b3a81fdb344d763156090100

SHA1
47e6b450cc0699724a0e59bd75f960469f747a9d

SHA256
d7766eb1ea7b46be7bfedcec670c2bb7935e25c13be3235cdc071138764f5c21

SHA512
e16ce69ed9458122da496c3c8ea505a3718e54be5ab4a25a9b9349a4fc1412c2c2dcf2aa4aaccfbb87455d859cb99283160ed40c69963d621a149b49b0455764

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4KIVE.tmp\setup.tmp

Filesize
1.7MB

MD5
a5faf7e2b3a81fdb344d763156090100

SHA1
47e6b450cc0699724a0e59bd75f960469f747a9d

SHA256
d7766eb1ea7b46be7bfedcec670c2bb7935e25c13be3235cdc071138764f5c21

SHA512
e16ce69ed9458122da496c3c8ea505a3718e54be5ab4a25a9b9349a4fc1412c2c2dcf2aa4aaccfbb87455d859cb99283160ed40c69963d621a149b49b0455764

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6RF36.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Games\Cuphead\unins000.exe

Filesize
1.7MB

MD5
88e39bf40004bdf0c2a0ade429d0dd1c

SHA1
29f3ffff900b0a774a8ac2887bea95a18f58cba8

SHA256
63db08a24b32f04245b4126bfd892788d38c812eb2fc4a489e2c9e8727d64e41

SHA512
8800afc561100dcb2051b7a1a3eab7cba96a8590249cd22202d222656a59c49d5f905131c986cc5059309ffbcf412858376d1f5c1baf8295cecc871d4084b98a

Download Submit
\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
1.7MB

MD5
88e39bf40004bdf0c2a0ade429d0dd1c

SHA1
29f3ffff900b0a774a8ac2887bea95a18f58cba8

SHA256
63db08a24b32f04245b4126bfd892788d38c812eb2fc4a489e2c9e8727d64e41

SHA512
8800afc561100dcb2051b7a1a3eab7cba96a8590249cd22202d222656a59c49d5f905131c986cc5059309ffbcf412858376d1f5c1baf8295cecc871d4084b98a

Download Submit
\Users\Admin\AppData\Local\Temp\is-4KIVE.tmp\setup.tmp

Filesize
1.7MB

MD5
a5faf7e2b3a81fdb344d763156090100

SHA1
47e6b450cc0699724a0e59bd75f960469f747a9d

SHA256
d7766eb1ea7b46be7bfedcec670c2bb7935e25c13be3235cdc071138764f5c21

SHA512
e16ce69ed9458122da496c3c8ea505a3718e54be5ab4a25a9b9349a4fc1412c2c2dcf2aa4aaccfbb87455d859cb99283160ed40c69963d621a149b49b0455764

Download Submit
\Users\Admin\AppData\Local\Temp\is-6RF36.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-6RF36.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-IANKJ.tmp\ISDone.dll

Filesize
452KB

MD5
4feafa8b5e8cdb349125c8af0ac43974

SHA1
7f17e5e1b088fc73690888b215962fbcd395c9bd

SHA256
bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71

SHA512
d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc

Download Submit
\Users\Admin\AppData\Local\Temp\is-IANKJ.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-IANKJ.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-IANKJ.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-IANKJ.tmp\callbackctrl.dll

Filesize
4KB

MD5
f07e819ba2e46a897cfabf816d7557b2

SHA1
8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

SHA256
68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

SHA512
7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

Download Submit
\Users\Admin\AppData\Local\Temp\is-IANKJ.tmp\wintb.dll

Filesize
16KB

MD5
9436df49e08c83bad8ddc906478c2041

SHA1
a4fa6bdd2fe146fda2e78fdbab355797f53b7dce

SHA256
1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435

SHA512
f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf

Download Submit
memory/2056-36-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2056-130-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2056-1-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2424-97-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2424-86-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2576-94-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2576-77-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2724-40-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2724-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2724-38-0x0000000002ED0000-0x0000000002F47000-memory.dmp

Filesize
476KB

Download
memory/2724-39-0x000000006B080000-0x000000006B08D000-memory.dmp

Filesize
52KB

Download
memory/2724-64-0x000000006B080000-0x000000006B08D000-memory.dmp

Filesize
52KB

Download
memory/2724-42-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2724-20-0x0000000002ED0000-0x0000000002F47000-memory.dmp

Filesize
476KB

Download
memory/2724-37-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2724-62-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2724-63-0x0000000002ED0000-0x0000000002F47000-memory.dmp

Filesize
476KB

Download
memory/2724-99-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2724-100-0x0000000002ED0000-0x0000000002F47000-memory.dmp

Filesize
476KB

Download
memory/2724-101-0x000000006B080000-0x000000006B08D000-memory.dmp

Filesize
52KB

Download
memory/2724-129-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2724-66-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download