Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230824-en -
resource tags
arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system -
submitted
26/08/2023, 12:22
Static task
static1
Behavioral task
behavioral1
Sample
NovaInstaller.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
NovaInstaller.exe
Resource
win10v2004-20230703-en
General
-
Target
NovaInstaller.exe
-
Size
152.4MB
-
MD5
b22a99d3bcaec970a0ff099b095053fc
-
SHA1
8f3ddffd78e901182382cd56994fab1e85171359
-
SHA256
423ecb6f566708e142c7be0cbc1cb7475eb1f6c017c00799592a0a5a124ff13e
-
SHA512
745b56187b4abf7fbf92cca79f85c436600a83caef7a88d9fa4d7870a425ac111e64d2920357d16018e1bdfb36197b155767a9095912367d2b8e1e2b7909188e
-
SSDEEP
786432:zpj24RRx7jChNQNt/ZYLy/pGyjOy5l7y953zQ3TtLwSTRpf4P1wT1XKTTmBEA/rI:zN2ExfWNQNt/ZL3+jRuBQ
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 2792 windowsdesktop-runtime-6.0.15-win-x64.exe 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 2424 windowsdesktop-runtime-6.0.21-win-x64.exe -
Loads dropped DLL 13 IoCs
pid Process 1116 NovaInstaller.exe 1116 NovaInstaller.exe 1116 NovaInstaller.exe 2792 windowsdesktop-runtime-6.0.15-win-x64.exe 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 2244 WerFault.exe 2244 WerFault.exe 2244 WerFault.exe 2244 WerFault.exe 2244 WerFault.exe 2244 WerFault.exe 2244 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0f39db03-9030-48f3-82ef-5384bed81d85} = "\"C:\\ProgramData\\Package Cache\\{0f39db03-9030-48f3-82ef-5384bed81d85}\\windowsdesktop-runtime-6.0.21-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-6.0.21-win-x64.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.21 (x64).swidtag windowsdesktop-runtime-6.0.21-win-x64.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log windowsdesktop-runtime-6.0.21-win-x64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2244 2828 WerFault.exe 31 -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85} windowsdesktop-runtime-6.0.21-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\Dependents windowsdesktop-runtime-6.0.21-win-x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85} windowsdesktop-runtime-6.0.21-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\ = "{0f39db03-9030-48f3-82ef-5384bed81d85}" windowsdesktop-runtime-6.0.21-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\Version = "6.0.21.32717" windowsdesktop-runtime-6.0.21-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.21 (x64)" windowsdesktop-runtime-6.0.21-win-x64.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1116 NovaInstaller.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1116 wrote to memory of 2792 1116 NovaInstaller.exe 30 PID 1116 wrote to memory of 2792 1116 NovaInstaller.exe 30 PID 1116 wrote to memory of 2792 1116 NovaInstaller.exe 30 PID 1116 wrote to memory of 2792 1116 NovaInstaller.exe 30 PID 1116 wrote to memory of 2792 1116 NovaInstaller.exe 30 PID 1116 wrote to memory of 2792 1116 NovaInstaller.exe 30 PID 1116 wrote to memory of 2792 1116 NovaInstaller.exe 30 PID 2792 wrote to memory of 2828 2792 windowsdesktop-runtime-6.0.15-win-x64.exe 31 PID 2792 wrote to memory of 2828 2792 windowsdesktop-runtime-6.0.15-win-x64.exe 31 PID 2792 wrote to memory of 2828 2792 windowsdesktop-runtime-6.0.15-win-x64.exe 31 PID 2792 wrote to memory of 2828 2792 windowsdesktop-runtime-6.0.15-win-x64.exe 31 PID 2792 wrote to memory of 2828 2792 windowsdesktop-runtime-6.0.15-win-x64.exe 31 PID 2792 wrote to memory of 2828 2792 windowsdesktop-runtime-6.0.15-win-x64.exe 31 PID 2792 wrote to memory of 2828 2792 windowsdesktop-runtime-6.0.15-win-x64.exe 31 PID 2828 wrote to memory of 2424 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 32 PID 2828 wrote to memory of 2424 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 32 PID 2828 wrote to memory of 2424 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 32 PID 2828 wrote to memory of 2424 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 32 PID 2828 wrote to memory of 2424 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 32 PID 2828 wrote to memory of 2424 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 32 PID 2828 wrote to memory of 2424 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 32 PID 2828 wrote to memory of 2244 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 33 PID 2828 wrote to memory of 2244 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 33 PID 2828 wrote to memory of 2244 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 33 PID 2828 wrote to memory of 2244 2828 windowsdesktop-runtime-6.0.15-win-x64.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\NovaInstaller.exe"C:\Users\Admin\AppData\Local\Temp\NovaInstaller.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe"windowsdesktop-runtime-6.0.15-win-x64.exe" /S2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\Temp\{FE94798B-5A66-41A6-8025-52139FCA6B34}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe"C:\Windows\Temp\{FE94798B-5A66-41A6-8025-52139FCA6B34}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.filehandle.attached=184 -burn.filehandle.self=192 /S3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\Temp\{FD8061ED-053C-4EEB-B9DF-E9E7AED137AF}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe"C:\Windows\Temp\{FD8061ED-053C-4EEB-B9DF-E9E7AED137AF}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{694E700A-325C-4165-8FF3-6D1E90548BA4} {487E8081-F767-4ED8-9CF5-96262289CF7E} 28284⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 6044⤵
- Loads dropped DLL
- Program crash
PID:2244
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
54.7MB
MD51a6d60add2d112dd73e83fb46dca474d
SHA18b374a54f508cfdb8c8176bfaef96f37edf7170b
SHA256aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545
SHA51249192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79
-
Filesize
54.7MB
MD51a6d60add2d112dd73e83fb46dca474d
SHA18b374a54f508cfdb8c8176bfaef96f37edf7170b
SHA256aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545
SHA51249192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79
-
Filesize
4KB
MD59eb0320dfbf2bd541e6a55c01ddc9f20
SHA1eb282a66d29594346531b1ff886d455e1dcd6d99
SHA2569095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
SHA5129ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
-
C:\Windows\Temp\{FD8061ED-053C-4EEB-B9DF-E9E7AED137AF}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
C:\Windows\Temp\{FD8061ED-053C-4EEB-B9DF-E9E7AED137AF}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
C:\Windows\Temp\{FD8061ED-053C-4EEB-B9DF-E9E7AED137AF}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
C:\Windows\Temp\{FE94798B-5A66-41A6-8025-52139FCA6B34}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe
Filesize610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
C:\Windows\Temp\{FE94798B-5A66-41A6-8025-52139FCA6B34}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe
Filesize610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
Filesize
4.7MB
MD5ca68272d2c97f1e145f50b8cd1edf3a6
SHA183097400436f111c13ee34740e66b3de0542914b
SHA256ff5dddae92b3798cc00c14a706ecb6329c27aa6d7bb6e82b393cf8b7366458ba
SHA512ffc670aea4dad0113196d594c0fd07a838123e485ffebe3b728b8a18403b0bb82b042ccf23019c850a62466990b10a2e94102178326df735e4815dba7811d502
-
Filesize
1.2MB
MD55a137f1c0db458b0e5bb642f5293d3e6
SHA16f66bf8ad1a930c7021a95025b81af6169508a08
SHA256334a78b0e495b25b9b828216c4613a8a169129c583245da3c3b2b923d4e4c39b
SHA512d645f9c57523296923e2753202dbcd2a09f75bf46ac9a5a5525182d1d90b6f2fb078789150f4aeeafca8717098670780cbdb1e81fdb7fdd32d5ad791a2cafc79
-
Filesize
1.9MB
MD5c8af68f307e0868e673d6e69924b3b81
SHA1fbf565bdc0c1fe97b57690e3be751452d7e2fc56
SHA25623db27f5a6d7b9993f3d5179e4021913cd977d810fbfd8c482f601aee9759e47
SHA512cb4d21179504de09c62629a7b4cb23d4b771f477bf888927896abb143214451c4ad6210f2586a4e442b68eb39b9af7f42c916931849dd650044152ce7bf25720
-
Filesize
197KB
MD54356ee50f0b1a878e270614780ddf095
SHA1b5c0915f023b2e4ed3e122322abc40c4437909af
SHA25641a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
SHA512b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691
-
Filesize
197KB
MD54356ee50f0b1a878e270614780ddf095
SHA1b5c0915f023b2e4ed3e122322abc40c4437909af
SHA25641a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
SHA512b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691
-
Filesize
197KB
MD54356ee50f0b1a878e270614780ddf095
SHA1b5c0915f023b2e4ed3e122322abc40c4437909af
SHA25641a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
SHA512b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691
-
Filesize
610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
Filesize
610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
Filesize
610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
Filesize
610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
Filesize
610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
Filesize
610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
Filesize
610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9