ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

set16.exe
Size

1.4MB
MD5

22d5269955f256a444bd902847b04a3b
SHA1

41a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256

ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512

d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
SSDEEP

24576:bI39dDR2/K50jpteDDyBcid0Ku1mUWOHVCakQodAgKBhE5fgRDU52KXsbIlyE3hH:b6dDk/KmpRdz1pFdyvEaY0KXsbAxVbvt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1404	is-KUJ93.tmp
2808	previewer.exe
2680	previewer.exe

Loads dropped DLL 11 IoCs

pid	Process
2484	set16.exe
1404	is-KUJ93.tmp
1404	is-KUJ93.tmp
1404	is-KUJ93.tmp
1404	is-KUJ93.tmp
1404	is-KUJ93.tmp
2808	previewer.exe
2808	previewer.exe
1404	is-KUJ93.tmp
2680	previewer.exe
2680	previewer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PA Previewer\unins000.dat	is-KUJ93.tmp
File created	C:\Program Files (x86)\PA Previewer\is-DT37I.tmp	is-KUJ93.tmp
File created	C:\Program Files (x86)\PA Previewer\is-L44OO.tmp	is-KUJ93.tmp
File created	C:\Program Files (x86)\PA Previewer\is-G5330.tmp	is-KUJ93.tmp
File created	C:\Program Files (x86)\PA Previewer\is-OQJRG.tmp	is-KUJ93.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\unins000.dat	is-KUJ93.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\previewer.exe	is-KUJ93.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	previewer.exe
Token: SeDebugPrivilege	2680	previewer.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1404	2484	set16.exe	28
PID 2484 wrote to memory of 1404	2484	set16.exe	28
PID 2484 wrote to memory of 1404	2484	set16.exe	28
PID 2484 wrote to memory of 1404	2484	set16.exe	28
PID 2484 wrote to memory of 1404	2484	set16.exe	28
PID 2484 wrote to memory of 1404	2484	set16.exe	28
PID 2484 wrote to memory of 1404	2484	set16.exe	28
PID 1404 wrote to memory of 2764	1404	is-KUJ93.tmp	29
PID 1404 wrote to memory of 2764	1404	is-KUJ93.tmp	29
PID 1404 wrote to memory of 2764	1404	is-KUJ93.tmp	29
PID 1404 wrote to memory of 2764	1404	is-KUJ93.tmp	29
PID 1404 wrote to memory of 2764	1404	is-KUJ93.tmp	29
PID 1404 wrote to memory of 2764	1404	is-KUJ93.tmp	29
PID 1404 wrote to memory of 2764	1404	is-KUJ93.tmp	29
PID 1404 wrote to memory of 2808	1404	is-KUJ93.tmp	31
PID 1404 wrote to memory of 2808	1404	is-KUJ93.tmp	31
PID 1404 wrote to memory of 2808	1404	is-KUJ93.tmp	31
PID 1404 wrote to memory of 2808	1404	is-KUJ93.tmp	31
PID 1404 wrote to memory of 2808	1404	is-KUJ93.tmp	31
PID 1404 wrote to memory of 2808	1404	is-KUJ93.tmp	31
PID 1404 wrote to memory of 2808	1404	is-KUJ93.tmp	31
PID 2764 wrote to memory of 2072	2764	net.exe	32
PID 2764 wrote to memory of 2072	2764	net.exe	32
PID 2764 wrote to memory of 2072	2764	net.exe	32
PID 2764 wrote to memory of 2072	2764	net.exe	32
PID 2764 wrote to memory of 2072	2764	net.exe	32
PID 2764 wrote to memory of 2072	2764	net.exe	32
PID 2764 wrote to memory of 2072	2764	net.exe	32
PID 1404 wrote to memory of 2680	1404	is-KUJ93.tmp	33
PID 1404 wrote to memory of 2680	1404	is-KUJ93.tmp	33
PID 1404 wrote to memory of 2680	1404	is-KUJ93.tmp	33
PID 1404 wrote to memory of 2680	1404	is-KUJ93.tmp	33
PID 1404 wrote to memory of 2680	1404	is-KUJ93.tmp	33
PID 1404 wrote to memory of 2680	1404	is-KUJ93.tmp	33
PID 1404 wrote to memory of 2680	1404	is-KUJ93.tmp	33

C:\Users\Admin\AppData\Local\Temp\set16.exe
"C:\Users\Admin\AppData\Local\Temp\set16.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\is-3H62C.tmp\is-KUJ93.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3H62C.tmp\is-KUJ93.tmp" /SL4 $30158 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 8
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 8
      4⤵
      PID:2072
- - C:\Program Files (x86)\PA Previewer\previewer.exe
    "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- - C:\Program Files (x86)\PA Previewer\previewer.exe
    "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3H62C.tmp\is-KUJ93.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3H62C.tmp\is-KUJ93.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
\Users\Admin\AppData\Local\Temp\is-3H62C.tmp\is-KUJ93.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
\Users\Admin\AppData\Local\Temp\is-MHCF6.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-MHCF6.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
\Users\Admin\AppData\Local\Temp\is-MHCF6.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-MHCF6.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1404-35-0x0000000003860000-0x0000000003A51000-memory.dmp

Filesize
1.9MB

Download
memory/1404-59-0x0000000003860000-0x0000000003A51000-memory.dmp

Filesize
1.9MB

Download
memory/1404-46-0x0000000003860000-0x0000000003A51000-memory.dmp

Filesize
1.9MB

Download
memory/1404-49-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2484-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2484-43-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2484-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2680-76-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-79-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-103-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-100-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-97-0x0000000002980000-0x00000000029C9000-memory.dmp

Filesize
292KB

Download
memory/2680-96-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-62-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-64-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-70-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-73-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-90-0x0000000002980000-0x00000000029C9000-memory.dmp

Filesize
292KB

Download
memory/2680-89-0x0000000002980000-0x00000000029C9000-memory.dmp

Filesize
292KB

Download
memory/2680-82-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-85-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2680-88-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2808-56-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2808-37-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2808-41-0x0000000000BF0000-0x0000000000DE1000-memory.dmp

Filesize
1.9MB

Download
memory/2808-42-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2808-44-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2808-47-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download