ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

General

Target

set16.exe
Size

1.4MB
MD5

22d5269955f256a444bd902847b04a3b
SHA1

41a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256

ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512

d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
SSDEEP

24576:bI39dDR2/K50jpteDDyBcid0Ku1mUWOHVCakQodAgKBhE5fgRDU52KXsbIlyE3hH:b6dDk/KmpRdz1pFdyvEaY0KXsbAxVbvt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1340	is-DV9JC.tmp
5084	previewer.exe
2484	previewer.exe

Loads dropped DLL 3 IoCs

pid	Process
1340	is-DV9JC.tmp
1340	is-DV9JC.tmp
1340	is-DV9JC.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PA Previewer\is-3UUUH.tmp	is-DV9JC.tmp
File created	C:\Program Files (x86)\PA Previewer\is-7FEK2.tmp	is-DV9JC.tmp
File created	C:\Program Files (x86)\PA Previewer\is-G00M2.tmp	is-DV9JC.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\unins000.dat	is-DV9JC.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\previewer.exe	is-DV9JC.tmp
File created	C:\Program Files (x86)\PA Previewer\unins000.dat	is-DV9JC.tmp
File created	C:\Program Files (x86)\PA Previewer\is-QP9N9.tmp	is-DV9JC.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	previewer.exe
Token: SeDebugPrivilege	2484	previewer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1340	1412	set16.exe	87
PID 1412 wrote to memory of 1340	1412	set16.exe	87
PID 1412 wrote to memory of 1340	1412	set16.exe	87
PID 1340 wrote to memory of 1540	1340	is-DV9JC.tmp	90
PID 1340 wrote to memory of 1540	1340	is-DV9JC.tmp	90
PID 1340 wrote to memory of 1540	1340	is-DV9JC.tmp	90
PID 1340 wrote to memory of 5084	1340	is-DV9JC.tmp	91
PID 1340 wrote to memory of 5084	1340	is-DV9JC.tmp	91
PID 1340 wrote to memory of 5084	1340	is-DV9JC.tmp	91
PID 1540 wrote to memory of 3928	1540	net.exe	94
PID 1540 wrote to memory of 3928	1540	net.exe	94
PID 1540 wrote to memory of 3928	1540	net.exe	94
PID 1340 wrote to memory of 2484	1340	is-DV9JC.tmp	96
PID 1340 wrote to memory of 2484	1340	is-DV9JC.tmp	96
PID 1340 wrote to memory of 2484	1340	is-DV9JC.tmp	96

C:\Users\Admin\AppData\Local\Temp\set16.exe
"C:\Users\Admin\AppData\Local\Temp\set16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\is-MPNOE.tmp\is-DV9JC.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MPNOE.tmp\is-DV9JC.tmp" /SL4 $C0064 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 8
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 8
      4⤵
      PID:3928
- - C:\Program Files (x86)\PA Previewer\previewer.exe
    "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Program Files (x86)\PA Previewer\previewer.exe
    "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MPNOE.tmp\is-DV9JC.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MPNOE.tmp\is-DV9JC.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VDOIL.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VDOIL.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VDOIL.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
memory/1340-32-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1340-33-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1340-40-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1340-7-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1412-23-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1412-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2484-54-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2484-75-0x0000000000860000-0x00000000008A9000-memory.dmp

Filesize
292KB

Download
memory/2484-87-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2484-84-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2484-48-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2484-82-0x0000000000860000-0x00000000008A9000-memory.dmp

Filesize
292KB

Download
memory/2484-57-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2484-60-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2484-63-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2484-66-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2484-69-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2484-72-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2484-74-0x0000000000860000-0x00000000008A9000-memory.dmp

Filesize
292KB

Download
memory/2484-79-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5084-44-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5084-39-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5084-45-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5084-41-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing