Analysis
-
max time kernel
2s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
02-01-2024 15:58
General
-
Target
installerexe.exe
-
Size
12.3MB
-
MD5
754ba59f4a661eb58ee6b9f170e9d84e
-
SHA1
2b633997fde8498f8b0705088d1af1094164ad31
-
SHA256
c19fa15613c590a4ceec40dc9e20871629af92309dd16cfb0585ca7543c4205a
-
SHA512
521cd56d81a2d9a0885d4255a1bb1ddc293d65339e26cc833ac6916c2b232dfbdab9b0c7da3933b3df7060ab7a8869bc054c451434760bf90e4e12d29c046488
-
SSDEEP
393216:OLKbbx3AgGnkQUXdiUyEaXM5FikLn2UGW5a2UQHj:OWbbx3TNt6bf64WjUu
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 2 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\installerexe.exe"C:\Users\Admin\AppData\Local\Temp\installerexe.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\installer.exeC:\Users\Admin\AppData\Roaming\installer.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\installer.exe"3⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "ghub"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "ghub" binpath= "C:\ProgramData\bnmabkttxedp\ghub.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "ghub"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\instaIIer.exeC:\Users\Admin\AppData\Roaming\instaIIer.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 31⤵
-
C:\ProgramData\bnmabkttxedp\ghub.exeC:\ProgramData\bnmabkttxedp\ghub.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
-
C:\Windows\system32\dwm.exedwm.exe2⤵
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"1⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD576a76e44c856c2aca6c8d668da52d28b
SHA17845adf8a65ad355b42bdf628ad8df9bd135ffed
SHA2565066cecbdbfa84b68b931e257ab58ce829a6b750b2f169f5be307c92dc89b630
SHA51207acb96a7f946f219fb273bd28b703e15061f2baebfd7d320b74066601a58b441fa932ae847d339e59481a26e0dd418d033911123d513e1b3307f731babd3e3a
-
Filesize
448KB
MD597c6900e59e84974d603a0e55d3ff4a8
SHA1b23b19b009abec3a4e96a06618fa43cbf960dfd1
SHA2563d4203a37005204db72112b601425b69d1ed8a9df0d5ec74292e43fb7488cfee
SHA51255eef3819c50f1a2727257ba8c6bcd3ba75a72e57c13297a010ecf652a5933f926d0e40cba151d554547cb21788e77cc1d7fc23167a94a452345ce2dd533c07a
-
Filesize
94KB
MD5460f436117fc61b8bedf29a47c3939a8
SHA1c69d829538c3bf9d9016074f4b4bfa112082fc14
SHA256905a462517469f3fe7f4157e17a599db7fafaf76fdfd0fc8596e324cf7d37d4c
SHA5121c4ee55628b90ecff1670a01889c6494aad45c0606e0fde420f7d0252e08713c8858dcaf56f5fb5b3f9d73a34d478f23bcc7cf0494f0b1352a3071ed80853444
-
Filesize
92KB
MD5f808f0f44d2f149c9ef306c956ac8a58
SHA1f221334c5975d5ee08280d37da570ed2ccff5a77
SHA256534daa630b83aa1d2eab387ed5904abdf5ecc0df591140e0cd6a2a331e8bb313
SHA5121ec7a2d96bb38360032459b4807c1863d285f59f0b4d2888cafd5b14aab840dbacfe17099e24cadd67c91b8fafffd7ff6260baabe0c5045a22acf9bc368428fd
-
Filesize
10.7MB
-
Filesize
8KB
-
Filesize
10.7MB
-
Filesize
10.7MB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
112KB
-
Filesize
724KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
10.7MB
-
Filesize
10.7MB
-
Filesize
2.1MB
-
Filesize
36KB
-
Filesize
2.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
4.7MB
-
Filesize
4KB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
2.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
2.1MB
-
Filesize
4.7MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB