Analysis

  • max time kernel
    248s
  • max time network
    255s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    14/01/2024, 01:56

General

  • Target
    amd-catalyst-15.7.1-win10-64bit.exe
  • Size 217.4MB
  • Sample240114-cc3qqabab3
  • SHA256 89e21371c6a0178c231111542210110e0d5d6afe12b5d6e0b19190203c7bc6fa
  • MD5 SHA1 SHA512 SSDEEP
Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\amd-catalyst-15.7.1-win10-64bit.exe
    "C:\Users\Admin\AppData\Local\Temp\amd-catalyst-15.7.1-win10-64bit.exe"
    1⤵
      PID:4420
      • C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\setup.exe
        "C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\setup.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4936
        • C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\Setup.exe
          "C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\Setup.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4256
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9dca61e5hab6ah4fbbhb815h051f63eefc36
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4568
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe2c3446f8,0x7ffe2c344708,0x7ffe2c344718
        2⤵
          PID:2720
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,3004542867319309697,15249759105638488631,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:220
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3004542867319309697,15249759105638488631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
          2⤵
            PID:3372
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,3004542867319309697,15249759105638488631,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
            2⤵
              PID:3568
          • C:\Windows\System32\CompPkgSrv.exe
            C:\Windows\System32\CompPkgSrv.exe -Embedding
            1⤵
              PID:5052
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:1884
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
                1⤵
                  PID:4632
                • C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\InstallManagerApp.exe
                  "C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\InstallManagerApp.exe" /IGNORE_UPGRADE
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:956

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      ATILog.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\ATILog.dll
                      • Size 81KB
                      • SHA256 38e0e6702bc3b6b0218343d9e33b01ec9a2fe5d4b775a79d8cc09c24ea5dc6d8
                      • MD5 SHA1 SHA512 SSDEEP

                      ATILog.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\ATILog.dll
                      • Size 68KB
                      • SHA256 2cba630d4e8a4795a00e40ed7890fd83dede31b73a614732aae53cb6227976f0
                      • MD5 SHA1 SHA512 SSDEEP

                      DetectionManager.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\DetectionManager.dll
                      • Size 509KB
                      • SHA256 1687786169c20bd942e3af617f2d0e477d25ec2cab06d893e4b8a54c31379e92
                      • MD5 SHA1 SHA512 SSDEEP

                      DetectionManager.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\DetectionManager.dll
                      • Size 513KB
                      • SHA256 0586d0cbc6cf0a99ea11435ac30228226c55a7820af475485719b6ae1afa1834
                      • MD5 SHA1 SHA512 SSDEEP

                      InstallManager.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\InstallManager.dll
                      • Size 82KB
                      • SHA256 37021106d6c524190d6070ff5e9ece6ada1b673d4236da9db6d7bc3839a5eb81
                      • MD5 SHA1 SHA512 SSDEEP

                      InstallManager.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\InstallManager.dll
                      • Size 76KB
                      • SHA256 009422cace8f45388cdb14eee9eb3eccb4503857877c2000c2661c6d2ef416d9
                      • MD5 SHA1 SHA512 SSDEEP

                      InstallManagerApp.exe

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\InstallManagerApp.exe
                      • Size 84KB
                      • SHA256 0ae5b0e8a12a528ff017a7b2711beeb1cb055751dd852a86f01efc3c51beb7da
                      • MD5 SHA1 SHA512 SSDEEP

                      InstallManagerApp.exe

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\InstallManagerApp.exe
                      • Size 1.5MB
                      • SHA256 ffd1936f90cefce7dc934b7c537961bded5340c23e46b0a39322ac045157c053
                      • MD5 SHA1 SHA512 SSDEEP

                      LanguageMgr.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\LanguageMgr.dll
                      • Size 51KB
                      • SHA256 893be2bda02121de68a6b6d9b735d7ae5e4618c2c3e35f26614de55191e78728
                      • MD5 SHA1 SHA512 SSDEEP

                      LanguageMgr.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\LanguageMgr.dll
                      • Size 33KB
                      • SHA256 85cf7fa7a7e6d3a8bad8ce17f29a9a180a5499ffe56739f7da0c7d1125f66d50
                      • MD5 SHA1 SHA512 SSDEEP

                      MSVCP110.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\MSVCP110.dll
                      • Size 96KB
                      • SHA256 425b9fab46e299fc9f7408c028da5682187f92418ec9d64ca2078ebe028a0763
                      • MD5 SHA1 SHA512 SSDEEP

                      MSVCR110.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\MSVCR110.dll
                      • Size 132KB
                      • SHA256 ce16a4777b2772cdcebf7f98ade777964c4e394a5a8973909acd5eaf2f33722e
                      • MD5 SHA1 SHA512 SSDEEP

                      PackageManager.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\PackageManager.dll
                      • Size 509KB
                      • SHA256 c90144e33b06b058a13872215095bcd3f65fbb977d24066a95d19ff744d07aa8
                      • MD5 SHA1 SHA512 SSDEEP

                      PackageManager.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\PackageManager.dll
                      • Size 564KB
                      • SHA256 d11b638e5a4f2052e683a87664b60c8b0e0ac0bd1b82217b61b14745ec112527
                      • MD5 SHA1 SHA512 SSDEEP

                      Setup.exe

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\Setup.exe
                      • Size 61KB
                      • SHA256 6400996b99fe9a3735fa4998905786721dfb4cccef3d4536813a0280791bf300
                      • MD5 SHA1 SHA512 SSDEEP

                      atiLog.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\atiLog.dll
                      • Size 69KB
                      • SHA256 c79cc4d49691bdb6fd992d737288a8cc877aa0fe5ee5a14ef3a515636d732fdb
                      • MD5 SHA1 SHA512 SSDEEP

                      mfc110u.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\mfc110u.dll
                      • Size 95KB
                      • SHA256 7a5abcdf193d97bf9e684f25358df78217d2fd6a1e94e44270af3cbc9936d642
                      • MD5 SHA1 SHA512 SSDEEP

                      mfc110u.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\mfc110u.dll
                      • Size 62KB
                      • SHA256 ebc3fd9cb4919b1a68609b9be5689da652b2e71c7351db71f7e75cd37c00aad9
                      • MD5 SHA1 SHA512 SSDEEP

                      mfc110u.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\mfc110u.dll
                      • Size 45KB
                      • SHA256 2d264a853f1491947febac7de4d44731130331b8321880658e3eef5696bdd596
                      • MD5 SHA1 SHA512 SSDEEP

                      msvcp110.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\msvcp110.dll
                      • Size 57KB
                      • SHA256 76226f646836e64164327132fb9b9ecd937bf3528efe644c6083ffd7d84cdb3d
                      • MD5 SHA1 SHA512 SSDEEP

                      msvcp110.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\msvcp110.dll
                      • Size 126KB
                      • SHA256 acb3e24e73adf34a661112f08f80f6dfe02e79740c80f597bd5a128355f2f35b
                      • MD5 SHA1 SHA512 SSDEEP

                      msvcr110.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\msvcr110.dll
                      • Size 93KB
                      • SHA256 bc0b24e1cdb18ec62b67ecf514f995e4a5df5e7f8340ded0551dc3aa637beb41
                      • MD5 SHA1 SHA512 SSDEEP

                      msvcr110.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\msvcr110.dll
                      • Size 78KB
                      • SHA256 e82776ff32d5d3eae8bb1a25a7d2462b27f773e3e6db19ebdcdf308e46cfa739
                      • MD5 SHA1 SHA512 SSDEEP

                      xerces-c_2_6.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\xerces-c_2_6.dll
                      • Size 78KB
                      • SHA256 cf7ab3cbf85abafedd4fdd6bf0cc0b048af53a06dc66b15c4ac390f8a2139a7b
                      • MD5 SHA1 SHA512 SSDEEP

                      xerces-c_2_6.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Bin64\xerces-c_2_6.dll
                      • Size 84KB
                      • SHA256 a2c348f8b6fe2c83957d0aabf4891fa1aa1c31527b5e27c76506e9b83f626d07
                      • MD5 SHA1 SHA512 SSDEEP

                      Chipset.msi

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Config\Chipset.msi
                      • Size 25KB
                      • SHA256 1e2cc4b7a20d0ad996b9f47cfa7a716d174765b082aa1ba1465b7d65b15eb086
                      • MD5 SHA1 SHA512 SSDEEP

                      InstallManager.cfg

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Config\InstallManager.cfg
                      • Size 647B
                      • SHA256 7ce6fba943f30486bbe4886f654eeae64e040aad9cf38284185df78dae18daf3
                      • MD5 SHA1 SHA512

                      MonetENU.xml

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Config\MonetENU.xml
                      • Size 44KB
                      • SHA256 bb911cdf94373f31844b9a9111cac667c52160f88f9e2da1d99490ecee2d4426
                      • MD5 SHA1 SHA512 SSDEEP

                      MonetESP.xml

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Config\MonetESP.xml
                      • Size 57KB
                      • SHA256 b1c886dfea46638a19107e0554ab7516d936b76f1380b6eae076b3c3e377c690
                      • MD5 SHA1 SHA512 SSDEEP

                      Splash.bmp

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Config\Splash.bmp
                      • Size 100KB
                      • SHA256 eedef4cde3575d1b6ae73852a3bcb6272928fd4bdbf5d609947915183b8efa91
                      • MD5 SHA1 SHA512 SSDEEP

                      MSVCP110.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\MSVCP110.dll
                      • Size 106KB
                      • SHA256 55228d22ad22c450c015eaeae29bf39117a54599373108a4b29cae8cc0be9b40
                      • MD5 SHA1 SHA512 SSDEEP

                      MSVCR110.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\MSVCR110.dll
                      • Size 98KB
                      • SHA256 f634cfbdd54e91cdb9373dc139bcfd0fac4bd39d8aea5491a0b0f496003b28ef
                      • MD5 SHA1 SHA512 SSDEEP

                      1043.mst

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Packages\Apps\CCC2\Core-Static-Net4\1043.mst
                      • Size 104KB
                      • SHA256 8149eacd60980af10b11374894153608f33f28f86e66ec1ad9eb487232ae2f50
                      • MD5 SHA1 SHA512 SSDEEP

                      1049.mst

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Packages\Apps\CCC2\Core-Static-Net4\1049.mst
                      • Size 100KB
                      • SHA256 cf4cdb9243461f1fd4782c73ca71f4674f2baf3545eb05e4e30cae95823240c3
                      • MD5 SHA1 SHA512 SSDEEP

                      3084.mst

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Packages\Apps\CCC2\Core-Static-Net4\3084.mst
                      • Size 108KB
                      • SHA256 edcbe1ca019ac0fdb89027eb7f2add30f82c97ae938bed8eea440763f8692890
                      • MD5 SHA1 SHA512 SSDEEP

                      1038.mst

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Packages\Apps\CIM\Win64\1038.mst
                      • Size 60KB
                      • SHA256 794c78404a829a7f259fad3950c0af3915d912868d2004f6c59daf5c1fec7065
                      • MD5 SHA1 SHA512 SSDEEP

                      1044.mst

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Packages\Apps\CIM\Win64\1044.mst
                      • Size 56KB
                      • SHA256 92e7257fcc5c4fcc0256db7739cc8e9d148912402f950c57c8ef4d83fd9247bc
                      • MD5 SHA1 SHA512 SSDEEP

                      Setup.exe

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\Setup.exe
                      • Size 550KB
                      • SHA256 58bc0fb5f9e4f11fc25b53ed211ee8dd94107e9ebdc14ac0099238a4dfd9cc4b
                      • MD5 SHA1 SHA512 SSDEEP

                      mfc110u.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\mfc110u.dll
                      • Size 100KB
                      • SHA256 6409762f3906647a4c8b54b6b191b17f4af39ccd158cdf0a45b3b6f1019dd0e5
                      • MD5 SHA1 SHA512 SSDEEP

                      mfc110u.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\mfc110u.dll
                      • Size 139KB
                      • SHA256 aafcb25cfe58ee4637177f0b7ee3639fee92e2f6e7d9251c68250b5da2e582ee
                      • MD5 SHA1 SHA512 SSDEEP

                      msvcp110.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\msvcp110.dll
                      • Size 213KB
                      • SHA256 aa5a5fdf3964b66630b71f372fe5acd427b1c40c0f6d73e24369344f8a52b156
                      • MD5 SHA1 SHA512 SSDEEP

                      msvcr110.dll

                      • Path C:\AMD\AMD-Catalyst-15.7.1-Win10-64bit\msvcr110.dll
                      • Size 29KB
                      • SHA256 2d28192540b85f9a49aaba29b36eeae6fa54838b73b6e352919e3e2ab2f6daca
                      • MD5 SHA1 SHA512 SSDEEP

                      settings.dat

                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      • Size 152B
                      • SHA256 a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
                      • MD5 SHA1 SHA512

                      Preferences

                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                      • Size 5KB
                      • SHA256 361b0ad5123c50a2122f61a495cdf5280fb015e62cf544fffedb13be35d79918
                      • MD5 SHA1 SHA512 SSDEEP

                      Local State

                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                      • Size 3KB
                      • SHA256 3140aa0088b6257d059492731a5b9fe2e1b22c20cb8c735b16dd98565b6443f2
                      • MD5 SHA1 SHA512