Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:18
Static task
static1
Behavioral task
behavioral1
Sample
74f3b871d85aaa247e93290b2bbbe7e0.exe
Resource
win7-20231215-en
General
-
Target
74f3b871d85aaa247e93290b2bbbe7e0.exe
-
Size
4.7MB
-
MD5
74f3b871d85aaa247e93290b2bbbe7e0
-
SHA1
4532523ce208a7b61f2707ef9020f27aabdd1d10
-
SHA256
5afa3995ab10db02e4ae53eace0287b98302111a76fd5dd2184f3e96ce047ef9
-
SHA512
42033f59c9baa72994e2b8fbd082dd693a1d546d52e09ec3b65f017c88f840772b40ee8e70222efed4c5f85f95d8e3926a06dafe9612e4325ba86b7970f2c843
-
SSDEEP
98304:PX4UgeItnJ43UEQdF9YHWYt33w234Ey8tmxiRGuc+yazx14:vOeItnEbQdFsWYC234EDtmYRL/ya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
74f3b871d85aaa247e93290b2bbbe7e0.tmpPariatur.exepid process 2656 74f3b871d85aaa247e93290b2bbbe7e0.tmp 1700 Pariatur.exe -
Loads dropped DLL 1 IoCs
Processes:
74f3b871d85aaa247e93290b2bbbe7e0.tmppid process 2656 74f3b871d85aaa247e93290b2bbbe7e0.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 22 IoCs
Processes:
74f3b871d85aaa247e93290b2bbbe7e0.tmpdescription ioc process File created C:\Program Files (x86)\Aut\eum\is-3GDS1.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\eum\is-5O0EJ.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File opened for modification C:\Program Files (x86)\Aut\unins000.dat 74f3b871d85aaa247e93290b2bbbe7e0.tmp File opened for modification C:\Program Files (x86)\Aut\Pariatur.exe 74f3b871d85aaa247e93290b2bbbe7e0.tmp File opened for modification C:\Program Files (x86)\Aut\sqlite3.dll 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\is-LNPVS.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\eum\is-TVNU5.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\voluptate\is-QSO82.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\unins000.dat 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\is-SL3TB.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\is-0T11E.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\eum\is-87TTN.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\is-RT7EJ.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\eum\is-AGHER.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\is-84RBL.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\voluptate\is-94HA0.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\voluptate\is-4RT8V.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\is-5P4P4.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\eum\is-I3OIO.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\eum\is-OM07E.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\eum\is-03S4H.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp File created C:\Program Files (x86)\Aut\voluptate\is-992OM.tmp 74f3b871d85aaa247e93290b2bbbe7e0.tmp -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
74f3b871d85aaa247e93290b2bbbe7e0.tmpPariatur.exepid process 2656 74f3b871d85aaa247e93290b2bbbe7e0.tmp 2656 74f3b871d85aaa247e93290b2bbbe7e0.tmp 1700 Pariatur.exe 1700 Pariatur.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
74f3b871d85aaa247e93290b2bbbe7e0.tmppid process 2656 74f3b871d85aaa247e93290b2bbbe7e0.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
74f3b871d85aaa247e93290b2bbbe7e0.exe74f3b871d85aaa247e93290b2bbbe7e0.tmpdescription pid process target process PID 4896 wrote to memory of 2656 4896 74f3b871d85aaa247e93290b2bbbe7e0.exe 74f3b871d85aaa247e93290b2bbbe7e0.tmp PID 4896 wrote to memory of 2656 4896 74f3b871d85aaa247e93290b2bbbe7e0.exe 74f3b871d85aaa247e93290b2bbbe7e0.tmp PID 4896 wrote to memory of 2656 4896 74f3b871d85aaa247e93290b2bbbe7e0.exe 74f3b871d85aaa247e93290b2bbbe7e0.tmp PID 2656 wrote to memory of 1700 2656 74f3b871d85aaa247e93290b2bbbe7e0.tmp Pariatur.exe PID 2656 wrote to memory of 1700 2656 74f3b871d85aaa247e93290b2bbbe7e0.tmp Pariatur.exe PID 2656 wrote to memory of 1700 2656 74f3b871d85aaa247e93290b2bbbe7e0.tmp Pariatur.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f3b871d85aaa247e93290b2bbbe7e0.exe"C:\Users\Admin\AppData\Local\Temp\74f3b871d85aaa247e93290b2bbbe7e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\is-LSVGQ.tmp\74f3b871d85aaa247e93290b2bbbe7e0.tmp"C:\Users\Admin\AppData\Local\Temp\is-LSVGQ.tmp\74f3b871d85aaa247e93290b2bbbe7e0.tmp" /SL5="$501D2,4273426,721408,C:\Users\Admin\AppData\Local\Temp\74f3b871d85aaa247e93290b2bbbe7e0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Program Files (x86)\Aut\Pariatur.exe"C:\Program Files (x86)\Aut/\Pariatur.exe" 3cdc3fe5f039df159d471f9bdb28e9143⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Aut\Pariatur.exeFilesize
4.0MB
MD59afdb0a2479b187c420219cffc77668f
SHA1e3e7f8a5e3f9e9e29006be7ae85823235dc3a5c1
SHA256a8486839490bdbc6038ba71231723779deac0fd6dfbed61b6ed2b86036c12a1b
SHA51289a85ecabefa48116d118d3c61b79f34a4d1522ee575408c1f3a419cf39b2de1f3f22fedcdda4801ed42ee1a9c74f62ac77742e127e2dfc5a8266401cefe1d1d
-
C:\Users\Admin\AppData\Local\Temp\is-LSVGQ.tmp\74f3b871d85aaa247e93290b2bbbe7e0.tmpFilesize
2.4MB
MD53fddfbaa9d029821152e746edbabf7ce
SHA1703690b3a2377047f6755e9b5274d608791b8062
SHA256787cef456bd60075199c04ac38dd5e65291bd3a930b132538889e4dafb76fa1a
SHA512fd50e763c6523022f1be02a6a690d2a2dec4e9a73c941314b4a810bbd7605d4058c5c49c53dcbdd8fde5e6c4d2c78fcec52b5bca087cbf552bc1ce90819c4903
-
C:\Users\Admin\AppData\Local\Temp\is-U1HCM.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
memory/1700-51-0x0000000000400000-0x0000000001617000-memory.dmpFilesize
18.1MB
-
memory/1700-50-0x0000000000400000-0x0000000001617000-memory.dmpFilesize
18.1MB
-
memory/1700-52-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/1700-55-0x0000000000400000-0x0000000001617000-memory.dmpFilesize
18.1MB
-
memory/1700-74-0x0000000000400000-0x0000000001617000-memory.dmpFilesize
18.1MB
-
memory/2656-5-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/2656-54-0x0000000000400000-0x0000000000679000-memory.dmpFilesize
2.5MB
-
memory/2656-59-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/4896-0-0x0000000000400000-0x00000000004BE000-memory.dmpFilesize
760KB
-
memory/4896-53-0x0000000000400000-0x00000000004BE000-memory.dmpFilesize
760KB