Analysis

  • max time kernel
    92s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2024, 21:46

General

  • Target

    MainInstallerAutoEmbedded.exe

  • Size

    796KB

  • MD5

    7fc6bc14a74dc69773587af10132d8c9

  • SHA1

    9d98b268eaa7f4ad208bde39944fdb1ab201e076

  • SHA256

    e288d49f6011dcd3f893e54ceafda9b6b491543966521c483064a7df43e5bdd2

  • SHA512

    a738205fb26bf259e70b1cacfd10f9168d381778ef90a49847b8d332d93b471cbdcf6357a3d2dfb2e41a4666cba98dd9dc2867a20d472636e5fc8080cc073742

  • SSDEEP

    24576:P7yrmq17YLUAl1+O50aT+1bXkS/EZQM7G7ZQ51bmtfWR163i95cVmB:jgbyLV1ILT/ES46S5Bmted6VmB

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe
    "C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe
      C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe /PID=0 /NOTIFY=0 /FFR=1 /FFP=0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1600

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe

          Filesize

          512KB

          MD5

          ff0198fd1f59b71c1deec34b6b0b0c07

          SHA1

          cae622ad91a3bab0996589e3bf905c9d4eeb6059

          SHA256

          f552d818f17841efb7f06803ecd2479fe5c9b2a0d3c4dad2c9d90b42e2e9d7d5

          SHA512

          96795276eefcde81b0ad4ac85f4aaec368cb93bd9e9912c343316912f1502f3a22d845af3ba75ea5aa92b1936028558d48c11a77d331d49bd77f58b886868ccc

        • C:\Users\Admin\AppData\Local\Temp\nsp5370.tmp\InstallOptions.dll

          Filesize

          14KB

          MD5

          325b008aec81e5aaa57096f05d4212b5

          SHA1

          27a2d89747a20305b6518438eff5b9f57f7df5c3

          SHA256

          c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

          SHA512

          18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

        • C:\Users\Admin\AppData\Local\Temp\nsp5370.tmp\ioSpecial.ini

          Filesize

          694B

          MD5

          587e5ce1a836385713d6fd9643fe5cfa

          SHA1

          2511916c8758a27a0dac328f86106759ac98f3d6

          SHA256

          b2a307e15118a59a1f3a98fd53d3a9b2eebab4fff1a635d557af204dfe06d1a6

          SHA512

          92f295cccc29f5ea2b8fdf60b4b3c0eaab3c7aa137396873904e74317f9aa15e542afdefa70d14d861db757db17d1af4236ab9dd555735674af1fe8906838726

        • C:\Users\Admin\AppData\Local\Temp\nsz5312.tmp\System.dll

          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f