Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 20:10
General
-
Target
db-installer.exe
-
Size
28.2MB
-
MD5
e1fa0ae17ca2f4183ab9aa879ae26386
-
SHA1
efe091723398992b8e9ddc39774c5ef163fd7229
-
SHA256
3bcbd9e46f36f8d30f31000aae8a5b397622bc11e178b631f9e0ae521e53329e
-
SHA512
630b8ad741bc67df681525bd9fa9efa9ccc8ba23277c9bccf065eb572c808bffd76c7140074b55ce34a25733e2be9950de3bdef9d582f47bce2242fe68040369
-
SSDEEP
786432:DMN9xVlm8epz1/QD1CcSfdodCPOp8qBbPhv:meH+1Clgrzphv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db-installer.exe"C:\Users\Admin\AppData\Local\Temp\db-installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-51EV9.tmp\db-installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-51EV9.tmp\db-installer.tmp" /SL5="$501D4,28855075,139264,C:\Users\Admin\AppData\Local\Temp\db-installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-Q80K1.tmp-dbinst\setup.exe"C:\Users\Admin\AppData\Local\Temp\is-Q80K1.tmp-dbinst\setup.exe" "C:\Users\Admin\AppData\Local\Temp\db-installer.exe" /title="Driver Booster 9" /dbver=9.2.0.196 /eula="C:\Users\Admin\AppData\Local\Temp\is-Q80K1.tmp-dbinst\EULA.rtf" /showlearnmore /noemailpage /nochromepmt3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5b5df6251f4efc8d769f30bda8898d7d4
SHA119ec86318bd3641b66bc86c0489f686280fbc9ca
SHA256647fa0cfc53ed76dfa6b87f89d46e06efc54c3c78ca4f34755e833d3df080c5c
SHA51256e2a4a7f96b1d414bd6ed2e0372714bbe7f47ee51f4cb36504160fb0e1c8bf21070ed5fc056fc60c1bbc0b0dfbcbf3798b3ce2cd7d7aa067ac6f6dc7ad63c5c
-
Filesize
1.2MB
MD568b52a0b8e3d45bf3b520a0e7f16dad1
SHA1e50408326eafb5ca8adc70db29c33b64e25bbbbd
SHA256b409d6d6f8896dc2afd1774479c741ca253c0e9b4732daaa08af84aa9c96888b
SHA512b8e0b486e2b9652831eb8efe48cf9575eef49204e827a64d69ae7c9c30304b2d98a66c28f1072fe8596847c15f13bbf7ec39d7708684ff64051bbae7ed063faf
-
Filesize
5.8MB
MD5c8cc229868090b93b5684180160aa4c4
SHA18cd93dd7b0254151b46f8137df2fd52752e58557
SHA256358c53f7f4a85af8a04067e72a1d03ad1066a6e05e1b0dda36db206a3f1fb86c
SHA5122e0688ddfa17a0cd6b42ec3944d9e03d3d62b34e1f85e898fb8461c3b51df4542fae78a6411c7fab45a895ca7dc1994f8893ff4452ca12cc8cefb04ee13d258b
-
Filesize
608KB
MD5da3716b6007ee7486c2a43a309de04dd
SHA1af29a82fa0eb54669b5e5e8dea0754fe43135482
SHA2563b757a882bf91a1e65462be9bb3dff5ae7862f7ba15c009e3a7cae8e073ccff5
SHA51258fe6cf7a860e8fd76ee681771e0bdf8beeee5d7a4f7fd6a2ffb5601acf8325c61974ab37906dd24cbc152de17d31da67dbb42626d0d6659eb22e357b9a6e0e7
-
Filesize
896KB
MD58f7c96a3c7b1661e0506a514b6295bb1
SHA1892786c922bfba97efe0a39580fcd911ff7193d1
SHA2568f7b1f78e8ba84d7d61af35a34bf31bd75e584f60d40b63d8ee77797a6d8686d
SHA512bb66ebacdc9e049963814578bd9ab51b093d2b00e051c48e69392dab40e303b25e0a04629d2088180cb2795f1d1248fde97859e8eb0b8c161e67a1262dfc4e3b
-
Filesize
28KB
MD5b0381f0ba7ead83ea3bd882c1de4cd48
SHA1c740f811623061595d76fce2ebb4e69d34316f3b
SHA25644bc9472169403484a0d384f1ca81989ef7e4b07441758e8a0110078933cbcb5
SHA5126cfb8bc562d22843d043411720db97d0b4cbac96a20983d83d19e59b8428ec202f2532cc5af254438dc34fca4161abbd3f6bac8d397590e41b6d41e60700e78a
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8.2MB
-
Filesize
4KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
4KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
4KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB