Analysis

  • max time kernel
    128s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22/02/2024, 17:46

General

  • Target

    Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x863.exe

  • Size

    6.3MB

  • MD5

    253773272d79cb515424e78547423948

  • SHA1

    6ec62445733107785ff6f4cac25bc3fee9e7bcd1

  • SHA256

    fd8f23c2ed640f7a4b18e55b10ef415febd83cbb8d58338ab71bee693f7e8d84

  • SHA512

    b1c93b1f7c6641f74279a746d3db2d9a6c25786ead56574fd42046c1f4134fddd84b55455158468a31a167d6a9ce07431ef4d6b07af2ac097e6ed9335594e58a

  • SSDEEP

    196608:ArKjLs+UIkzHlAv4X6zQRgiwHLD2LQIXG:UKjaxFFP1iLD2LnW

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x863.exe
    "C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x863.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x863.exe
      "C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x863.exe" -burn.unelevated BurnPipe.{0F94A828-BB17-45DF-B61E-3849811214BB} {84CB7078-A420-41F0-BC55-8F105E0CF7EB} 4860
      2⤵
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      PID:3392
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5104
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2816

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\.ba1\logo.png

          Filesize

          1KB

          MD5

          d6bd210f227442b3362493d046cea233

          SHA1

          ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

          SHA256

          335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

          SHA512

          464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

        • C:\Users\Admin\AppData\Local\Temp\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\.ba1\wixstdba.dll

          Filesize

          126KB

          MD5

          d7bf29763354eda154aad637017b5483

          SHA1

          dfa7d296bfeecde738ef4708aaabfebec6bc1e48

          SHA256

          7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93

          SHA512

          1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c

        • C:\Users\Admin\AppData\Local\Temp\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\.be\vcredist_x86.exe

          Filesize

          447KB

          MD5

          365aa5472c3470a4d4ab6b27de058ab4

          SHA1

          e3df8255bdd934f797a947e231a804671270619d

          SHA256

          a246bf7ff8f4fcae4131415df2e35ae960cb6bfd7ff047c07dabcd3811974c88

          SHA512

          c42e763982bc5dbdd5f8813e1c24d2f97d067978a22341f7c4c9cbf36e09432c9905e2bc74e8829f838340cca5a7ee5b36a9729b85f222b63b2f57389a785cc4