Overview

overview

7

Static

static

3

AULA F75 S...1).exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    41s
  • max time network
    47s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23/02/2024, 10:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AULA F75 Setup v2.0 20230923(1).exe
  • Size 3.0MB
  • Sample240223-l2ql5afa85
  • SHA256 53c05f8669aa0bb2fd950650ea845e9410205f5d543fe192c6c3563fc46cc1ce
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AULA F75 Setup v2.0 20230923(1).exe
    "C:\Users\Admin\AppData\Local\Temp\AULA F75 Setup v2.0 20230923(1).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\AppData\Local\Temp\is-AQOB8.tmp\AULA F75 Setup v2.0 20230923(1).tmp
      "C:\Users\Admin\AppData\Local\Temp\is-AQOB8.tmp\AULA F75 Setup v2.0 20230923(1).tmp" /SL5="$700DA,2712295,281088,C:\Users\Admin\AppData\Local\Temp\AULA F75 Setup v2.0 20230923(1).exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:492
      • C:\Program Files (x86)\AULA\F75\OemDrv.exe
        "C:\Program Files (x86)\AULA\F75\OemDrv.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3200
  • C:\Program Files (x86)\AULA\F75\OemDrv.exe
    "C:\Program Files (x86)\AULA\F75\OemDrv.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1324

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Cfg.ini
        • Path C:\Program Files (x86)\AULA\F75\Cfg.ini
        • Size 1KB
        • SHA256 c7bdcc2b4ed7670c8473c12520f0c20fe4ee59135f931e75bd9d71092ee4c794
        • MD5 SHA1 SHA512
        Submit Download

        KB.ini
        • Path C:\Program Files (x86)\AULA\F75\Dev\kb\1\KB.ini
        • Size 5KB
        • SHA256 794751026176e96a0432bb8135cf35ee1fcbe95d856517f760f9dd79e7f4f0c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        KB.ini
        • Path C:\Program Files (x86)\AULA\F75\Dev\kb\wired\KB.ini
        • Size 5KB
        • SHA256 22b1beb8a2635eef87d4925caf115ca484e2afc2a83df338d79ee58b2e7853f4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OemDrv.exe
        • Path C:\Program Files (x86)\AULA\F75\OemDrv.exe
        • Size 2.5MB
        • SHA256 54dc704f9d417a2c5df43b917446228c64ed942d00b2db3cbfa5b90ecac91237
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        appico.ico
        • Path C:\Program Files (x86)\AULA\F75\appico.ico
        • Size 141KB
        • SHA256 b43a53dc95f2564fa6512f99674794fc3b1cd07954d6e0552b08dc505f49218f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bracket_left.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\bracket_left.png
        • Size 2KB
        • SHA256 5e3b18226e17fc720e8db66a34433a66b3d362a0bde7cb92d6ec00625445db35
        • MD5 SHA1 SHA512
        Submit Download

        bracket_right.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\bracket_right.png
        • Size 2KB
        • SHA256 d0e21db4947092913a6184aba4c2f1b2e762ef0718b23f5d91497fd38d1332bb
        • MD5 SHA1 SHA512
        Submit Download

        copy_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\copy_nr.png
        • Size 2KB
        • SHA256 62235019cc93768e6fe3824f36f1ff8cb52509dbfa95f533638a83a8ffa217f0
        • MD5 SHA1 SHA512
        Submit Download

        copy_ov.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\copy_ov.png
        • Size 2KB
        • SHA256 32ba93b200f1761b298fead53c4746a2c11d2115be9d9746763498ac57eeb7c8
        • MD5 SHA1 SHA512
        Submit Download

        del_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\del_nr.png
        • Size 3KB
        • SHA256 415e271d0dfa4511ee42e917ee1a08df56b2c8cfa4d954a06dd611ea35e4d6a9
        • MD5 SHA1 SHA512
        Submit Download

        del_ov.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\del_ov.png
        • Size 3KB
        • SHA256 282985f6b17440706e8098fb1d86a88132aaddd2ddbb63f78b7be56028a9a418
        • MD5 SHA1 SHA512
        Submit Download

        dir_close.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\dir_close.png
        • Size 2KB
        • SHA256 20dc6600daf41e597a4c68615113d26bae42cf54e7a9abc6173f61afcc918812
        • MD5 SHA1 SHA512
        Submit Download

        dir_open.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\dir_open.png
        • Size 2KB
        • SHA256 88d08ca4121d98a2a6264d3802a55bbb8e2a76812b8e4f8d23dc0ec4964f7555
        • MD5 SHA1 SHA512
        Submit Download

        edit_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\edit_nr.png
        • Size 2KB
        • SHA256 5c44d49fb33be475b47414f8845e29f9cc88c6c963e8e685b02f08fc1c7be003
        • MD5 SHA1 SHA512
        Submit Download

        exit_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\exit_nr.png
        • Size 2KB
        • SHA256 0a6c490ac75f40c3d23351845521ff4d4614b347cea8d5b591cb99b33c9840aa
        • MD5 SHA1 SHA512
        Submit Download

        exit_ov.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\exit_ov.png
        • Size 2KB
        • SHA256 3aac676de969011ae40f9ff7da88273aef99d0e4f76c0ac5f81e0013cc9c5eb9
        • MD5 SHA1 SHA512
        Submit Download

        export_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\export_nr.png
        • Size 2KB
        • SHA256 87268064b8dc53a36b52a4f4747c094442e4746582df171b92fbe4bcd5abb26b
        • MD5 SHA1 SHA512
        Submit Download

        export_ov.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\export_ov.png
        • Size 2KB
        • SHA256 a6908ac6ca974ef0842cdd88595676a2163d7fd0070e9d643225f573ef10e290
        • MD5 SHA1 SHA512
        Submit Download

        import_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\import_nr.png
        • Size 2KB
        • SHA256 a2ddea92ffecce474d3cdab259f27f15d2ef6faf9c9a10743544e4a710515c79
        • MD5 SHA1 SHA512
        Submit Download

        import_ov.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\import_ov.png
        • Size 2KB
        • SHA256 feb2017120ca9ba60d198c31ea5a98ffa099a2eb489773af3f1916b9fff3a386
        • MD5 SHA1 SHA512
        Submit Download

        min_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\min_nr.png
        • Size 2KB
        • SHA256 fc07072782f24efd01f584b05a9f11cba840119d1ff40aadf58befbad2d8adc1
        • MD5 SHA1 SHA512
        Submit Download

        min_ov.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\min_ov.png
        • Size 2KB
        • SHA256 4e5580ff509d58f35d5d0b84c0b6f6fcaac7d6ef12c55feaea3ebc8ea6f08a9e
        • MD5 SHA1 SHA512
        Submit Download

        new_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\new_nr.png
        • Size 2KB
        • SHA256 dc407e41619893c1965c95de61627222720ada6f32d619fd0d3c9d86768fa66a
        • MD5 SHA1 SHA512
        Submit Download

        new_ov.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\new_ov.png
        • Size 2KB
        • SHA256 97b1bf78bb214cb820b43f0e99c852c6bbf25793cee7e4cf1bb55408ace274a4
        • MD5 SHA1 SHA512
        Submit Download

        rename_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\rename_nr.png
        • Size 2KB
        • SHA256 3c46c296c283516bd5a9ed6c7057ca04b9384bfce5cc62ccc84c2d191a1b5333
        • MD5 SHA1 SHA512
        Submit Download

        rename_ov.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\rename_ov.png
        • Size 2KB
        • SHA256 32980085c49826ec1b089abca7a2c85ba40b33fcf1bc75014dcba0c6111be388
        • MD5 SHA1 SHA512
        Submit Download

        save_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\save_nr.png
        • Size 386B
        • SHA256 107306efe5338845dcde65f47c0ab7b68d3c0e6b82fb77ef0cb0eba28d3f595c
        • MD5 SHA1 SHA512
        Submit Download

        save_ov.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\save_ov.png
        • Size 351B
        • SHA256 8b456b81101539ede010288efaedd170109485be92c5fa5b422156a1599b63e4
        • MD5 SHA1 SHA512
        Submit Download

        share_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\share_nr.png
        • Size 3KB
        • SHA256 f596a82c21ab2dcb62da6ddd5fa7a17a2375cc0aabaa9c465aa2b6e06bb49f93
        • MD5 SHA1 SHA512
        Submit Download

        main_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\main_nr.png
        • Size 28KB
        • SHA256 d11793fbef0ed675c70109f16fdefca39be54cb323c90ecc956b5d579ac7c8e2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        mak.skn
        • Path C:\Program Files (x86)\AULA\F75\skins\mak.skn
        • Size 520B
        • SHA256 147c687edec5a9a97d566353a77007308238bf8767e7f855e5c3cd46ac02b696
        • MD5 SHA1 SHA512
        Submit Download

        icon_kb_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\other\icon_kb_nr.png
        • Size 601B
        • SHA256 1895de1d82178c3fca5de6413b67ff31c1ff960293943d039d4308fb01c27981
        • MD5 SHA1 SHA512
        Submit Download

        icon_ms_dn.png
        • Path C:\Program Files (x86)\AULA\F75\skins\other\icon_ms_dn.png
        • Size 761B
        • SHA256 4640cbd5cf8897d1e78616c7a1ef587e65bc22f68f30c138d1d7e5900ea9e51d
        • MD5 SHA1 SHA512
        Submit Download

        icon_ms_nr.png
        • Path C:\Program Files (x86)\AULA\F75\skins\other\icon_ms_nr.png
        • Size 552B
        • SHA256 8d88850136dc982ad4de34055a437980b8a8dc85805126de8a1b7a80d4e78554
        • MD5 SHA1 SHA512
        Submit Download

        kbico.png
        • Path C:\Program Files (x86)\AULA\F75\skins\other\kbico.png
        • Size 332B
        • SHA256 4da8f28652b1ae2d3e10df0dbf6271782ce239db6bd4f61f280b1146e5b9a7a1
        • MD5 SHA1 SHA512
        Submit Download

        mac_keydn.png
        • Path C:\Program Files (x86)\AULA\F75\skins\other\mac_keydn.png
        • Size 251B
        • SHA256 7eb7cf847568052d93ea8a693618a9e2a1bfefb82fc5219e0a989af333308af0
        • MD5 SHA1 SHA512
        Submit Download

        mac_keyup.png
        • Path C:\Program Files (x86)\AULA\F75\skins\other\mac_keyup.png
        • Size 258B
        • SHA256 bad3d998aeed2b8eb8d57e5b2e71249011d3058208ed2a9914ddebc3133d2254
        • MD5 SHA1 SHA512
        Submit Download

        macico.png
        • Path C:\Program Files (x86)\AULA\F75\skins\other\macico.png
        • Size 318B
        • SHA256 cbc4fecc558b53d40e28f63e040b27f6a12eed625d6aa8f47fddfd8ce448d655
        • MD5 SHA1 SHA512
        Submit Download

        msico.png
        • Path C:\Program Files (x86)\AULA\F75\skins\other\msico.png
        • Size 466B
        • SHA256 b1beaf9333a398761fc1fbbefc643b5301177d5b31ad15232d647eea550383f7
        • MD5 SHA1 SHA512
        Submit Download

        time.png
        • Path C:\Program Files (x86)\AULA\F75\skins\other\time.png
        • Size 331B
        • SHA256 5aa3df6debcb777e25969e410ca2ec5544f05febd13c8c2f0aad3362fe051964
        • MD5 SHA1 SHA512
        Submit Download

        user.png
        • Path C:\Program Files (x86)\AULA\F75\skins\user.png
        • Size 3KB
        • SHA256 b59eb21419b7f1cefea9361d649f0a692e6c122213b228022baa62d56465e84e
        • MD5 SHA1 SHA512
        Submit Download

        welcome.png
        • Path C:\Program Files (x86)\AULA\F75\skins\welcome.png
        • Size 411KB
        • SHA256 d052e86b982c2a0a356317d11bbb643fd124e15fd4889af7ce44d37491b8fca0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        text.xml
        • Path C:\Program Files (x86)\AULA\F75\text\en\text.xml
        • Size 23KB
        • SHA256 82fc5bf5f51765ba375efe654fa5493bccab80894a575e0d4556348fa4a56618
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        gSetting.dct
        • Path C:\Users\Admin\AppData\Local\BYCOMBO4\gSetting.dct
        • Size 84B
        • SHA256 fb4110a7fd96324616cd137ef6eec8aba4731a0e41aedd35f3f0e7c6d37a564d
        • MD5 SHA1 SHA512
        Submit Download

        lang.ini
        • Path C:\Users\Admin\AppData\Local\BYCOMBO4\lang.ini
        • Size 20B
        • SHA256 2c5451afc3ee4f44c5dbf63d07377485ecfa52a024ac869f0ee113c9c1cf59f0
        • MD5 SHA1 SHA512
        Submit Download

        InitSetup.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-5DM2V.tmp\InitSetup.dll
        • Size 55KB
        • SHA256 72f5cfe575253eaff31e27ce8f70b4caaa079d2c42a4130515eecf7f0967115d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AULA F75 Setup v2.0 20230923(1).tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-AQOB8.tmp\AULA F75 Setup v2.0 20230923(1).tmp
        • Size 1.2MB
        • SHA256 02eec62b7139a7cfc747d5f897ccedcf76ea154ec63ede231436a0f89e317387
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/492-345-0x0000000000400000-0x0000000000558000-memory.dmp
        Download

        memory/492-6-0x0000000002410000-0x0000000002411000-memory.dmp
        Download

        memory/492-13-0x0000000000400000-0x0000000000558000-memory.dmp
        Download

        memory/2216-346-0x0000000000400000-0x0000000000451000-memory.dmp
        Download

        memory/2216-12-0x0000000000400000-0x0000000000451000-memory.dmp
        Download

        memory/2216-0-0x0000000000400000-0x0000000000451000-memory.dmp
        Download