ea1d62aa5b05ad3d21473bb9fbd20f0671b3078627f2e2cce8b1d9ade7ca5c31

General

Target
SketchUp Pro 2018v18.0.16975/SketchUpPro-en.exe
Size 163.3MB
Sample240302-vct3pafb2v
SHA256 0211f2a8c1ec6ef8ef2b66e4bf33fea95be0c04c2b00eac4cb4abd3da95ec92e
MD5 d6552e4a822151794e464dd25eaa1348
SHA1 af2f362026f0afc19b6719adb39377a825820e04
SHA512 528df1871dfb111ec5456000cab6c801eda0afa47360d23bda47500d6d46c5efd423cca9dd6bcf47cbed5d7af5b0b3a82b93089cb56dedb080a202e76b6a15b6
SSDEEP 3145728:vA1V246ECxvPzoGF6A8cKBOxu3jZKhnrwDFVk1jcXyKZ+tjY:KVHSPzoGF6d8sNqnAvJsts
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2600	presetup.exe
2456	setup.exe

Loads dropped DLL 2 IoCs

pid	Process
1336	SketchUpPro-en.exe
2600	presetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2456	setup.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2600	1336	SketchUpPro-en.exe	28
PID 1336 wrote to memory of 2600	1336	SketchUpPro-en.exe	28
PID 1336 wrote to memory of 2600	1336	SketchUpPro-en.exe	28
PID 1336 wrote to memory of 2600	1336	SketchUpPro-en.exe	28
PID 1336 wrote to memory of 2600	1336	SketchUpPro-en.exe	28
PID 1336 wrote to memory of 2600	1336	SketchUpPro-en.exe	28
PID 1336 wrote to memory of 2600	1336	SketchUpPro-en.exe	28
PID 2600 wrote to memory of 2456	2600	presetup.exe	29
PID 2600 wrote to memory of 2456	2600	presetup.exe	29
PID 2600 wrote to memory of 2456	2600	presetup.exe	29
PID 2600 wrote to memory of 2456	2600	presetup.exe	29
PID 2600 wrote to memory of 2456	2600	presetup.exe	29
PID 2600 wrote to memory of 2456	2600	presetup.exe	29
PID 2600 wrote to memory of 2456	2600	presetup.exe	29

C:\Users\Admin\AppData\Local\Temp\SketchUp Pro 2018v18.0.16975\SketchUpPro-en.exe
"C:\Users\Admin\AppData\Local\Temp\SketchUp Pro 2018v18.0.16975\SketchUpPro-en.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\7zS2720.tmp\presetup.exe
  .\presetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Users\Admin\AppData\Local\Temp\sketchup_install\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7zS2720.tmp\..\sketchup_install\setup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SketchUp2018-x64.msi

Path C:\Users\Admin\AppData\Local\Temp\7zS2720.tmp\SketchUp2018-x64.msi
Size 110.9MB
SHA256 a12d69757a027112d1741123e362a340c3020a73d0c76532a575a61997021f6b
MD5 435dd0a3a94cdfae9a6ad6c55565beb3
SHA1 5d4f3f916bb5bdefce1b4bf0d2711cda2ad4b75b
SHA512 c7a14115bf71783076fe10c8183c0934c8d8b06d65f9549daa90795f48ebe09586fc864bbd2245ea3e0dcd86b53651980cd91b52b35d1d8e0f397ca89608dc5b
SSDEEP 3145728:6AJA150/FkfAUwk3IOnkh1vxTTQFRcovfHHYyBK+ws+d:3J80t0AM3FkhVxTTQFKovfH4Bs+d
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallPrerequisites.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS2720.tmp\SketchUpPrerequisites\InstallPrerequisites.exe
Size 100KB
SHA256 43a028c7ae3cbbd3c41f36586477bcc44f1523d571810bf6da5340bf2ed26e71
MD5 ddcef619412a49ca748d3c2cf30f7287
SHA1 c511ecf5f983e0a6153d379687dcc0d6e0dbc77f
SHA512 cc40b1065a97a63163955986d5a883b9637b0e92ca394b0119d12f343621f3e3eb450e55f48eee585a9cffb8a25f64f80ca76c942b31ca67cd420550c77ed512
SSDEEP 3072:Txxh/EVBkJ2NNEZkdNVtzFytrmK23hWZQ/sMzr:5cVBkWrLzDhWZQ/sQr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows6.1-KB2999226-x64.msu

Path C:\Users\Admin\AppData\Local\Temp\7zS2720.tmp\SketchUpPrerequisites\Windows6.1-KB2999226-x64.msu
Size 1010KB
SHA256 43234d2986ca9b0de75d5183977964d161a8395c3396279ddfc9b20698e5bc34
MD5 ad7f5c851f6387e424ab206effb21354
SHA1 54050a5f8ae7f0c56e553f0090146c17a1d2bf8d
SHA512 3ab0a5eb48c7e5aec55640171acec4e3449dd5e5e90345a39c214be16858d5e66892b01fb4a792405c9fcef9a6286c85e5411c79d38d49930d9edfa40e535093
SSDEEP 24576:azFaglzo0gI3XAXjlxJLj9xj4c6LuWTGZFF+wQ1:0aEgXRHLjX6lIfc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows8-RT-KB2999226-x64.msu

Path C:\Users\Admin\AppData\Local\Temp\7zS2720.tmp\SketchUpPrerequisites\Windows8-RT-KB2999226-x64.msu
Size 1.3MB
SHA256 50cae25da33fa950222d1a803e42567291eb7feb087fa119b1c97fe9d41cd9f8
MD5 c511bb7f1b2c0e20860a7e653035a43c
SHA1 b5943b2700b56f5f8dc307a9e237f23fca5d8b70
SHA512 832188ee8a9f98ab349e0dc078a91f995774470bfb5b33fa2b782bd02a1cc14f91a7546f889192cf0b0270521c22791581b17ae973569c69b81a0ac481089ec6
SSDEEP 24576:sJSYow+cXAUm1w0jk7Ny2xXnnuzTDWm3Vo6la9840NrJZQXAWPC:bNw+cFmXjkgWcum39l940Nd6X+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows8.1-KB2999226-x64.msu

Path C:\Users\Admin\AppData\Local\Temp\7zS2720.tmp\SketchUpPrerequisites\Windows8.1-KB2999226-x64.msu
Size 981KB
SHA256 9f707096c7d279ed4bc2a40ba695efac69c20406e0ca97e2b3e08443c6381d15
MD5 d0728878f9c6799046b43aeece4f3aca
SHA1 3acbf3890fc9c8a6f3d2155ecf106028e5f55164
SHA512 e5cecaca86779a281bf5c396d7fa3a5f322bc6423e2250d617a6fab229e86d2c9d3b784c1fa3fa2be5513fcd3ba87695b3934d13802ee15cabae62f84c2c3668
SSDEEP 24576:qUOyllz4g/IJm9JJPQMlzGYetBuhTapcpDZH4U:52kImztfUCQiZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS2720.tmp\setup.exe
Size 703KB
SHA256 414e68f7ae512aab8ee1617431a2289925b45fcec50472132025e8ed59dd6d7b
MD5 73263776233b7ce4dbb4456fd4e49313
SHA1 28af1066e201948a7c4bffb59e0ee70aa41ff44a
SHA512 65e10976cff19b9ada5654821014a371d5aeb19f71acf8ddd275167259c84925c17780655c14dafded8bea88ae50cf268110d4f13ae520f9b9ccea27278c77d1
SSDEEP 6144:wqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD3zGM3eO:w7IRWDvFa+nhmuF3Y0sc3O
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS2720.tmp\vcredist_x64\vcredist_x64.exe
Size 14.6MB
SHA256 da66717784c192f1004e856bbcf7b3e13b7bf3ea45932c48e4c9b9a50ca80965
MD5 45b47f4214ddc9f4782363a38504c9d2
SHA1 10b1683ea3ff5f36f225769244bf7e7813d54ad0
SHA512 c87955c5542e39fbb44c6edf9ea0c6671693e7cd93b2bbb3988bd51c4e0bfc4c46fbd968ba9bc6327b21f2e52dd1dfe8d0d077aa27a8619bcf61edc3f58b246a
SSDEEP 393216:nfyklp+dkBSuF2SfUfn6tX5MTwhGW+N7MbIT1uGYvPsW:nnp+Ty2SfUfn2F+N7MbIB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

presetup.exe

Path \Users\Admin\AppData\Local\Temp\7zS2720.tmp\presetup.exe
Size 205KB
SHA256 aa21f24d6f317222969007cd4ee2f509f3792e4bfb75070327531f3a8d426069
MD5 300bda82d3e21000c9d9fdd884ce1527
SHA1 b5cd6abd32a1fb6bd30346d950ba51c766cc7052
SHA512 62e192293a8f75e01ece11342141a1ef44d5051121ae9bc5e4597e8b6badc895c3d4844e6b92625cc6d6b915025ec990ad4e348407faa17cbcf2958fbe938b7c
SSDEEP 3072:8i/X1+O8YTE8ripKn2eVT2Q2ye+3KuUEugHb1ytGuLuAg0FubAmHtkvHgnz:881+qV2wF2y3KCAOnNkon
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads