47dc665c232cc9c20b0ac42d336832c3d6ef9e8f2790bb0b8c2b4534a2966315

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bcd99daa92f75283885ad5e54d600623.exe
Size 938KB
Sample240309-1b7v2sba56
SHA256 47dc665c232cc9c20b0ac42d336832c3d6ef9e8f2790bb0b8c2b4534a2966315
MD5 bcd99daa92f75283885ad5e54d600623
SHA1 73566376ebd79e45b1893ede197923432818a8ce
SHA512 e37f8eea1534856f7ecade7203c181a334ac9da5a8c766d3d69ee17a450c128ab09d1823aca8eb0ba9cadde4e3245fe368fb235d20ea950bc25bbe17e97673c0
SSDEEP 24576:mDdU+YdDUtBDVYPVsLzs0Iy6vAf2dKm7A91kyDj8NF:0dBtBDaCHAS2d8nAF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3200	_INS5176._MP

Loads dropped DLL 5 IoCs

pid	Process
3200	_INS5176._MP
3200	_INS5176._MP
3200	_INS5176._MP
3200	_INS5176._MP
3200	_INS5176._MP

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\_iserr31.ini	setup.exe
File created	C:\Windows\_isenv31.ini	setup.exe
File opened for modification	C:\Windows\_delis32.ini	setup.exe
File created	C:\Windows\_INS33IS._MP	_ISDEL.EXE
File opened for modification	C:\Windows\IsUninst.exe	_INS5176._MP

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	setup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3200	_INS5176._MP

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 840	2500	bcd99daa92f75283885ad5e54d600623.exe	91
PID 2500 wrote to memory of 840	2500	bcd99daa92f75283885ad5e54d600623.exe	91
PID 2500 wrote to memory of 840	2500	bcd99daa92f75283885ad5e54d600623.exe	91
PID 840 wrote to memory of 3200	840	setup.exe	93
PID 840 wrote to memory of 3200	840	setup.exe	93
PID 840 wrote to memory of 3200	840	setup.exe	93
PID 840 wrote to memory of 432	840	setup.exe	94
PID 840 wrote to memory of 432	840	setup.exe	94
PID 840 wrote to memory of 432	840	setup.exe	94

C:\Users\Admin\AppData\Local\Temp\bcd99daa92f75283885ad5e54d600623.exe
"C:\Users\Admin\AppData\Local\Temp\bcd99daa92f75283885ad5e54d600623.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\InstallShield\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\SETUP.EXE" -isw64"C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\SETUP.EXE" /SMS
  2⤵
  - Drops file in Windows directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Users\Admin\AppData\Local\Temp\_ISTMP1.DIR\_INS5176._MP
    C:\Users\Admin\AppData\Local\Temp\_ISTMP1.DIR\_INS5176._MP
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3200
- - C:\Windows\SysWOW64\InstallShield\_ISDEL.EXE
    C:\Windows\SysWOW64\InstallShield\_ISDEL.EXE
    3⤵
    - Drops file in Windows directory
    PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZDATAI51.DLL

Path C:\Users\Admin\AppData\Local\Temp\_ISTMP1.DIR\ZDATAI51.DLL
Size 52KB
SHA256 12ff2d1288a0684fe8162ba8a76662288b7e3be9e77725de93d05525a43a1986
MD5 805006328d0da72df964909bba8166ac
SHA1 79814934c81d044b1bbfdc44f689fc68038aaa26
SHA512 8fdb2a45442ef0a2f1cca6b50485391d744b061f58faf43391aaec60811abfd45922b5368ec68ec1dce125e3ac2f71f0bc0077def13622479c92983183dc6765
SSDEEP 768:KXLM/802eEtx83lyZ/3ClWYefVwVEjywhSvlxipX7wpuR0QD2QG+kYqTr8g1w:KXWZFfkZalDef6XJUX7lR1GDhIg1
MD5 SHA1 SHA512 SSDEEP

Submit Download

_INS0432.INI

Path C:\Users\Admin\AppData\Local\Temp\_ISTMP1.DIR\_INS0432.INI
Size 183B
SHA256 3e28a1e882fbad138c140053ca3683fd5b87303acd922ef6cbccd0d299f8fb11
MD5 19580d130892388f491ddf4f9227ca22
SHA1 e654fd5ac33ac2c9aca1d4e95247ffdb6d1a88e8
SHA512 125789afe7ef838ff39e4c5cb8c517f5bd9a63549ed9abd4e04456a41bc6c7b41b462c8fbd0bd5b5a1d3305edb53659395322e9c47f3bad67de56fe6087d02b7
MD5 SHA1 SHA512

Submit Download

_INS5176._MP

Path C:\Users\Admin\AppData\Local\Temp\_ISTMP1.DIR\_INS5176._MP
Size 581KB
SHA256 82ca5fd2d52ddbef610dccb4641fab4e84f8e55d81f1d92ec34a41b54beb0664
MD5 fc70a99b13f272737b003d0b6846a189
SHA1 513d2471b9960828b8890b637bc333e9b1d7187d
SHA512 d0366dd73a0056a4f53b35ce6784cb4735b51794a4acba9999c2c9cba83dd6c8aba3a19e39cb690f5e41045f139ac1f73c910addd1f539d0b62f9129ac30a9d0
SSDEEP 6144:dnc6nT/pEK7N0CD1JjqDBtcQoxPLksbCHU+O9GwH2OCcyvGpFyBJ+C:pnT/VJeDBtcJPLkglcwH2OCjupFq+C
MD5 SHA1 SHA512 SSDEEP

Submit Download

IsUninst.Exe

Path C:\Users\Admin\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.Exe
Size 296KB
SHA256 9ad358395fe14631c451e67b9f03a213458b84c7a411ed8dcc0bd58d2fb9c58b
MD5 c0dffad445b264da258f9794633d6455
SHA1 58b480dce3283c115eea4756c3864da968ff06a8
SHA512 8821a2e18559d1f6e4dd2de6288f48a456747ecc4ed71e5c49795a3da58cc021316c0b07d5a3a508e341c1921de7a1bb90fdb879bc4d55f16ffb0786540d700d
SSDEEP 6144:ZM/oLMXLhDh8Wf9yaUQbJRTItbsdVedDC:6gcDSWfIfqPcxsdEZC
MD5 SHA1 SHA512 SSDEEP

Submit Download

e575d33.DLL

Path C:\Users\Admin\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\e575d33.DLL
Size 126KB
SHA256 b6a5e5d3e991d5e5f6ede9eca927fde2e582b88d973e1974171f132abbdec6b5
MD5 4dbf53786ecdd42cde6a88115b36e0f6
SHA1 dc2fda1c89d2b90f9e528e36f7e6965d946e2b1c
SHA512 591cd570912b1a6d1f779ba495807b50adc9c1432e39554bcebab78d71a418d15d8e12c0203b1f84e02de51ad63a2d3e9cdb7c85ba9d124c6642d5e338d992b6
SSDEEP 768:AQsY4skkkkkngWKJGabSogSXhEczeFMnEHVptICdJHxOs+Gg+WUw7:8Y4skkkkkngt3lhZeFMnI7tfWTT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_WUTL951.DLL

Path C:\Users\Admin\AppData\Local\Temp\_ISTMP1.DIR\_WUTL951.DLL
Size 45KB
SHA256 3ad102d309953433faef7357cab408c8e64995f8111f57a59b9f6e5b7e8d4a92
MD5 847d78a673e9b8313c651d037180f3b4
SHA1 e500d6bdd57e08295aa7594139db467dbd6045a3
SHA512 11c42cfe422bbc8c9b1cb89d12f047404253125fdc30d726b2f8c3988865deb284fa31c821bab99b3a423180922ad0feb6126df4928e426a7d2271f0cea01b45
SSDEEP 768:lAWMToliRQMcg93ssCvGfZvUthsssvAg9vY:NMTo0RQO93ssCvmvMg
MD5 SHA1 SHA512 SSDEEP

Submit Download

LAYOUT.BIN

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\LAYOUT.BIN
Size 372B
SHA256 397681cde547bb1a558df5b3be55156c084b917872ee71090730ff26801c1d9e
MD5 03dcc48deceb5d8d4ab3a8a21a1771d2
SHA1 ba62233b0207d8c7845d4dc3d36f4a70f980c87e
SHA512 dac4eef8d0bfd070516f3e8a6fc22907d27cf8ebe0c619e8d551dfc10da3bd2c617cf28b0e7ebf37df1b95c665bf69d67409769220b6d51d4dea53388c349b04
MD5 SHA1 SHA512

Submit Download

SETUP.EXE

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\SETUP.EXE
Size 58KB
SHA256 83441525fb5aebe10892cfbc931395e2bb1f68c8720e49bb58749cb95981f06d
MD5 2e7bc5b75df9c7bc2a53a32964c2d899
SHA1 24d08d262007a254e0797a128e0399aa47b13e6c
SHA512 41bd7911b436fd907394ad3094a8162cbc9d9f3102daf58ef9dd628571956a49929638e0b4141c00f06d90c48711877ea2fc10736b789299b7a85e918db1db03
SSDEEP 768:d8s/igVfqfbqg6tNrpaE7bP+Fbsk4WoPygjhZB/qf0F4r:CgViDqgMdpa47+zv4hZB/qsFq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP.INS

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\SETUP.INS
Size 56KB
SHA256 e388329ff9ab108557db302c95a51cb07f5d1d1c7dbc74e786464ea2f5743534
MD5 df813e6c53a815ca2296b2c7054cf288
SHA1 5991ed9f3ed6fd1e413ef32626cb240323d84735
SHA512 5ba21ca10cdc7e21f8c589368fee90c62827c86ba52c6f09eebdf9cb2a0e5a322c300c78c163921b75ab08cf6ef63047f17477329c27c04446d301fc357a0c29
SSDEEP 768:KkVZ81D2XEaj1Z7DYv8Iophq3TsxlzEDSo5FVlGO6LQ:bVZkD2X1j1Z6cphq3YKn5DlGOkQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP.LID

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\SETUP.LID
Size 49B
SHA256 708d29c649525882937031b3d73cc851b7b1bc30772eb4e0e2a71523908f2eb5
MD5 1b79748e93a541cc1590505b6c72828a
SHA1 1ddefee04dc9e9b2576dc34eebcfa3de4aa82af9
SHA512 e85c1f04d3841cd1e5aa5d7ba37bb3aff557d67b1aceb2d9435f07862593eb4e139162c71d9b017c82aade2e1c535c79d1a18d26dffb95282e10bc64bda04bfc
MD5 SHA1 SHA512

Submit Download

_INST32I.EX_

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\_INST32I.EX_
Size 293KB
SHA256 c707f6bd6eea954ddf0e8999ed949a506f915e4ae8237fbe52b3d548e68867b4
MD5 8d70c8885459ccfb5b8066c39e969699
SHA1 bab7718c41427419065bffa5d1af298cac77961e
SHA512 35868601d26a5f77c718ec9b46365e4e09f9464b63a98175526994bb175f6e201cc52403f807395ae564a66c40e6cce50312113e5da2c81c58540e4dd7467d2f
SSDEEP 6144:3FkD/sAlnsAQh7oHwc2DBs06doMZ0y58ycaRT3n1Omy0I9zyQG:ybwA2oHWT6dG0Nx1Omq9zLG
MD5 SHA1 SHA512 SSDEEP

Submit Download

_sys1.cab

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\_sys1.cab
Size 186KB
SHA256 210631c17c473d158cce9205031c6237d5b5c9ad9840f362c1f099109ff864c4
MD5 41bd982a59a4d68de293fc9ec264f459
SHA1 bc15c4be2d087a453ea82810c17011d79d114f8c
SHA512 74190a6781ea1da22f74f94e528c8e0e844a12e5d6d6ab9e46515c7537c5e7faea8999c4b29cb10548c8aadd144bdead88b79d4289087959407d8241969e4909
SSDEEP 3072:AxrgMD50coBwg3GD0grjBDWUmmo/R7JXPzZwQVORPp/Em7g3Edh7VCeKfNRbBQ1:KgqoBwg2Dbrtnmmo7lw3Faqg3Ch7se8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

_user1.cab

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\_user1.cab
Size 49KB
SHA256 299fde601a6625a332aa0c45a12c099dccbbf1d3dc192c6abd5c3c60c69344de
MD5 8b3597bc9de72faefd6392772048bcc4
SHA1 3ed5bf8069255bf5485a229bc8bd8f924025c04a
SHA512 7ea794497726eda25c47128868fe42f5658e44a3647187b0672cba63bb07c70ed19d10a50a817eac417dcc799af3e302868a544abba69d60806229a1364f88d9
SSDEEP 384:dPovf+nYrFaRKyw0UTq+LVMumjdxcdDFxmmG6fwU+LM9CuYA8lT7fMfw:dPoXfQbyBMjJx4FxZZAc+MY
MD5 SHA1 SHA512 SSDEEP

Submit Download

data1.cab

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\data1.cab
Size 2KB
SHA256 d3779c19f8f18d8fb0eaf34c59f6683ff74d6fe3206a97d98aa09ee856a15a62
MD5 d9c6b894461a9ca0c49a3986fbb52922
SHA1 698ee0b68ade8b36db5d5d1d396e528b7fa45257
SHA512 aea2e5378ea93585974be040e1aabcbec04c4b9a724834aaf1179c35f1c8a41c48ad40f1aba06b360bda77c9214596de2be4033f721f8434e546bffa873bdce2
MD5 SHA1 SHA512

Submit Download

os.dat

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\os.dat
Size 417B
SHA256 2f148cb3d32ab70a315b5a853761c2702b6deef6ffaff6aa76d513b945ce7ef7
MD5 af1d8d9435cb10fe2f4b4215eaf6bec4
SHA1 c20e693a53acc586c59a456648df5162f172c27d
SHA512 64f572a0d4df3c35a302cb232400dbd1165016ec93fb45ac2c539090d4018527b6d2f335fbcb57571d327dadb66e7e062a692ff86b2f0215967cfd0a8927355c
MD5 SHA1 SHA512

Submit Download

pftw1.pkg

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\pftw1.pkg
Size 648KB
SHA256 4beb37519faaeeaf0978b56295681270b5c9dc7f89d1277f27677c6d50eda144
MD5 873cd6d39ff7252ff8bfc7ce69f09ca6
SHA1 9194768425a092710b68c84bedb04d6072b13f39
SHA512 761424fa86cf3f7291a86309bed2be7f3d574ccf65670bf1b285d5473a45a404cdb1898b44f7b6719ecf1312783ee0e4fb012a9326b0604175727f0535db7d30
SSDEEP 12288:IUjbcUgBDvAIYEC2R+XsLm6srQENy6vApRj/dipeGHKaF7Av1QUkynp/VXTEEhQf:ItBDVYPVsLzs0Iy6vAf2dKm7A91kyDj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.bmp

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\setup.bmp
Size 80KB
SHA256 da5a359eb2c8b47d3df84aaa5f7ee0a8b881b198eeaf8b4ecae8e7de5184bdd2
MD5 f707f4215fe4aa6c558c79cb945ec3f6
SHA1 2e0b42b47860729f57d71e118c720a117c696203
SHA512 4d18f63fb5d7b5b569946f9b23f78a288f9e1c11fdc0a81434c2a6de34022fd077aa3400be4a364dc3266a86cf177f0d39f32d610c0bb7a94351c4d17d520e2d
SSDEEP 384:Cx0Sja+Q5J4LZN5Hsd/Sh9MZBuWvZWv+mz4q3:Cx0IQ5J4LZN5Hdh96BuWBWvbzv3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.ini

Path C:\Users\Admin\AppData\Local\Temp\pft4299.tmp\setup.ini
Size 76B
SHA256 e95b2862840f297deda714b6fb6ad4653b40d925d94207a62c4280a91d8a39aa
MD5 03399789eee9d518b88a6d00d033b9f2
SHA1 7a863ed25a3c99d223b66b0dfb786020f89b2901
SHA512 4052e231b5752f5a637dc3e61e94847bdaa77690798f81a6adf0282153d82a73aeb80eac5d373043db4f1d50c03ce11a41d1b52555fe33dc9c238f5f5b5f8eb7
MD5 SHA1 SHA512

Submit Download

plf421A.tmp

Path C:\Users\Admin\AppData\Local\Temp\plf421A.tmp
Size 5KB
SHA256 55023b00e2c2401272d0ad7b4b633814869483b6d939c5d4910e4ff18eeeee6c
MD5 cfaec980a3639a6b33704c0db20cb812
SHA1 e9402b1deb9293d51ea7a45ff5aea0f5bff1ea8f
SHA512 72bb65180098c195ea74c7dacf24500d98bbd872149e4247bdc98b3a12fabd2fd6846a61b7d30e610748d49348c347a1cec5939276e3a0b30703aeeb591017b2
SSDEEP 96:Kq2orCnavjFYCac5ENA3jOpAWaMd1ZcMeJgocuEaegn:KopxYRcuU2NaM9eJ4aegn
MD5 SHA1 SHA512 SSDEEP

Submit Download

_delis32.ini

Path C:\Windows\_delis32.ini
Size 268B
SHA256 c0b4fc8cff3a8e29b03c28eb7f81eec5442514d7dd4e8bafe9840c6cea985aa9
MD5 431536b7b894cbeaab41384492bf3b45
SHA1 c265c4a3f434eb1ccabc8d08eaad5ab8ecfeab9e
SHA512 714185664b08401aa1388f29d469480b3b19d8ac8b72e96bbc641016a0e464f70cea03b495750a7b1d53284905e19c73e15197587804041476be7c49e4c6ec01
MD5 SHA1 SHA512

Submit Download

_isenv31.ini

Path C:\Windows\_isenv31.ini
Size 1KB
SHA256 310ea63b7947f4005b0956288176d90494ceb15836df065248d49989576c9de9
MD5 79c4fe3e680023f2f94e9630fd289753
SHA1 a306002a96f30851b7703b5f01892652b7116241
SHA512 022d5188b6415cecdff426bc729a7261174df44d8e1b02a8c477063bc519584f3bcdad59bbffbd79b38ccb82a03bc361bb93a6287b80106f152a3904c24e2997
MD5 SHA1 SHA512

Submit Download

_iserr31.ini

Path C:\Windows\_iserr31.ini
Size 521B
SHA256 bd6efc8e0f5b775ae357f3b647d74b7ddbc5fb8fc827e659d77ac2ef9888f16f
MD5 b99921c1ce27e631044ad7ad03e27faa
SHA1 13fa80578e7a9f5ece1cfd7913eec6e3e5b12250
SHA512 79ff7699ad240f4b62c5b336fb6ebb684e675b2d74cf541997f1d42716c1e05bcc35d92443c0641a6f0e60a26d3add03f6316390aacb22701b718f652e5472ab
MD5 SHA1 SHA512

Submit Download

memory/3200-170-0x0000000002680000-0x0000000002691000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads