Overview

overview

8

Static

static

1

AMASS 2.0/...es.rtf

windows7-x64

4

AMASS 2.0/...es.rtf

windows10-2004-x64

1

AMASS 2.0/...es.rtf

windows7-x64

4

AMASS 2.0/...es.rtf

windows10-2004-x64

1

AMASS 2.0/...up.exe

windows7-x64

6

AMASS 2.0/...up.exe

windows10-2004-x64

6

AMASS 2.0/...up.exe

windows7-x64

8

AMASS 2.0/...up.exe

windows10-2004-x64

8

AMASS 2.0/...on.pdf

windows7-x64

1

AMASS 2.0/...on.pdf

windows10-2004-x64

1

AMASS 2.0/...60.dll

windows7-x64

1

AMASS 2.0/...60.dll

windows10-2004-x64

1

AMASS 2.0/setup.exe

windows7-x64

1

AMASS 2.0/setup.exe

windows10-2004-x64

1

Resubmissions

09/03/2024, 00:10

240309-agetcabb6y8

09/03/2024, 00:06

240309-adr99sac648

Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 00:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AMASS 2.0/LicenseManager/LicenseManagerSetup.exe
  • Size 40.8MB
  • Sample240309-adr99sac64
  • SHA256 c5e754131691a1362d9f28ba77e6ab2aec76b3834796c54a63b44d2a66916774
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 24 IoCs
  • Drops file in Windows directory 27 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Users\Admin\AppData\Local\Temp\{0C82B1E0-0938-4B9C-87DA-9DBE15E5F6EA}\LicenseManagerSetup.exe
      C:\Users\Admin\AppData\Local\Temp\{0C82B1E0-0938-4B9C-87DA-9DBE15E5F6EA}\LicenseManagerSetup.exe /q"C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{0C82B1E0-0938-4B9C-87DA-9DBE15E5F6EA}" /IS_temp
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1264
      • C:\Windows\SysWOW64\MSIEXEC.EXE
        "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{0C82B1E0-0938-4B9C-87DA-9DBE15E5F6EA}\License Manager.msi" /log C:\Users\Admin\AppData\Local\Temp\LicenseManagerSetup.log SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager" SETUPEXENAME="LicenseManagerSetup.exe"
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4784
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F31135EEFBFC15EE6FFAC4DCE13C634B C
      2⤵
      • Loads dropped DLL
      PID:2784
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4312
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 0412728AAB8195CB4F3E27095210FB8D
        2⤵
          PID:3096
        • C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe
          "C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe" -i -cm
          2⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe
            C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe -i -nomsg -32to64
            3⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks SCSI registry key(s)
            PID:3808
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:1536
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:4240
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c7a01b62-675e-f245-bbf1-31ba452eb307}\akshasp.inf" "9" "4d1770e3f" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Windows\system32\setup\aladdin\hasphl"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4736
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4846a92d-6de1-f448-b126-f482ef467b84}\akshhl.inf" "9" "48e7fedb7" "0000000000000158" "WinSta0\Default" "000000000000015C" "208" "C:\Windows\system32\setup\aladdin\hasphl"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:1624
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{380ee709-a27e-8a4a-9806-3ced7bcf951c}\aksusb.inf" "9" "486f4dfd7" "000000000000015C" "WinSta0\Default" "0000000000000154" "208" "C:\Windows\system32\setup\aladdin\hasphl"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4548
      • C:\Windows\system32\backgroundTaskHost.exe
        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
        1⤵
          PID:4736

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              LicenseManagerApplication.exe
              • Path C:\Program Files (x86)\PANalytical\LicenseManager\LicenseManagerApplication.exe
              • Size 20KB
              • SHA256 416e8afc3ed2e11972ce1cec17b9edee3106e38a7e4710b615facd2bfc6bb395
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              haspdinst.exe
              • Path C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe
              • Size 2.1MB
              • SHA256 3fad4c1c3fbe34ae9489864dcd2233b48b61e219ac8578ebf5b18d5df5ddca6e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              haspdinst.exe
              • Path C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe
              • Size 3.0MB
              • SHA256 13af8b4ecefede9bcb260a69ef0ea4f50f125aedfdbe75fd6dd3ad4b3617306d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              0pdc.txt
              • Path C:\Users\Admin\AppData\Local\Temp\0pdc.txt
              • Size 4KB
              • SHA256 aa9223ed8ab7ab3e555242dcc62cd25c63f129522150f56425da7740bb24e529
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LicenseManagerSetup.log
              • Path C:\Users\Admin\AppData\Local\Temp\LicenseManagerSetup.log
              • Size 7KB
              • SHA256 79c19e86868ba655f2b39a05b9752d4cf22f8773253dffa57c1d56ff1ace812a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSI662C.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI662C.tmp
              • Size 89KB
              • SHA256 dfad5b298984973d6c8566124b8564fff4dccc9006eefe08d7d7bd0e4e4bb0c6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSI662C.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI662C.tmp
              • Size 57KB
              • SHA256 d7d702819b377190dfb5ff5f0534490eb7383b7765ecf55d84ec7015480dd796
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              haspdinst_x64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe
              • Size 1.1MB
              • SHA256 7cfab09b0fcff6f419aee7bb4c10d2dfc0fc77e7ab9f4d44c8159638622ba779
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              haspdinst_x64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe
              • Size 1.2MB
              • SHA256 ae8bb026ac8f55caf3d1b6868903ff8afd973ffc4ff8abddcb6a98226e9ce8ae
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              haspds_windows.dll
              • Path C:\Users\Admin\AppData\Local\Temp\haspds_windows.dll
              • Size 1.7MB
              • SHA256 bf079e0348830afaa6c96687070920d1404d7d5d0af64a21397f975cf63d22c6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              haspds_windows.dll
              • Path C:\Users\Admin\AppData\Local\Temp\haspds_windows.dll
              • Size 473KB
              • SHA256 98408f0e91307f9f874b95294da440422726d85c763f95d997192076079f2dc7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              haspds_windows_x64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\haspds_windows_x64.dll
              • Size 913KB
              • SHA256 d247c121aa0ffd6efd7e24ecc2b8bd1e0ef4d4f35bfb523c3b79e59b68733795
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              hhl01.cab
              • Path C:\Users\Admin\AppData\Local\Temp\hhl01.cab
              • Size 1.1MB
              • SHA256 530ace69fcf16dde0dd26f4f573b0367b45e2463e6ec7d291673eb3b823620be
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              hhl01.cab
              • Path C:\Users\Admin\AppData\Local\Temp\hhl01.cab
              • Size 517KB
              • SHA256 ba0efb8c7a6a9b6f953804b2fd89a9da3d57dcc8f639340bbe9af3def0a20047
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              0x0409.ini
              • Path C:\Users\Admin\AppData\Local\Temp\{0C82B1E0-0938-4B9C-87DA-9DBE15E5F6EA}\0x0409.ini
              • Size 21KB
              • SHA256 8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              License Manager.msi
              • Path C:\Users\Admin\AppData\Local\Temp\{0C82B1E0-0938-4B9C-87DA-9DBE15E5F6EA}\License Manager.msi
              • Size 168KB
              • SHA256 b382eff835e851b5f00c190877b8eef0ecd8a2d0def45e42d58f3aa65c4c43b3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LicenseManagerSetup.exe
              • Path C:\Users\Admin\AppData\Local\Temp\{0C82B1E0-0938-4B9C-87DA-9DBE15E5F6EA}\LicenseManagerSetup.exe
              • Size 830KB
              • SHA256 8ca633535089de7c6cce6d79195df0ad7e1dee79c6bbd3130c0d805c439c3e55
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LicenseManagerSetup.exe
              • Path C:\Users\Admin\AppData\Local\Temp\{0C82B1E0-0938-4B9C-87DA-9DBE15E5F6EA}\LicenseManagerSetup.exe
              • Size 686KB
              • SHA256 5285d3f5a4b0c6699ec029b3bf5ad7c1945407228aa3e0416fc281704fea61da
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _ISMSIDEL.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{0C82B1E0-0938-4B9C-87DA-9DBE15E5F6EA}\_ISMSIDEL.INI
              • Size 648B
              • SHA256 b4ff14b5e3a460b22b008ad9e72e5218ad5071a46d70267639ece9c1399e0aa1
              • MD5 SHA1 SHA512
              Submit Download

              akshhl.cat
              • Path C:\Users\Admin\AppData\Local\Temp\{4846A~1\akshhl.cat
              • Size 9KB
              • SHA256 e097b13d615ed6874e95954393017ca2b357f05ee164d5588d02545d842b5ae2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              akshhl33.dll
              • Path C:\Users\Admin\AppData\Local\Temp\{4846A~1\akshhl33.dll
              • Size 273KB
              • SHA256 046b84032596cf064c28cfb40ab839f484304a9e8e8c05c32c09cf875b5a922b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              akshhl.inf
              • Path C:\Users\Admin\AppData\Local\Temp\{4846a92d-6de1-f448-b126-f482ef467b84}\akshhl.inf
              • Size 2KB
              • SHA256 758192f976302955fa8130ff85a0b459ac7a5df2ff05cf258c7255a5d4697dd5
              • MD5 SHA1 SHA512
              Submit Download

              ~4F1C.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\~4F1C.tmp
              • Size 5KB
              • SHA256 f5d115bd6743167068e550f5b5a81d915762b3ca6b052e322defd64ac69ed070
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              e58d2bc.msi
              • Path C:\Windows\Installer\e58d2bc.msi
              • Size 3.6MB
              • SHA256 507fdac3539ed299e74cec6d68a38ceff8efa717d07188078c86cf847c831e9b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dberr.txt
              • Path C:\Windows\System32\CatRoot2\dberr.txt
              • Size 19KB
              • SHA256 c09bfec2598c5845000b3d132c6580b93c879bad8f6021875a7459a3f517009c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dberr.txt
              • Path C:\Windows\System32\CatRoot2\dberr.txt
              • Size 19KB
              • SHA256 018010fa51f086795c1a8630f49966f1d61c18c65e3b55505ffccf0830b48e35
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dberr.txt
              • Path C:\Windows\System32\CatRoot2\dberr.txt
              • Size 19KB
              • SHA256 3c63dd1e75e0aa021516d40cb754f0e0fa0d9974a6a6f516f526818fb712cadc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              aksclass.sys
              • Path C:\Windows\System32\setup\aladdin\hasphl\aksclass.sys
              • Size 30KB
              • SHA256 740bffacf2f383c9e5180203adc7fcb8476df876a1097791b97cea8d7689c11a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              akshasp.cat
              • Path C:\Windows\System32\setup\aladdin\hasphl\akshasp.cat
              • Size 9KB
              • SHA256 f4739fca522e29627af4ae3eb8149fb89ddea18631cd1f9ba29deb2e845f353a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              akshasp.inf
              • Path C:\Windows\System32\setup\aladdin\hasphl\akshasp.inf
              • Size 2KB
              • SHA256 2083bca634feb5c9faf3eb2a4488ac1faec2bd36f6c6de53277be528509a3e7c
              • MD5 SHA1 SHA512
              Submit Download

              akshasp.sys
              • Path C:\Windows\System32\setup\aladdin\hasphl\akshasp.sys
              • Size 67KB
              • SHA256 3c635791b9b514a152ff9b3a853458864acdf668ba72d4a8b2840619ad93055b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              akshhl.sys
              • Path C:\Windows\System32\setup\aladdin\hasphl\akshhl.sys
              • Size 66KB
              • SHA256 4a80438e8c8aa89b9e356fb9320b57d7c01c9b1ff66e7b8fdf69d4022024750c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              akshsp53.dll
              • Path C:\Windows\System32\setup\aladdin\hasphl\akshsp53.dll
              • Size 72KB
              • SHA256 488a800297c3357e855937730a51ac61fce86ef42d34c467c1109789f1fab385
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              aksusb.cat
              • Path C:\Windows\System32\setup\aladdin\hasphl\aksusb.cat
              • Size 11KB
              • SHA256 a71d9d4ce4ed79325fb708502c8e3e3adf3dd6b36e0acd878150cbd32396a5cf
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              aksusb.inf
              • Path C:\Windows\System32\setup\aladdin\hasphl\aksusb.inf
              • Size 2KB
              • SHA256 10a13e9a15a18016a8bdbc2b235dffb819e4229a7f5a7c352d3fb0923a569b7f
              • MD5 SHA1 SHA512
              Submit Download

              aksusb.sys
              • Path C:\Windows\System32\setup\aladdin\hasphl\aksusb.sys
              • Size 306KB
              • SHA256 63ac9315688dc5c67b79dbbd0205f69e3dafec1c4cb104b9f806809472819142
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              aksusb5.dll
              • Path C:\Windows\System32\setup\aladdin\hasphl\aksusb5.dll
              • Size 83KB
              • SHA256 514972afcd1d1f3792cba8434e7b1ac0a2bb04752597d2372882726d725e9b1d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              hardlock.sys
              • Path C:\Windows\System32\setup\aladdin\hasphl\hardlock.sys
              • Size 1.9MB
              • SHA256 1d3e3dc116eb68c6a22ef06d92c06ce9f650cb8fa772c623545d2b974f87520a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              hlvdd.dll
              • Path C:\Windows\System32\setup\aladdin\hasphl\hlvdd.dll
              • Size 201KB
              • SHA256 587d166830beb63866394c3738c40931958cb1703b3be3dc035f8913ce3c816b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              aksdrvsetup.log
              • Path C:\Windows\aksdrvsetup.log
              • Size 1KB
              • SHA256 e58f6c6c0855c1b70930ddb87e4123d1b34de59b6d464746175827bbb4261b94
              • MD5 SHA1 SHA512
              Submit Download

              metadata-2
              • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
              • Size 10.6MB
              • SHA256 fd50f041559ec37d608905c481066b0c019e457cf6778f4453042f6e0d580f1b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              {643b1652-9bb0-4249-b9d0-b9e324f3b6d0}_OnDiskSnapshotProp
              • Path \??\Volume{f429969b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{643b1652-9bb0-4249-b9d0-b9e324f3b6d0}_OnDiskSnapshotProp
              • Size 6KB
              • SHA256 03ee828bdcb5e411e32f02b1d47788f13f9ddf92f50e89de0cb3034441c8d5f3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download