Overview

overview

8

Static

static

1

AMASS 2.0/...up.exe

windows7-x64

6

AMASS 2.0/...up.exe

windows10-2004-x64

6

AMASS 2.0/...up.exe

windows7-x64

8

AMASS 2.0/...up.exe

windows10-2004-x64

8

AMASS 2.0/setup.exe

windows7-x64

6

AMASS 2.0/setup.exe

windows10-2004-x64

1

Resubmissions

09/03/2024, 00:10

240309-agetcabb6y8

09/03/2024, 00:06

240309-adr99sac648

Analysis

  • max time kernel
    136s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 00:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AMASS 2.0/LicenseManager/LicenseManagerSetup.exe
  • Size 40.8MB
  • Sample240309-agetcabb6y
  • SHA256 c5e754131691a1362d9f28ba77e6ab2aec76b3834796c54a63b44d2a66916774
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 24 IoCs
  • Drops file in Windows directory 27 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4340
    • C:\Users\Admin\AppData\Local\Temp\{746988E5-1DBF-4F0F-B659-195284C31491}\LicenseManagerSetup.exe
      C:\Users\Admin\AppData\Local\Temp\{746988E5-1DBF-4F0F-B659-195284C31491}\LicenseManagerSetup.exe /q"C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{746988E5-1DBF-4F0F-B659-195284C31491}" /IS_temp
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4568
      • C:\Windows\SysWOW64\MSIEXEC.EXE
        "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{746988E5-1DBF-4F0F-B659-195284C31491}\License Manager.msi" /log C:\Users\Admin\AppData\Local\Temp\LicenseManagerSetup.log SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager" SETUPEXENAME="LicenseManagerSetup.exe"
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:740
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 33DA5639283B633E6FF9D85AB79D7793 C
      2⤵
      • Loads dropped DLL
      PID:2156
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4792
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding A67532671457731DB5B7FC060F3FFBED
        2⤵
          PID:3612
        • C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe
          "C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe" -i -cm
          2⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2608
          • C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe
            C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe -i -nomsg -32to64
            3⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks SCSI registry key(s)
            PID:4736
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:4244
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f2527557-f44c-9744-9820-994a58c9c09b}\akshasp.inf" "9" "4d1770e3f" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "C:\Windows\system32\setup\aladdin\hasphl"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4288
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{40b9681a-3610-4145-a2be-8f9ab3ecbdfe}\akshhl.inf" "9" "48e7fedb7" "0000000000000164" "WinSta0\Default" "000000000000015C" "208" "C:\Windows\system32\setup\aladdin\hasphl"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4784
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{30f6254d-b4c1-dc4c-b9b4-8a3c2b3b97c8}\aksusb.inf" "9" "486f4dfd7" "000000000000015C" "WinSta0\Default" "0000000000000170" "208" "C:\Windows\system32\setup\aladdin\hasphl"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4260

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            LicenseManagerApplication.exe
            • Path C:\Program Files (x86)\PANalytical\LicenseManager\LicenseManagerApplication.exe
            • Size 20KB
            • SHA256 416e8afc3ed2e11972ce1cec17b9edee3106e38a7e4710b615facd2bfc6bb395
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            haspdinst.exe
            • Path C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe
            • Size 9.0MB
            • SHA256 634f381b07e9e9261ca959b7b5cee75bbfcbcbed70b739cab3d3cd0e1f46a3be
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            haspdinst.exe
            • Path C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe
            • Size 10.1MB
            • SHA256 9c588855eb15baf3524af6511b22d65f3810e26b32dee5cb45f140d5470ecf74
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            0pdc.txt
            • Path C:\Users\Admin\AppData\Local\Temp\0pdc.txt
            • Size 4KB
            • SHA256 aa9223ed8ab7ab3e555242dcc62cd25c63f129522150f56425da7740bb24e529
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LicenseManagerSetup.log
            • Path C:\Users\Admin\AppData\Local\Temp\LicenseManagerSetup.log
            • Size 7KB
            • SHA256 3bd614bc06f462ec3cd5f3e968fb3a24f2f1d58aa33ac7ef8959ff411a5e2fa9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSICCA6.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSICCA6.tmp
            • Size 165KB
            • SHA256 1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            haspdinst_x64.exe
            • Path C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe
            • Size 8.2MB
            • SHA256 a505a29dbdb6d04a6fe69779182923976a6d7f3144567c4a1c41642e91213e77
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            haspdinst_x64.exe
            • Path C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe
            • Size 9.1MB
            • SHA256 9fe923532e970333e5ef917739cc27b69dfcfc3fc14b2bffa7c1b30cb852fd44
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            haspds_windows.dll
            • Path C:\Users\Admin\AppData\Local\Temp\haspds_windows.dll
            • Size 14.2MB
            • SHA256 23c68f278293fd0f8dcf60f78a66630de268f332cc56f9fde1c5e9d3a0182dcb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            haspds_windows.dll
            • Path C:\Users\Admin\AppData\Local\Temp\haspds_windows.dll
            • Size 896KB
            • SHA256 2d9bfdd956ee9d3b51352c8e9e8f812289da5f3f2d14ef3564f45d1a24154324
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            haspds_windows_x64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\haspds_windows_x64.dll
            • Size 9.2MB
            • SHA256 e9794089902ed5c0488d7fb3f7ce0ed6cca1aa9caeed16ddaaa8403d44a66160
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            hhl01.cab
            • Path C:\Users\Admin\AppData\Local\Temp\hhl01.cab
            • Size 8.0MB
            • SHA256 1d313fa33111704af145c65a215a98888e79b34127ec84251cd9400b5a791fa7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            0x0409.ini
            • Path C:\Users\Admin\AppData\Local\Temp\{746988E5-1DBF-4F0F-B659-195284C31491}\0x0409.ini
            • Size 21KB
            • SHA256 8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            License Manager.msi
            • Path C:\Users\Admin\AppData\Local\Temp\{746988E5-1DBF-4F0F-B659-195284C31491}\License Manager.msi
            • Size 34.1MB
            • SHA256 8cec6b6f938a8a9ec837cea96b4c8e647998108cb4106740618cf6c8ba4c9449
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LicenseManagerSetup.exe
            • Path C:\Users\Admin\AppData\Local\Temp\{746988E5-1DBF-4F0F-B659-195284C31491}\LicenseManagerSetup.exe
            • Size 14.1MB
            • SHA256 f358c322c547bfa8484459de2cc0899bf9d0c112a7ee7a45a164666bb766258d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LicenseManagerSetup.exe
            • Path C:\Users\Admin\AppData\Local\Temp\{746988E5-1DBF-4F0F-B659-195284C31491}\LicenseManagerSetup.exe
            • Size 14.4MB
            • SHA256 c2ed08695713fc01fda078b07d97c7ea2127f115637633d122823729ed1c4962
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _ISMSIDEL.INI
            • Path C:\Users\Admin\AppData\Local\Temp\{746988E5-1DBF-4F0F-B659-195284C31491}\_ISMSIDEL.INI
            • Size 648B
            • SHA256 81a35ba253db4a03fe4b4a7491682db176d502f6da55a45bd63c352be9441b69
            • MD5 SHA1 SHA512
            Submit Download

            ~AE05.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\~AE05.tmp
            • Size 5KB
            • SHA256 f5d115bd6743167068e550f5b5a81d915762b3ca6b052e322defd64ac69ed070
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            e5867fc.msi
            • Path C:\Windows\Installer\e5867fc.msi
            • Size 10.5MB
            • SHA256 78a662d3c84c6af25d39dac0c47d9e65b16873d1d485ca47182076bdf570bb02
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 19KB
            • SHA256 38c7329a6656b1f5234a7cca905276d6f81c86b7b5bc29877b1dee55248fa297
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 19KB
            • SHA256 520ed2fc5972942623f5260d79202ceed17c8ba55bcb1332c2484848ba8cd8ae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 19KB
            • SHA256 327215ae53ce8225734fb3d1c1a7ed2ede98c754a6fe5b25c72434d88c3c635d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            aksclass.sys
            • Path C:\Windows\System32\setup\aladdin\hasphl\aksclass.sys
            • Size 30KB
            • SHA256 740bffacf2f383c9e5180203adc7fcb8476df876a1097791b97cea8d7689c11a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            akshasp.cat
            • Path C:\Windows\System32\setup\aladdin\hasphl\akshasp.cat
            • Size 9KB
            • SHA256 f4739fca522e29627af4ae3eb8149fb89ddea18631cd1f9ba29deb2e845f353a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            akshasp.inf
            • Path C:\Windows\System32\setup\aladdin\hasphl\akshasp.inf
            • Size 2KB
            • SHA256 2083bca634feb5c9faf3eb2a4488ac1faec2bd36f6c6de53277be528509a3e7c
            • MD5 SHA1 SHA512
            Submit Download

            akshasp.sys
            • Path C:\Windows\System32\setup\aladdin\hasphl\akshasp.sys
            • Size 67KB
            • SHA256 3c635791b9b514a152ff9b3a853458864acdf668ba72d4a8b2840619ad93055b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            akshhl.cat
            • Path C:\Windows\System32\setup\aladdin\hasphl\akshhl.cat
            • Size 9KB
            • SHA256 e097b13d615ed6874e95954393017ca2b357f05ee164d5588d02545d842b5ae2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            akshhl.inf
            • Path C:\Windows\System32\setup\aladdin\hasphl\akshhl.inf
            • Size 2KB
            • SHA256 758192f976302955fa8130ff85a0b459ac7a5df2ff05cf258c7255a5d4697dd5
            • MD5 SHA1 SHA512
            Submit Download

            akshhl.sys
            • Path C:\Windows\System32\setup\aladdin\hasphl\akshhl.sys
            • Size 66KB
            • SHA256 4a80438e8c8aa89b9e356fb9320b57d7c01c9b1ff66e7b8fdf69d4022024750c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            akshhl33.dll
            • Path C:\Windows\System32\setup\aladdin\hasphl\akshhl33.dll
            • Size 273KB
            • SHA256 046b84032596cf064c28cfb40ab839f484304a9e8e8c05c32c09cf875b5a922b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            akshsp53.dll
            • Path C:\Windows\System32\setup\aladdin\hasphl\akshsp53.dll
            • Size 72KB
            • SHA256 488a800297c3357e855937730a51ac61fce86ef42d34c467c1109789f1fab385
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            aksusb.cat
            • Path C:\Windows\System32\setup\aladdin\hasphl\aksusb.cat
            • Size 11KB
            • SHA256 a71d9d4ce4ed79325fb708502c8e3e3adf3dd6b36e0acd878150cbd32396a5cf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            aksusb.inf
            • Path C:\Windows\System32\setup\aladdin\hasphl\aksusb.inf
            • Size 2KB
            • SHA256 10a13e9a15a18016a8bdbc2b235dffb819e4229a7f5a7c352d3fb0923a569b7f
            • MD5 SHA1 SHA512
            Submit Download

            aksusb.sys
            • Path C:\Windows\System32\setup\aladdin\hasphl\aksusb.sys
            • Size 306KB
            • SHA256 63ac9315688dc5c67b79dbbd0205f69e3dafec1c4cb104b9f806809472819142
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            aksusb5.dll
            • Path C:\Windows\System32\setup\aladdin\hasphl\aksusb5.dll
            • Size 83KB
            • SHA256 514972afcd1d1f3792cba8434e7b1ac0a2bb04752597d2372882726d725e9b1d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            hardlock.sys
            • Path C:\Windows\System32\setup\aladdin\hasphl\hardlock.sys
            • Size 1.9MB
            • SHA256 1d3e3dc116eb68c6a22ef06d92c06ce9f650cb8fa772c623545d2b974f87520a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            hlvdd.dll
            • Path C:\Windows\System32\setup\aladdin\hasphl\hlvdd.dll
            • Size 201KB
            • SHA256 587d166830beb63866394c3738c40931958cb1703b3be3dc035f8913ce3c816b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            aksdrvsetup.log
            • Path C:\Windows\aksdrvsetup.log
            • Size 1KB
            • SHA256 fb073a080ff1a7f93f82c72cfd949fc699991233847fccfcf0069ac4b61b746f
            • MD5 SHA1 SHA512
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 20.1MB
            • SHA256 528a20894b6eab090d24f733f55f3c11afa316a90a086ec1ae3cff342c51d558
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            {0633a9e7-9c1e-46b6-9620-dc48d5b96acd}_OnDiskSnapshotProp
            • Path \??\Volume{0e54dc8f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0633a9e7-9c1e-46b6-9620-dc48d5b96acd}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 4ae33dac03b57a01cd2dffed012e2caa280943fd0dd6f2ac0b08c062e2cfa62e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download