Analysis
-
max time kernel
118s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
12/03/2024, 08:39
General
-
Target
Setup (1).exe
-
Size
164.0MB
-
MD5
ee4515790ffc6bb0300d31e052e8413f
-
SHA1
6e9c1ddb29ef9a6371d910641a65297c70e320fe
-
SHA256
2560e0633f979374e3486de7f02ab1977be54313d866fcf54ce9ef175662b7ac
-
SHA512
d05a419255d608c3a20e8ca642b32289e393edf2b7cc3d4284ec28a93f8cc74d99ca4737ec733ec4749a1b9660e5aa5c8e64b1314a6ade45f956ec931b98222e
-
SSDEEP
3145728:EFPspn7jxX+g2xi5p1qZAM3kauX0GSxNuQ50uTXVLTR/xcILvaRYvztj:Lpnnxu0Xq1ZukPnLF/hLvaR4j
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 25 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (1).exe"C:\Users\Admin\AppData\Local\Temp\Setup (1).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ExergySimulator\app-1.11.41\Skm.Exergy.ExergyUI.exe"C:\Users\Admin\AppData\Local\ExergySimulator\app-1.11.41\Skm.Exergy.ExergyUI.exe" --squirrel-firstrun3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1172 -s 14364⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\ExergySimulator\app-1.11.41\Skm.MatlabWorker.exe"C:\Users\Admin\AppData\Local\ExergySimulator\app-1.11.41\Skm.MatlabWorker.exe" --squirrel-firstrun3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD54f21edcf35b12d5b72a359c1be36b4d8
SHA140c97b8e931d632ddb16169cf832333867b56f1e
SHA2566384df248726a669fc5da22c24c4796fecd64aa05bdd6b7c68c181c88e478948
SHA51281813a310c0cbd98205d5070a4c75bb49f1b4e419e4c7add94a94566c4aba93c0ba640ad1f4e766abbcf0fde72fe7f9d3e9dfa6d58776555e6a6d12b7efddb01
-
Filesize
14KB
MD5ab7867bd44b59879a59b5cb968e15668
SHA178bdff6642d5c04adb0e66461aee0553660b1c80
SHA25636141745e29b73817cf38f8a298dcee3de8338b0a0ecf82284bb9f74831296ed
SHA51200017413bc57c8af8b657621a306a53b65241f8817dfe14da7590366ad3bcc0a989ecb1e85963cab2c837be40529a2961b91a23eb7420c90e341c277a2faa86f
-
Filesize
82KB
MD5a52bdecbc1b7625cb13c9385fad4231b
SHA1614cb142fe219a056eff7d9dfd4fc79049b29b98
SHA2560ac08ac0a63f8424568f2bd6f13aac242fad6d508c6a7cb5d208f2c85a0ce11a
SHA5128e117f6f70336dfd0bfbc2da9e7b2962d69568c95bf9960d77df24688c91048187f4769437d61453792fd6ecb8464acfabb62959a140d9d108d157ec370aadbd
-
Filesize
60KB
MD5aa5f96c02b08d9b33322f3024058dd91
SHA139c1bff758d6974d90b4690b5911b4371ed91f19
SHA256cdfd368e3616d8f380dcd6750f22defe24aadbc4ab99f6e0daaea9290af96286
SHA5125cec444cb47c024f1395320ac1cbd5bc6fe8ecf5c70447f71462e85a66576e27801e3d817358fc8bbf050a752c4a51224db3c0b763b62f3773b2c86c4269cfb7
-
Filesize
77KB
MD599db9eb9678765c0ff2ff2131bc77521
SHA12fc3e2b6bebdbad0a1795136dc41409039383bb1
SHA2567360e55d14647845f75a055978b3df21d3988a42861bd82bf7e9fadc1f82043d
SHA51215d74a03cf1bc2c0dcae6c47fb5d1b7e926dc7cdd75cd852808ac81acd0c26cd90e0074f2f26869a6c342ae2107c6ab6f223f680d52e1b2113baeeeef3f8f594
-
Filesize
102KB
MD594aac5372d5d1b47eb66eebf3c697dd4
SHA113188bc03463801f3371d8224038798f785bc119
SHA2563b8f67e97e95ec3511e1493cacbe1efbfaa6aa96444e9884df1be551ab2b95ac
SHA512599490184579a3927b8207cf7c4f414f0e260306f4aed29919f9fed6375c31e24a9e55169dfaea17f130c2c677f06726e3a842ad4ff3335af76461efd22a293e
-
Filesize
727KB
MD5e6d43dfbb8850a60568478fdca31d5d7
SHA141437c8feded142a94b6ae4b33fa3dea13f2f037
SHA256f6b17196c9a363407b51f3345241a1594c399dea622bec5cd8794f7296cc9886
SHA5126c72f4ac4baefc209599abcc423afe1a2864967c5e1fc187a8adc3f8224e719bad5258938a8aab28b6afbdd6f88325b90f3d177b7c5056069d413407be752ac7
-
Filesize
702KB
MD55cb8c5212721ea64787c402a4aea3100
SHA1710bc464ea66db8dd3f52d435c242bf6187dce61
SHA256b4ac87cfd8c0dd993fe89162fe3035e609ec42495c98708d923d765918c1310e
SHA5125baf0a4e5841ed81a7d417606047dc04199e6c09a54d253ab61c32c29879e0ecf65483eb249a3897fbafafa5c0e55f6c2ad1bfa2305b7adc9c3cbf74ae7bfee7
-
Filesize
384KB
MD5b155d9163b872e4cc412e54675c52127
SHA11a128c7e55cfebdcd03415676349f48835160e94
SHA256b862de99932c7eea5dbf2660ec7c1e5351ae5548d48f7cf1ef139da97b8c3d02
SHA51267f36f9cc7fbdba30ca43c913a3c5b46c9f8517799801ce93a74cb49f0de08d6de51c2d16f5ac375f2502cb38c7373ca95a35ea35b354a88bed77306e37d952e
-
Filesize
358KB
MD5faaf5c87ace618aed419a412dd934c82
SHA1efd344b0275124f3f07e4dc85eb02cf17b0efd9c
SHA25698f34eca917aedf854790a2537707a366e9cb37caf2b4cbf2b593fc7a4385309
SHA5128eca56271604dc9c257d27ef276b5b7058f33ef6eda14648b46d26b3641be8dee4878b926c1d3c43910b6474dc7be76fcd313dd705a1d3857e90c1ec759d41cd
-
Filesize
1.3MB
MD5cd480fbfd3524b742c3f7371733d5e54
SHA129a1e158e511c195906afb13653defa4fae4b456
SHA256377720d8a41fe87076a07dba6040b0a508bffdefa46dd894ec799bf03789d7de
SHA512bb94d2a41c91bf84f93ca7522127dd2025e6978f48f7bad49ef65e2242e72fb133cb659ea111d80397f6afebfaa5674003ca521cd45643c8e65320f308f3b690
-
Filesize
366KB
MD56902a2ef7ed74d476606f471df7464cd
SHA10e677b6b09603b90b12f92ee64ac4bc6d903e28f
SHA256d7276c3fb269e7cd8b7f0f175206277c4f5de8b82129fd7880d96b57407b3261
SHA512c1abb1be21082c3cb083a15e407e8e3b9fac2d784bd912e71fd916e26e2e70d0472106ccd07f5ead725d5a6177c3f280bada935bccd0e2b1326352107478a088
-
Filesize
490KB
MD5214cad1cc1e8f00cbc45a1c299feeefd
SHA12a177cf9b5941f6a305270beabb8433dd4ff8e75
SHA2567af3f41f977a23e1d2a5d7c43d847ac0d07861c18a33db7fbb1d6fa71d84937c
SHA512b97404e7e3ca5e93e1173b783843fbf666e152dde35c3307e5e0ae2e640737e550cbca435075d13ff4ac7c9c7aaa12b8fd57bc9d23cd0289f18500f0ca41296c
-
Filesize
477KB
MD5d84efca9307f3bc9beeac7f79d7efd50
SHA1ffa1ebb75186177045f591efd3e43a171e60fa9b
SHA256a35fe529b7a7638c89d5d9a959fffff23278047043004e28ca86f516cbf66e0d
SHA512f359071de977e99099516867b704e088b87411b785943d8c389ede0a0c6adfc510b25911a732ea1e70e52d5e22a4eefed463d56cd97a24865a64ad0fbca39fd4
-
Filesize
295KB
MD5c2e127a0eea52900b464ce739e8b5914
SHA192a66a42d49a128c2c87f0cf3f3c13b7109c9b41
SHA256dd8bee65f1ad1e20b321a7472656f20a122c702b55d6a3c29d0925f36b10ee9f
SHA512fa6f0103b9f732bd1e15049f1f48e28f679181bad013dba2c1127fd1dd4ccc47f990287f048639c4fa12578c8f54e9f0946fba97d2cf2b1e911794f4aa99821d
-
Filesize
787KB
MD5f86a2747227acaa9abfa2a114b863871
SHA15c1d1c514c28fb220b563a73f40ce5916208a84a
SHA2569338c181defac58e4bb0f0b8e412ba28fe2902fdf098226427bce33073e554c3
SHA5123737226c3a17550827f32489c8efb0d84a72fc282036b56ebe9fa9d700cd9ffc549e61c9db1db17a15b95abdc0ec9d47fcad469de5e9dfbade42901ff3ae3480
-
Filesize
114KB
MD5a3c84c6d08a8f130343a4a1b4f7f0883
SHA117e1beff3746c10ed2ba846e81ebd5cd6d294484
SHA256107603433ae8a65b8e3369a68ba9b9fa2aabe67a4729d84f79e7eaf0bfb92c7d
SHA512273c4caf9f0d00e68afb7eb2dee232cf2ed0cac9535f989353ac5af46520ab93a78b5fcb96d1a2b40d7c2cf36dd1dc38aa2daeefe935ba5c4a356753ede5dd2e
-
Filesize
10KB
MD5a4e11b433054ba7f88ecd36321f26327
SHA1a7d01839d428b3c97c5ac8c4f8ac34dd640395dc
SHA256ed1936c775a50cc7b1b3ab4f04b331913598af370faf73f75399ae23e12b4b14
SHA512068afcaecb6ed14dcdec1518b4a60108b1ea96d3bbe33cdcfbbe9943213ce7901d69c1defe7d48d96e057c3885044fe28a2516c1486b96ab3f4acd28c8b58b3d
-
Filesize
429KB
MD5bf243aa2aca61bc33fde6fb37d81f4f4
SHA1f44256d22c8c6927f1a13ab84f7d59042addc71a
SHA2560d83b00efbefa7b478c0490e6356add652c445ea0517ed03f26025bb769d4758
SHA51244090b3d528cf5e67ee28c095e4b85c323558631a06a227eaf7ae7799bce94b2ee74d77b1ec219d5aefe67035466aecfbc6675888ac0077d3308b6909f4053c9
-
Filesize
6KB
MD5fb11c48f908a84e5f8a6a764237a02fd
SHA16071fe561f093543a8aeb2b4ec7218155d73a6d9
SHA2561a8b7d5167fe05cccc3ebcc12f9be6207825c0b3014811290c3a921e810e25b6
SHA51273bd5bc668cd7aa516146a1d4cf54e361026c2fb5aed09e363867a48d8ad89e4632b25b99395c4527de74d52d7a15d3f447260e7e2225558b16d1b642dc0582c
-
Filesize
861B
MD56d46929f4e94dceeb8ef4c1d53155ca4
SHA16536a960bd5747e2eb5cd296c241a98af3576b9d
SHA256c8748bfbfae2eeef3d738d624e3cbc5709b2edf8602528e28a692d2debe43b71
SHA5129d0890416d07657d9baaa598fc6c85eb4acd41ff8eef28a667cd2cfa6779affdeaea402ab3c9254a4c8d748285cdaab2ed284e158cbe9bf556c5116c7f21b0cb
-
Filesize
20KB
MD544530f072c1a3cc301d52570bf1fb20e
SHA1c1bb66548701eff4b8d45b85520ce4aa7a69a4a0
SHA256ace300add8513e70e1a5d7474530d4428da0ccd4adc3f07edee9844a6a2103f9
SHA512c3940613f3a387b4f12c297754e8cea3ebb59a9328301a890699066e548278f972c40b0f75ad1272cf68e7746844299fe614a7f343f9be652255b82f19ca5440
-
Filesize
43KB
MD5e1e923b6db56b15280c89a5508e2d551
SHA17b2028901f627589f508a159792663073e419b76
SHA256903dee4c9c618f6468f6e2cd1fd51fd008980081dde6d6063f116ccedc66fd5c
SHA5124e47405aa1c82ae3ecd8d5b316754936b011f4c0e2376a593ffbad468a758fd1dad0c75ee125c1f2feda5da2e2d987f624e1bee7571cf5f247a5faade17e9ece
-
Filesize
235KB
MD5a0e00a45ecb497b42bd00852a6142dbf
SHA1411459f090a9cde2154b68cf0c88af4e721df422
SHA2569f2fb6cce796f115e2b21b18ecc4d08784823290847c25bd41140a4fa87cd783
SHA512baeace51cbd05412264788c893741985b8a8ae6bb3ea0e91b68b1a129c41bb985c116b8d0846a60feff4c3f41d8737993a7ad16870fba0d2de1180c9e4e9a76f
-
Filesize
108KB
MD5b2ce49c37351d7a7471cd20c9e02b6e9
SHA144eb7732131b4b1b25ea8d023c3d2f544e017f24
SHA25676fcaccf84313bf78f523b3bc8198c2d040dabdc04a5dc863b46c8af7ac10a88
SHA51240980b050861f7c4f1ed5b71f7f7fd91052fcfc1c49b7b3490d9a4fd68fec8fd3c95af38d113aba8e7f1ce2b4ceadd1b6d66c5d1ea68064ec6265c266be1afc5
-
Filesize
26KB
MD5a84b438dbd4df29560eeb5765e03723a
SHA137de951f703687cf061556b1a52c6f548cbf779e
SHA256a576d1609cc08c46a46ce708b7fdae33452a3befb701128a5bc9d6ff1f1b6dfd
SHA512ee6855bca6ee6ff8ac7ce5c0565ccc77c35e5f1b3096f1ede2c018d3364683bc289c6c520472ba46e174fdbd821ea673bffa7dabc9358ce4c86d26f0c08fcc7c
-
Filesize
54KB
MD5580244bc805220253a87196913eb3e5e
SHA1ce6c4c18cf638f980905b9cb6710ee1fa73bb397
SHA25693fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf
SHA5122666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0
-
Filesize
13KB
MD5ca6129012719812a79542b9051c14d71
SHA199f4e152137b0416d59e0afd796d35168a2587d9
SHA25665da22414240bee5d9cec20841eae84df341860f47ed0f9ab159a61edee120d8
SHA51211a12b871a07d54b4fe0797ab9560a2d3c2b91b56e79d4697b8d3c7e87de3e501c082fe622e6f1f54d8afcaf4d4b4cae2be5085bffd94149fbb1e70359150bc4
-
Filesize
343KB
MD53a56463cb7d01d7dd244c002ca2f958a
SHA19b1885278d0ec0786d26dbd48431b2895dce2aa4
SHA2567d7ac298cbf7d10b3392a4154886e17a784c4ab40cdd0dd413a3b1acb3cb9bb5
SHA512ae4c6e216a4085a1e00cac8fb3b5dc0e239f56e7995a5aaa7be69e536f1474001718aa1ef51b9b6f5349d89323f63d8a346a7d2e4d3c2a0625338427fe41a3f0
-
Filesize
1.8MB
MD52d006681a7d8256294c167bbce9af4ff
SHA1488eef161e3751b7efe0ee373c97ab40e6e0b5e1
SHA256925b8cf410cce58da0f577ef4a44c2e8ecc99ac3973176733cf9d86e62993a90
SHA512d960aec43604f528955fdaa2db55f9b73c9d664fe735c43854842201cafac3dcda1deb92fc16472b2d1aed2e437cbb3b6cfdde142373a8db8c7580f638e44181
-
Filesize
19.1MB
MD5291dbfb874ab40a91839556f6820512d
SHA1f96d27a5a2e694455cf0dc32396fafb251b8c106
SHA256012000a13c8690f8dbcd2d152eb5ff0860db0ab487961b3f25842b425c1528b0
SHA512ab6f69576f41c0416f1cf1b2af1b1c965ea0f5c852810af5974082f44a7a79a994abc56f95d24a74086bce3d08d2f9f0b40bdd7fb31561f29398f9df76469007
-
Filesize
88B
MD54d6c668c1ca47d03526e7a093e8409e7
SHA17066779cf5b14b40a0ca38d193c065e0389a0d9e
SHA2565f82a7bc433a301b3bd42e1aa02aa8c958d39aa84f7a695b225ef95d6cb2edef
SHA512c5e40e94852f243f903d14dc29ddcda6893e052294e7edad522a7eca316bac53c89307df6e45979813995da84cac43517af16a64b76b7645400e2d73280a46a2
-
Filesize
13KB
MD54f5a2f6a0dfea73d6928dfb8023de157
SHA1d08d8ed01c5740b8463bfd87d43c6b5ff12c5fa0
SHA256d603c6104fcb76aa282467d7b7b6a3cd0090fc72dde00786f7c8dca6d2dfe7c1
SHA512e38c122753f1ffa7889a91954cac90d3f8fd94e5ebdddcac782583871dea0cae2dbdc063c94f4743995c12c2c19d6c54855d31e4fb80e4995937a367017d37da
-
Filesize
186KB
MD5f76c1bced865a848d195ea5bd516f8a2
SHA15cda7e3b23b59c3e811dea8c90dc2e9f74e30127
SHA25691afae14e03ca405fb18620dc4e0b8b1239e51cc7baf9f51c54d982ad463a2ca
SHA512c8f178a2a616d256892e2313d16ae06b7666651c8310c010c2ef4eca797fdf050d2d5a083f6279dc3a222effb1f8cee0db4a86f6410edd08c66852d25faef123
-
Filesize
104KB
MD5fc8d6ae6c1c3034d6918a86fd41c02de
SHA142810ddbffddc809cfcc442f847073a00b1fea52
SHA256bf9db285e268ac7817e6d1bf6f95f3d10406c3acd4b5cf23150b7834b8562a8f
SHA512f599b248959c980df35d388711178d9353c79a34d226446515ed7a08c212e1806d6e3de9d05083bbff58bc0a5db4c573feaefc8af56a7b927598e9e3656fe3f4
-
Filesize
951KB
MD5f1b01b82fedf24b1b4231b3d74874422
SHA1694b1b6cca8a2d1995f616b2b09d15ef1d05ea3c
SHA2565bf775ee94b1b8a71638e745d06b43d61bcfe3c71c77985ff95f6a506b8655cb
SHA512b9e5989aa98b133befec68eaf099ac2ae6ea7fad969c7ceed5d9aaf3e9d8e8d1394c00e592f1a246c7bdde4f5dab93ac922d3431c4a671d72716538a4ac0dab9
-
Filesize
448KB
MD58e766d46eda4d825c754988315937270
SHA1a482edceb4ad3d3aa6010e6d563636bac326c7e6
SHA2567aedbf8ec3e4919984bc394b504d22232b32bf63d0e192e6e7eaf74bdcd3802c
SHA5122d2dac7ba873fd5eac08b5fc75c969f3c793fbce94826214201fdfd6cfd1a23d023d98d101923450f17ecbb7c2a83f804f534455527e03690c44396d353ab401
-
Filesize
289KB
MD5622ed0dc5370edde46436393b7a5c68d
SHA1f80b949aecbd915590985a7991098dbbbdb089cc
SHA2569d794ae7791c5368d773a8b86a5c6a9086920e4dae75084dc7ad2d0a9e6f60f0
SHA512005fd46ab1d09595fa8d2d57e7a4dd78f244171e76ad2f679ff54ccb637e1ee945c20d9a8a681bebc2c2ba834fbf04e3b6936b4c3a4be9f3bfca596bcb503bd2
-
Filesize
12KB
MD5a5a60dd451d0076a6a5cd0201656d36c
SHA11671281d55a5d8b066950dd31686fb42dd095a00
SHA25613157ca76ec59b5fcb7669e4c4e87e38b3fbf18eda5d4db37e0d5119c3290680
SHA51267f4c8062ac80677f070d28ef82650e08adea879b473c5613c8bc1ba14ea912fe72a91dc41017932f926b9b324dd92988b12b0f2b6246a81fc3ef0bab1a64796
-
Filesize
1.8MB
MD56b888f27a6246d268dd9362915c1012b
SHA15d47c99641985d333a28105bc2feb09ec885ea96
SHA2563f2e2cdfa9f55f2e8fad7c5133915baadbc6c260a5641f17bc923c19832617c7
SHA512cff491d87c117e4a8202335a56796371cc53138a9d534e63f6e868beb13e77e1a12fec135805f999799ac070990b0071846c4c2a65d3cceacc70a4dafb264f21
-
Filesize
2.4MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
10.9MB
-
Filesize
32KB
-
Filesize
88KB
-
Filesize
848KB
-
Filesize
40KB
-
Filesize
9.9MB
-
Filesize
2.7MB
-
Filesize
40KB
-
Filesize
104KB
-
Filesize
512KB
-
Filesize
4.3MB
-
Filesize
5.1MB
-
Filesize
512KB
-
Filesize
72KB
-
Filesize
264KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
120KB
-
Filesize
40KB
-
Filesize
512KB
-
Filesize
464KB
-
Filesize
512KB
-
Filesize
9.1MB
-
Filesize
32KB
-
Filesize
9.9MB
-
Filesize
8.0MB
-
Filesize
40KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
968KB
-
Filesize
32KB
-
Filesize
496KB
-
Filesize
1.4MB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
136KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
6.9MB
-
Filesize
1.8MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
40KB
-
Filesize
40KB
