Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/03/2024, 08:39
General
-
Target
Setup (1).exe
-
Size
164.0MB
-
MD5
ee4515790ffc6bb0300d31e052e8413f
-
SHA1
6e9c1ddb29ef9a6371d910641a65297c70e320fe
-
SHA256
2560e0633f979374e3486de7f02ab1977be54313d866fcf54ce9ef175662b7ac
-
SHA512
d05a419255d608c3a20e8ca642b32289e393edf2b7cc3d4284ec28a93f8cc74d99ca4737ec733ec4749a1b9660e5aa5c8e64b1314a6ade45f956ec931b98222e
-
SSDEEP
3145728:EFPspn7jxX+g2xi5p1qZAM3kauX0GSxNuQ50uTXVLTR/xcILvaRYvztj:Lpnnxu0Xq1ZukPnLF/hLvaR4j
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (1).exe"C:\Users\Admin\AppData\Local\Temp\Setup (1).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ExergySimulator\app-1.11.41\Skm.Exergy.ExergyUI.exe"C:\Users\Admin\AppData\Local\ExergySimulator\app-1.11.41\Skm.Exergy.ExergyUI.exe" --squirrel-firstrun3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\ExergySimulator\app-1.11.41\Skm.MatlabWorker.exe"C:\Users\Admin\AppData\Local\ExergySimulator\app-1.11.41\Skm.MatlabWorker.exe" --squirrel-firstrun3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD55e09a37582c251bb88df7882107a4c83
SHA1bda3f7c9b3f30de31b2e3690afe6617a9e49bae4
SHA2569014c7d20bc59d01a15e7799af96cf42cd31c490eac3d0572b3647ab55a39d00
SHA512c81cc98a216dacd309efc5b60b75b70ba88f2a78276ba47656c966172ce476848ef01a8e245a345aa4c4607da9b1aa93e4bde15bbe120c3ad340730ae21ebab3
-
Filesize
14KB
MD5ab7867bd44b59879a59b5cb968e15668
SHA178bdff6642d5c04adb0e66461aee0553660b1c80
SHA25636141745e29b73817cf38f8a298dcee3de8338b0a0ecf82284bb9f74831296ed
SHA51200017413bc57c8af8b657621a306a53b65241f8817dfe14da7590366ad3bcc0a989ecb1e85963cab2c837be40529a2961b91a23eb7420c90e341c277a2faa86f
-
Filesize
82KB
MD5a52bdecbc1b7625cb13c9385fad4231b
SHA1614cb142fe219a056eff7d9dfd4fc79049b29b98
SHA2560ac08ac0a63f8424568f2bd6f13aac242fad6d508c6a7cb5d208f2c85a0ce11a
SHA5128e117f6f70336dfd0bfbc2da9e7b2962d69568c95bf9960d77df24688c91048187f4769437d61453792fd6ecb8464acfabb62959a140d9d108d157ec370aadbd
-
Filesize
60KB
MD5aa5f96c02b08d9b33322f3024058dd91
SHA139c1bff758d6974d90b4690b5911b4371ed91f19
SHA256cdfd368e3616d8f380dcd6750f22defe24aadbc4ab99f6e0daaea9290af96286
SHA5125cec444cb47c024f1395320ac1cbd5bc6fe8ecf5c70447f71462e85a66576e27801e3d817358fc8bbf050a752c4a51224db3c0b763b62f3773b2c86c4269cfb7
-
Filesize
77KB
MD599db9eb9678765c0ff2ff2131bc77521
SHA12fc3e2b6bebdbad0a1795136dc41409039383bb1
SHA2567360e55d14647845f75a055978b3df21d3988a42861bd82bf7e9fadc1f82043d
SHA51215d74a03cf1bc2c0dcae6c47fb5d1b7e926dc7cdd75cd852808ac81acd0c26cd90e0074f2f26869a6c342ae2107c6ab6f223f680d52e1b2113baeeeef3f8f594
-
Filesize
444KB
MD56e6d227b278b28c30ec077cbd2b82961
SHA1290a0116c15325952c9b2d99f87f474963587d9a
SHA256c381b035cb36e5efa5fae5e305b12c215d8021aa5367f22eb7edf15895c4b892
SHA5123b5e6ff7b8559ebda1699cb84bc5982aac34426f4fba048c3b453ec650ba034fbd3141211237fbcedbd2b9eaf239f49a361693ccbcd6884d51480310ea288d99
-
Filesize
1.6MB
MD5ab10b245f639aba47c60aa89662606a8
SHA14f26ff3ca983c2c5d8f1710a24c5e7eec43714a8
SHA256401d80b97e0afa71fb2c0b8a7f2fd2182fd0bc97c286245b2f01190496dc6420
SHA512a7db83bd96fb87ad2588f9b74364f55e61a16aa0936cf0e6c317fc9d542bb86a51de363e11269a3bf24b12c76f560a97ec082f687e6d2028823521fc4cb09bd8
-
Filesize
831KB
MD5e48e06f8c9569261ddea47baf1531329
SHA13f7452418f4d3b8515cdda3166401509c74756f0
SHA256ab1a99535496df21a083006a006f1321447f98558ad70a06273f4e9cdde41df4
SHA5120f97feb442158adda0e3eceef6b52519a2f1a0187aada63054811bb58da362a0a545c4e6d7efb1ae96750983328202f4b5e4a1091ca977b8a4fbc34b19bfa2f7
-
Filesize
128KB
MD51b8acb57bc92d75ae7ccbbb3a7592035
SHA107d61b1c1b93e7ade66ea8bc474534a74ef32935
SHA2565ff5616f35028d29053daf83324633e80600f3449eb810e18f3da9b2f6069b17
SHA512a02ea571080735e1393ea4f71aa509bfbc20ad84187d5bdae6c6c326934f8cde8e7946706d690776b52b28db8457fff97aedeaf9d1edd521b2c48040a7a42669
-
Filesize
1.4MB
MD582b19f13039191896d990309a70762de
SHA1256ea23347a12d607429f1ce4d82b54138a29df3
SHA25613576e7a48a435b96fe5fb06198f0e09db01d05248524dc11d38a56a2afdd43f
SHA512017ea98e63f3d70741549a387eff5a496fbd80db71fb7aba971cf3f10b17a4cacf6af644cc2c34ed95ae2e21634940a0af86be9da3b10cb30b92ffba8167e70c
-
Filesize
2.7MB
MD507c2c770a8819f847694ecb3c2954606
SHA1e89b45177e246b85b771982091c6c496b49fb59f
SHA2568cba55720852ba6a95e1ee8d2cad70fb31138eb2e5359a0745ec5b7620658ce0
SHA5125527ec970513c69e409ecc05c5ea36cff2365c60c809f8d61e3d08ff316276c8f512e61d7bdfa6fe70075b5b1649e5048b7e91c8dfc71e8b459cdb00a95c6d99
-
Filesize
402KB
MD59cf5008d6e1a07df9673311e4dcf3d41
SHA1bd33140c4d9a089c79d6d7693e9b5c111a42eeb7
SHA2561e363117252a0170e26397e2beb93cef70306e6a61d03e1f1fcf405a3c4ec027
SHA5128b8f854806007511b55d4ceeaf04f4103f204e5c44a5c551697bd2c2472c10c32f5aa2632df579bf4f6e7e0894047b8bd340cec5d6e7b516fa5a311caf8170be
-
Filesize
2.2MB
MD574cd24472f755d7b5dcc43a6e470bb04
SHA11ffd179ac74677faae53b0aebf76d02b48e6de26
SHA2562d110ec910fda488f990dc32f3b22b5432f4c33aafff820dc9557b448c8d2547
SHA512f82009e383cd45f74df0cb085c7f1a96cf3afced589e6571b8a5cdbcf66cd5cdd2b4075f8d4c57a70de0b40f955c14a34d20fcac86285509f84a6fbdcad42798
-
Filesize
477KB
MD5d84efca9307f3bc9beeac7f79d7efd50
SHA1ffa1ebb75186177045f591efd3e43a171e60fa9b
SHA256a35fe529b7a7638c89d5d9a959fffff23278047043004e28ca86f516cbf66e0d
SHA512f359071de977e99099516867b704e088b87411b785943d8c389ede0a0c6adfc510b25911a732ea1e70e52d5e22a4eefed463d56cd97a24865a64ad0fbca39fd4
-
Filesize
2.5MB
MD50dddd7335b24d795d1b91243d04c5921
SHA119cec5e2be26476a197732082661a563f3aa991f
SHA25643c5f64b5f44f4216a9959ce1c9b6c54a602f5fbfc091de3f7e8c3193612c5cc
SHA512a7d14f7527f5b3596576e358b25706dd5004c3629bfb9306ab714c53a264b801d7338f5042842cf59133677e6383adc1293b5f4048dbe12a4924d142b21c34b4
-
Filesize
5.4MB
MD5f8e28f94aca9408fc6661977beae412b
SHA168b47c92b0c2bd6155aaa6406a50a0c608fcdab4
SHA256f834e6fa96d27524d113a181cdf92e61691d9f64551d7d7709448067754b5e23
SHA512561f5d5d819ceb2949b5d4404175a9504d1c033caa890b145736b4218c323cee83a06f63f833e035079fdc979d055dc9a1d88287adfb570d36172b2a8dd1dc2f
-
Filesize
114KB
MD5a3c84c6d08a8f130343a4a1b4f7f0883
SHA117e1beff3746c10ed2ba846e81ebd5cd6d294484
SHA256107603433ae8a65b8e3369a68ba9b9fa2aabe67a4729d84f79e7eaf0bfb92c7d
SHA512273c4caf9f0d00e68afb7eb2dee232cf2ed0cac9535f989353ac5af46520ab93a78b5fcb96d1a2b40d7c2cf36dd1dc38aa2daeefe935ba5c4a356753ede5dd2e
-
Filesize
10KB
MD5a4e11b433054ba7f88ecd36321f26327
SHA1a7d01839d428b3c97c5ac8c4f8ac34dd640395dc
SHA256ed1936c775a50cc7b1b3ab4f04b331913598af370faf73f75399ae23e12b4b14
SHA512068afcaecb6ed14dcdec1518b4a60108b1ea96d3bbe33cdcfbbe9943213ce7901d69c1defe7d48d96e057c3885044fe28a2516c1486b96ab3f4acd28c8b58b3d
-
Filesize
951KB
MD5f1b01b82fedf24b1b4231b3d74874422
SHA1694b1b6cca8a2d1995f616b2b09d15ef1d05ea3c
SHA2565bf775ee94b1b8a71638e745d06b43d61bcfe3c71c77985ff95f6a506b8655cb
SHA512b9e5989aa98b133befec68eaf099ac2ae6ea7fad969c7ceed5d9aaf3e9d8e8d1394c00e592f1a246c7bdde4f5dab93ac922d3431c4a671d72716538a4ac0dab9
-
Filesize
627KB
MD53b4764cc07b825f079bebd2912c4aa32
SHA131f01de183dcfc25c238f077556302f85ebad535
SHA2565bf6178303e0f3615b55ddfd31404dcc7e6a2a4310d4dd46d0dfd4d29614dedb
SHA512a7a96d322689137cc234444a7bb538658796426ec6eeb20d37e7b8c0855a0b8745b9581dee4cf1881dd8e7925660e34ba858035cf2ff0b3e3abc7a5d920045f4
-
Filesize
6KB
MD5fb11c48f908a84e5f8a6a764237a02fd
SHA16071fe561f093543a8aeb2b4ec7218155d73a6d9
SHA2561a8b7d5167fe05cccc3ebcc12f9be6207825c0b3014811290c3a921e810e25b6
SHA51273bd5bc668cd7aa516146a1d4cf54e361026c2fb5aed09e363867a48d8ad89e4632b25b99395c4527de74d52d7a15d3f447260e7e2225558b16d1b642dc0582c
-
Filesize
12KB
MD5a5a60dd451d0076a6a5cd0201656d36c
SHA11671281d55a5d8b066950dd31686fb42dd095a00
SHA25613157ca76ec59b5fcb7669e4c4e87e38b3fbf18eda5d4db37e0d5119c3290680
SHA51267f4c8062ac80677f070d28ef82650e08adea879b473c5613c8bc1ba14ea912fe72a91dc41017932f926b9b324dd92988b12b0f2b6246a81fc3ef0bab1a64796
-
Filesize
861B
MD56d46929f4e94dceeb8ef4c1d53155ca4
SHA16536a960bd5747e2eb5cd296c241a98af3576b9d
SHA256c8748bfbfae2eeef3d738d624e3cbc5709b2edf8602528e28a692d2debe43b71
SHA5129d0890416d07657d9baaa598fc6c85eb4acd41ff8eef28a667cd2cfa6779affdeaea402ab3c9254a4c8d748285cdaab2ed284e158cbe9bf556c5116c7f21b0cb
-
Filesize
20KB
MD544530f072c1a3cc301d52570bf1fb20e
SHA1c1bb66548701eff4b8d45b85520ce4aa7a69a4a0
SHA256ace300add8513e70e1a5d7474530d4428da0ccd4adc3f07edee9844a6a2103f9
SHA512c3940613f3a387b4f12c297754e8cea3ebb59a9328301a890699066e548278f972c40b0f75ad1272cf68e7746844299fe614a7f343f9be652255b82f19ca5440
-
Filesize
43KB
MD5e1e923b6db56b15280c89a5508e2d551
SHA17b2028901f627589f508a159792663073e419b76
SHA256903dee4c9c618f6468f6e2cd1fd51fd008980081dde6d6063f116ccedc66fd5c
SHA5124e47405aa1c82ae3ecd8d5b316754936b011f4c0e2376a593ffbad468a758fd1dad0c75ee125c1f2feda5da2e2d987f624e1bee7571cf5f247a5faade17e9ece
-
Filesize
235KB
MD5a0e00a45ecb497b42bd00852a6142dbf
SHA1411459f090a9cde2154b68cf0c88af4e721df422
SHA2569f2fb6cce796f115e2b21b18ecc4d08784823290847c25bd41140a4fa87cd783
SHA512baeace51cbd05412264788c893741985b8a8ae6bb3ea0e91b68b1a129c41bb985c116b8d0846a60feff4c3f41d8737993a7ad16870fba0d2de1180c9e4e9a76f
-
Filesize
108KB
MD5b2ce49c37351d7a7471cd20c9e02b6e9
SHA144eb7732131b4b1b25ea8d023c3d2f544e017f24
SHA25676fcaccf84313bf78f523b3bc8198c2d040dabdc04a5dc863b46c8af7ac10a88
SHA51240980b050861f7c4f1ed5b71f7f7fd91052fcfc1c49b7b3490d9a4fd68fec8fd3c95af38d113aba8e7f1ce2b4ceadd1b6d66c5d1ea68064ec6265c266be1afc5
-
Filesize
26KB
MD5a84b438dbd4df29560eeb5765e03723a
SHA137de951f703687cf061556b1a52c6f548cbf779e
SHA256a576d1609cc08c46a46ce708b7fdae33452a3befb701128a5bc9d6ff1f1b6dfd
SHA512ee6855bca6ee6ff8ac7ce5c0565ccc77c35e5f1b3096f1ede2c018d3364683bc289c6c520472ba46e174fdbd821ea673bffa7dabc9358ce4c86d26f0c08fcc7c
-
Filesize
54KB
MD5580244bc805220253a87196913eb3e5e
SHA1ce6c4c18cf638f980905b9cb6710ee1fa73bb397
SHA25693fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf
SHA5122666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0
-
Filesize
704KB
MD528821456b4da368c06dd8c79343fe2f5
SHA14bbead078f7bae18588efd1fab401bd461ed4e2a
SHA256c25f63b10810df8ec754b50427b36731d89d07a54ee516617fdc9d1c3674b803
SHA5124040b0e9bd3c23ac60fedd8f8d82c78921b13096c2d57bc623651d31c14e6fc562dbf170eb003f622a3bf193d64d0adda558fef74d54459032e11cb50c8ce6b4
-
Filesize
16.9MB
MD5542b1ceeecf63ce50c30cfe549558803
SHA16229678a3cad8ea1aea0bc227c2003873a4b2585
SHA25668eb32a7dd46fdbd69e7740fcdb020773576ba8ed4dc1bad7be5d389f12c0598
SHA512286483ffa3eab6b2746ef2978ce81dbb885cb349901a9380af4a1754c414d23a57fbc504956fc6dc8b9508655d3a760c36899471917336a7f64603d932e18b83
-
Filesize
1.2MB
MD50fff6e0eb89054842230aa5b36dfd9bf
SHA1db50758d159f9da2106a86b5abd3ade8ff47ee36
SHA256d4592024e5806ad4ba3a05abef5a1ee2daf89a77c063fb06aaad74311530823c
SHA5125dc38fc39afa6fe81e9ee6596d4c0721cb8ca280b640d20d5c791133505920bb9cf928541f3fc8d7067051e6cb7f1f40287227ec14f5e26b8af512a09729bd88
-
Filesize
23.4MB
MD53743bcdb9e67a739fd73e290cef3c611
SHA15f852b348fd7e9512e0766605f72b571ce2e0a9f
SHA2565cbb881504db42a0b2b1ca29c1d33b0c1c35245f5ce31062c40b6ffb8a5079da
SHA512f0b9820ebe11dda0b7c4537c2e02bd370d2a79ced3d61a98a738f16c6aa60a01a851d723deb29930045f1f1f4b05ebf33f43b5dc8e17111131c5fb55e98ab538
-
Filesize
88B
MD54d6c668c1ca47d03526e7a093e8409e7
SHA17066779cf5b14b40a0ca38d193c065e0389a0d9e
SHA2565f82a7bc433a301b3bd42e1aa02aa8c958d39aa84f7a695b225ef95d6cb2edef
SHA512c5e40e94852f243f903d14dc29ddcda6893e052294e7edad522a7eca316bac53c89307df6e45979813995da84cac43517af16a64b76b7645400e2d73280a46a2
-
Filesize
1.8MB
MD56b888f27a6246d268dd9362915c1012b
SHA15d47c99641985d333a28105bc2feb09ec885ea96
SHA2563f2e2cdfa9f55f2e8fad7c5133915baadbc6c260a5641f17bc923c19832617c7
SHA512cff491d87c117e4a8202335a56796371cc53138a9d534e63f6e868beb13e77e1a12fec135805f999799ac070990b0071846c4c2a65d3cceacc70a4dafb264f21
-
Filesize
13KB
MD54f5a2f6a0dfea73d6928dfb8023de157
SHA1d08d8ed01c5740b8463bfd87d43c6b5ff12c5fa0
SHA256d603c6104fcb76aa282467d7b7b6a3cd0090fc72dde00786f7c8dca6d2dfe7c1
SHA512e38c122753f1ffa7889a91954cac90d3f8fd94e5ebdddcac782583871dea0cae2dbdc063c94f4743995c12c2c19d6c54855d31e4fb80e4995937a367017d37da
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
136KB
-
Filesize
968KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
10.9MB
-
Filesize
64KB
-
Filesize
5.1MB
-
Filesize
64KB
-
Filesize
848KB
-
Filesize
40KB
-
Filesize
2.7MB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
32KB
-
Filesize
4.3MB
-
Filesize
296KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
264KB
-
Filesize
72KB
-
Filesize
88KB
-
Filesize
40KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
136KB
-
Filesize
32KB
-
Filesize
464KB
-
Filesize
128KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
9.1MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
8.0MB
-
Filesize
32KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
496KB
-
Filesize
1.4MB
-
Filesize
1.8MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
224KB
-
Filesize
584KB
-
Filesize
7.7MB
