07a4c72903c22343938a9f3151b2e5a7f272eba8c3c79c2a36c0b1347473b438

Analysis

max time kernel
99s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

2.3MB
MD5

36cb2865742f095aba20bfeb868f8e1f
SHA1

41418696704ac3028e34b5e8bdc8ea7e97800da6
SHA256

07a4c72903c22343938a9f3151b2e5a7f272eba8c3c79c2a36c0b1347473b438
SHA512

5746f34052e28f46471b9c632e731878f9d4076eb1a958acbe3eb2d900f5e56a33214cd4dd0dcd7ae010ee49efff99ae8daf27ca25e2889a5a0a4aa9877c815d
SSDEEP

49152:HqUsn4CcPKJXjvC+cp9w+/KvxQtFPsaXPI0Mrp:KUIxcPAX7C+m/KQtjPI0Ml

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5112	setup.tmp
984	unins000.exe
872	_iu14D2N.tmp

Loads dropped DLL 6 IoCs

pid	Process
5112	setup.tmp
5112	setup.tmp
5112	setup.tmp
5112	setup.tmp
5112	setup.tmp
5112	setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5112	setup.tmp
5112	setup.tmp

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5112	setup.tmp
5112	setup.tmp
872	_iu14D2N.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 5112	3092	setup.exe	90
PID 3092 wrote to memory of 5112	3092	setup.exe	90
PID 3092 wrote to memory of 5112	3092	setup.exe	90
PID 5112 wrote to memory of 984	5112	setup.tmp	106
PID 5112 wrote to memory of 984	5112	setup.tmp	106
PID 5112 wrote to memory of 984	5112	setup.tmp	106
PID 984 wrote to memory of 872	984	unins000.exe	107
PID 984 wrote to memory of 872	984	unins000.exe	107
PID 984 wrote to memory of 872	984	unins000.exe	107

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Users\Admin\AppData\Local\Temp\is-51T9V.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-51T9V.tmp\setup.tmp" /SL5="$A0066,1797722,677376,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Games\House Party\unins000.exe
    "C:\Games\House Party\unins000.exe" /VERYSILENT /NODELSAVE
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\House Party\unins000.exe" /FIRSTPHASEWND=$2024C /VERYSILENT /NODELSAVE
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Games\House Party\unins000.dat

Filesize
23KB

MD5
fa9a1dbce605d4bd6f772202a2241095

SHA1
880684c5cb635a37173f9826a7921d03ddff9cf6

SHA256
861f7ed7b1309a3cad32e4b870e6d92d33414e66a57d3e84a7f00ebd3d9bf7f8

SHA512
a2055464a2ef8ec72c2c72f7583fba9abfca73416c8a1c730180e89e7670a14b1f396826809befc1f73ccc8f74929e2ddda66dc6a3a82eb1e40f1175610eeab9

Download Submit
C:\Games\House Party\unins000.exe

Filesize
1.7MB

MD5
f1fc220b7a95480f0d1cc32e42183d29

SHA1
2a921981df9adeba655451d151a81271d40bf191

SHA256
b60bc23c507dafad893ce8b7cb8de29620b6efdb8b8d83189b2b2034d587f866

SHA512
cce574c67cccfb876aab70bc678fe7c40b7611255eec3f3ae0e2218925b28fb5799991349880200dca4cb0dad209b548c98561390311fc4ff25e57aa9c60bf89

Download Submit
C:\Games\House Party\unins000.exe

Filesize
1.3MB

MD5
ae4ee45ea3dd86b59585b4bb907370b4

SHA1
bc37f1c2f9d0cb294a085532c88b1ca3b9202dd0

SHA256
2fcc1d45619f39faaf4385fdb1e0170cca1efc492cfe485669dc6b33a4659558

SHA512
8b31d62f30d2e50158ec958a4e1b9a89b4e63806a1c9d05d1f631167542919c22eba2d0e64e51bea72ec83615c676bfd7ad0f73d4f7bd11e0611bfaea9cb4a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
1.1MB

MD5
2a937a3917ed8b021674ce37cdd37574

SHA1
9752e25762cd9126fc839ea6b2715e60a3c38913

SHA256
0707e9d0d892e1b6ddb587f24681b698a2ac8b1fc73a5373a069796f188be8fd

SHA512
0683e0911d31f61b16231b8372cd55653ca5e799ca22711ca02e524871bb934100920252da0edbfb7a114f3a452488d4b372077b06fe594b721a9e2af373bd7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
1.2MB

MD5
17eac3823c4c3b482b0789fb76bc987f

SHA1
73521e349b144b54bcd2de3a5b6c87a1259ea6d9

SHA256
a1828ea22085c5171f096800edb17d19f54670381aba644342903308ac31f964

SHA512
6b376cf5ccbddc13e147e71133fcf8a685d7d88595603b670579cfedfc98627d30219093dfe4e71bba2c856248c6d0d2bac95a7e67dc9e3186c09694219e7fd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
1.0MB

MD5
0053ee67d45c4da09c31938c673c35c5

SHA1
ea89cc724ab485712b3d55d78afb4d7f93e1e557

SHA256
82dc16777163fc2ce826fe8a851e25d436913285e7adfe8a0eef96e985fd2805

SHA512
9aae21721f5af5f2bb828576843b2105c56e14aec1e132dcd8c911f1775bc84fd5178f47909cf357467e952fe8ba2d06354a2154567bc4d1760af6b7074a9b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-51T9V.tmp\setup.tmp

Filesize
1.7MB

MD5
396948c5280f871a33884f67cae59080

SHA1
1719c7a22cf994970cb3e1af1d0be60223a2393a

SHA256
7c5620b745d52b426c2caa9ca2f2058a88ef0a5c1316b7eb0f9e32d102dac63b

SHA512
ac8f81aafdd92bb9871c3f056f31fb84481d04debd8b74e7d06a7f57e519bfa60b30b17ef4ba3cbb75b6e74f8863cc63c300611b9a35ca74ceb547b69c0b4fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BSU1H.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HF0VP.tmp\ISDone.dll

Filesize
452KB

MD5
4feafa8b5e8cdb349125c8af0ac43974

SHA1
7f17e5e1b088fc73690888b215962fbcd395c9bd

SHA256
bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71

SHA512
d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HF0VP.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HF0VP.tmp\callbackctrl.dll

Filesize
4KB

MD5
f07e819ba2e46a897cfabf816d7557b2

SHA1
8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

SHA256
68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

SHA512
7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HF0VP.tmp\wintb.dll

Filesize
16KB

MD5
9436df49e08c83bad8ddc906478c2041

SHA1
a4fa6bdd2fe146fda2e78fdbab355797f53b7dce

SHA256
1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435

SHA512
f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf

Download Submit
memory/872-87-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/872-98-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/984-83-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/984-93-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/3092-40-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3092-0-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3092-123-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/5112-41-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/5112-48-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/5112-42-0x00000000033F0000-0x0000000003467000-memory.dmp

Filesize
476KB

Download
memory/5112-43-0x000000006B080000-0x000000006B08D000-memory.dmp

Filesize
52KB

Download
memory/5112-56-0x000000006B080000-0x000000006B08D000-memory.dmp

Filesize
52KB

Download
memory/5112-89-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/5112-51-0x00000000033F0000-0x0000000003467000-memory.dmp

Filesize
476KB

Download
memory/5112-95-0x000000006B080000-0x000000006B08D000-memory.dmp

Filesize
52KB

Download
memory/5112-19-0x00000000033F0000-0x0000000003467000-memory.dmp

Filesize
476KB

Download
memory/5112-94-0x00000000033F0000-0x0000000003467000-memory.dmp

Filesize
476KB

Download
memory/5112-6-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/5112-122-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/5112-54-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download