Analysis
-
max time kernel
73s -
max time network
80s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/03/2024, 18:42
General
-
Target
driver4vr-setup.exe
-
Size
43.3MB
-
MD5
f5008c8fd276499ece97684b0a017b85
-
SHA1
eb92df78711ae4abed2d50fa420bd33b36f46bed
-
SHA256
e41a9902c27177517b5216d8e591c5dd3672710eeb57a5b73640b6b49590aeee
-
SHA512
0a49a84cfef12ab2853191bb19e0e9de20966b810151f8e565f124f148cfa24f0cb274336348da20996a15d298eabaf30b82712ca33759064b0295ca7ba58fbd
-
SSDEEP
786432:s702wAPJDuZA+oHESD8ZLjIleSjI/BBjbZ1tWc4Df0Oo0tctwJlEEuFIkad:oVV5uZ4FIKebbrcce9FctOlrtks
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 19 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\driver4vr-setup.exe"C:\Users\Admin\AppData\Local\Temp\driver4vr-setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GRM19.tmp\driver4vr-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-GRM19.tmp\driver4vr-setup.tmp" /SL5="$4010A,45134229,57856,C:\Users\Admin\AppData\Local\Temp\driver4vr-setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Driver4VR\Installer.exe"C:\Program Files (x86)\Driver4VR\Installer.exe" /installer3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\Driver4VR\Driver4VR.exe"C:\Program Files (x86)\Driver4VR\Driver4VR.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640KB
MD58e7ee8d17bd37af6ca6b6bd9ff5327da
SHA1a3ea47300d3a9baf4dd0f8e7eaaa691dd19199bf
SHA256f8221bd86961fa3e47052519c19a2a0e3c264af8f5cc65daaeb6b7502787ca93
SHA512f390f27bc9f985ff9114b4883069bb1d273ce8e9c1fa3a0c3f3d7d3942f7e69f74b4c95690b0aa37f358e99e59eb8ecd3fe9cefa759e1957c5bf94f1fbad1f81
-
Filesize
686KB
MD5875652af2c5f9a4ceb31d6b5ec54c6f6
SHA131c7e2149afe6190ec26015771578914caa55ea3
SHA25609edcc6e607476a417c80dc369da16dec005e50bec41cc56f325be1dcbd26e74
SHA512782c82b536777f80e956dc296429b7c129227a32670e330cff41465a3ced7821f7e8ae8ccd60151b0e8774f3723ed433f42688698830370410cc580a0adda3ba
-
Filesize
638KB
MD5f33cbe589b769956284868104686cc2d
SHA12fb0be100de03680fc4309c9fa5a29e69397a980
SHA256973fd70ce48e5ac433a101b42871680c51e2feba2aeec3d400dea4115af3a278
SHA512ffd65f6487bc71c967abcf90a666080c67b8db010d5282d2060c9d87a9828519a14f5d3a6fe76d81e1d3251c2104a2e9e6186af0effd5f331b1342682811ebf4
-
Filesize
370B
MD5b34d3baddf9462c1770d3aeab97a0840
SHA1995835b16dd0f66d12ba41380dce827ff64700d1
SHA2567bb5a14c5e86a9c945a9705f6f5175a97b4247b55451b76cf088988a350572f8
SHA512a029572aafcb7a11829f2451c881ca1783af2c2728bcf6bada3a15263bff9e48f9b4d63bee7c752a6efec58941efb4b7055de275f7b79a944efaab7ccdedc8b3
-
Filesize
256KB
MD58dcbf2032b41ffbb10a54a4c7c1dd77e
SHA13de4640c71da9af98e7022b72b55251122f02ea6
SHA25669b73d05cbdde8aae9234c5ffd90bb52c9a3d9210399d06f474d0798e35d5081
SHA512d54208b40e2ac4ac22eccbb874fb75c2beb1b272e1f04644dadc86e04a2f948a1011abb28dab8bf4fd20b2f07377119c6625eb668f98510502fec9174ed51ab1
-
Filesize
2.2MB
MD51c7965af8c761efd7748b2ac8cbb186a
SHA1831bdf62fe74273c393b41e9672a3a6017caa464
SHA25677b49db2ef393e19a5641e857ceec57c221243c4aa743df163575ab7acf95109
SHA5124d05b7eaef954ba2d337a5c07e7de2e7508c53cdb97d36cb674f5ab727cbdaf76d881b9a2cfa027067723115482db84cf70b4ef94f516550e073bdc57427a429
-
Filesize
2.1MB
MD5b112380305f9645214eaed703e726c71
SHA1ba9cdaac45304841d06da6b9ed6a36b7cee3f972
SHA256fe803f6d942e6c5b57d678442873d3651336cde8949b94d9776be4c2525db1e1
SHA5128bc7d6f1b4bab89a96ef58c16f2bac4814d31f5580b8b89c56fab4c0e83e491a0216feaf0715b2e1e7e4471abd808a816ce802425b39312a636b37a903a448ba
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
3.9MB
MD5fe21ae996e4d6e94349fd078ec90a41f
SHA14bfcd1579be825f31b2685910a4784c27c6b4968
SHA256dd557d8271ae230d90a52086ef231906d206359449a9f7ce259741270919bb95
SHA51262ab97d4822501eb2c4f6f90f4658246d8015ce6f3119ca64b508dacc07780227899009c0fb533fe40bca0442546fdcd8dbad6f0e31af73a2a7adb87d72a57d2
-
Filesize
960KB
MD5516bf5e0ddb8738cec892624fbef55d9
SHA1d757f7f4862515afc95b7762eba452ee8005fe5b
SHA256abf78551d4809aea063ee119cee8cc1a0f611efe972303969a115f99f1cfacbc
SHA512be3aa79056b4f634039dd12b3b0aba0435a77589ff4a641cc28d4c7ea143efe9d4bf1074d752d2f31141142de044a823db07b69e180d96ddf37d3acc68a59c14
-
Filesize
185KB
MD560599998b17bd2b880757f4e09daa4d4
SHA1f3e836cac13bb812c917b2dd1d9a0522622510e4
SHA25653ace2e0b337a1db793a1c62ba3216af2407c353f382ef0e6986258b86965edd
SHA51237573969efa5337ecae02cd152245297eed5c8f0b316d7a1704dfe1637345c3be8a36304d263ad269838877c8720eda739294912ebcbf544e81b9f0212eef740
-
Filesize
48KB
MD572c3f5bf5c3dc58a2b583d17b78de551
SHA165697ec498b1cdb6391252ff6d63fabff0adce06
SHA25624876e61a6936acebc086227cdd916f40d1d55813e61c2918e10d4d8e8cfdbb3
SHA512f403a46ebd07f735d22bddcd2b65473e9d0328b3dc4b1809f20b6d8e58cf4e6e03404746423dcd12d85ce82e9407da429048f74b1e207fd3b85560ddc45949e5
-
Filesize
156KB
MD5958df4238ddb86a116acbfceb39c4c93
SHA12f89c0234eaafc94407db781f2253d77760e3e1b
SHA256ab19f6647a0283f40f76a9d970ce7929907472a44689dcbc342c194e502e022e
SHA5128ea0e6e9787541fa1980b96c048975921955bff7b0bd4cdf66a55c45ef19e17e472c2bc9caa9d0b7bcba1233b390066034d516cf050e8670f67a763b5cd321ed
-
Filesize
128KB
MD5b9ac289d8d173b095cd1a86646831f7b
SHA14d4697770679f690486f46c429fabf555c78c2b5
SHA2563aa8b31da2944489b1914e480e0a55176b9d73795796c787ef7eef967497026d
SHA5122bc3c9aded9b0c2deb5a602aeffcc0e823db8a935cc44f4006126c0b73f0fb0d5aeabd7605c71bfbf040f7014b990f3a8e608a657287c20d70de51eed1f9565b
-
Filesize
2.1MB
MD52c8d8a9932403509f765be1ea130f102
SHA15cd917773b6d41c8ac13bc5922e12c9aa6acc647
SHA256fc766393a0b25953e7a60809c684d6c1ca7f1c3925b3d58342f8500adbb51677
SHA51278620eaab71a92ba57ec9a0e47ec62c72f699cc5a5524fc5d19fcb9d263cfc8d9b89d641248542f7e974df9325ee3ed6a5b40fecb4a384fa7c4616137c134ca1
-
Filesize
605KB
MD518920afd13872383f9aa1893fce4a575
SHA174728ded8f77a8db172ddde019575c9c05dd675e
SHA256aa0a585e4b6417669c2e4bad674b2c8c83584645d44c24d88915678c59d569ff
SHA51208c8993d89c104ce80460a447fbbaf302c155444b9a72970e634c62dacfa2b0e12400c480677eaccc6487afd131db3451633db02e4bfc5e3ea8bbc20c458b859
-
Filesize
2.2MB
MD5462de0f2feb4fe6719f277bb28abbeea
SHA187956725b4e0e3360865c62836a465ff99c99133
SHA256964b8203d2c06739c0e5c09d82106440b8be17bea7ab9cfba7afe0859574ea41
SHA512e7418fa0db3754b00b2e54c0e0df396d286f94a509358220fbc9b9370d98541644deaddde5cb35ff2d35ddb6c3d781e5bbfadba1577da14cdfc03cbbb2840543
-
Filesize
83KB
MD53170dfbc38a0bb57382d898386f70ad4
SHA168615290fd840778498a42eaf9d28dc8c93b961d
SHA256e4d5a1842d65e99581e52225e0af6455e078e95b3ea3d3b49f673e4d5168b82d
SHA51269e71251e36e266bb2d1079cbf7a56a4db2efba54dc473eee4db7966af97c29dae977cdd75ea63818b2ac2cec1fb8af6b42b5d36732b9c0e2419fee138dad7ad
-
Filesize
702KB
MD5335e83c746fce622daee2dbeeb2d6220
SHA14d73b362a701fc579d0e786c67e690c6cef2581b
SHA2565566d1e064e096636dd49f10643192d1cae01500e25774a1b4931568daf7c83c
SHA512cda99c70c273e07bcc9e82621d0e2a899f74a5933c78f5b2bd89fc5edca51763b29b403a5077b641820bee32eb840678ed1b0dec505a010e57129cbb8aa41775
-
Filesize
208KB
-
Filesize
664KB
-
Filesize
168KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
40KB
-
Filesize
512KB
-
Filesize
24KB
-
Filesize
9.9MB
-
Filesize
208KB
-
Filesize
40KB
-
Filesize
8.8MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
712KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
28.8MB
-
Filesize
9.9MB
-
Filesize
28.8MB
-
Filesize
512KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
760KB
-
Filesize
760KB