Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-03-2024 16:25

General

  • Target

    MainInstallerAutoEmbedded.exe

  • Size

    796KB

  • MD5

    7fc6bc14a74dc69773587af10132d8c9

  • SHA1

    9d98b268eaa7f4ad208bde39944fdb1ab201e076

  • SHA256

    e288d49f6011dcd3f893e54ceafda9b6b491543966521c483064a7df43e5bdd2

  • SHA512

    a738205fb26bf259e70b1cacfd10f9168d381778ef90a49847b8d332d93b471cbdcf6357a3d2dfb2e41a4666cba98dd9dc2867a20d472636e5fc8080cc073742

  • SSDEEP

    24576:P7yrmq17YLUAl1+O50aT+1bXkS/EZQM7G7ZQ51bmtfWR163i95cVmB:jgbyLV1ILT/ES46S5Bmted6VmB

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe
    "C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe
      C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe /PID=0 /NOTIFY=0 /FFR=1 /FFP=0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1288
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2132,i,4018525042804461719,1997165676266557055,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3112

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe

      Filesize

      512KB

      MD5

      ff0198fd1f59b71c1deec34b6b0b0c07

      SHA1

      cae622ad91a3bab0996589e3bf905c9d4eeb6059

      SHA256

      f552d818f17841efb7f06803ecd2479fe5c9b2a0d3c4dad2c9d90b42e2e9d7d5

      SHA512

      96795276eefcde81b0ad4ac85f4aaec368cb93bd9e9912c343316912f1502f3a22d845af3ba75ea5aa92b1936028558d48c11a77d331d49bd77f58b886868ccc

    • C:\Users\Admin\AppData\Local\Temp\nscF1D3.tmp\InstallOptions.dll

      Filesize

      14KB

      MD5

      325b008aec81e5aaa57096f05d4212b5

      SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

      SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

      SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • C:\Users\Admin\AppData\Local\Temp\nscF1D3.tmp\ioSpecial.ini

      Filesize

      694B

      MD5

      f1352feaf0f4e62ee471768f662d90c1

      SHA1

      e244e0b705524ace3ede07f7866d0b88dee1e1e9

      SHA256

      bd5dcf82d608d12e4ef14ffbfbe86c275dddcd292e256617d5ff4d9d2e772a6e

      SHA512

      5f1893745fa04c158d3f0d693b4ebcbab6b9e5b3169c4e7186888ea8c99494b88e01b3e46e1b3731da5dd7cc034f27e412543d3dce1b8750d892adbd6ad1cfb1

    • C:\Users\Admin\AppData\Local\Temp\nsrF0AA.tmp\System.dll

      Filesize

      11KB

      MD5

      c17103ae9072a06da581dec998343fc1

      SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

      SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

      SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f