Analysis
-
max time kernel
99s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2024 23:09
Static task
static1
Behavioral task
behavioral1
Sample
Full_Setup_Installer.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Full_Setup_Installer.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral3
Sample
Installer_X_v5.7.0.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Installer_X_v5.7.0.exe
Resource
win10v2004-20240226-en
General
-
Target
Full_Setup_Installer.exe
-
Size
84.3MB
-
MD5
8b624521d1738fbcc41d3579c69154bd
-
SHA1
619ea5848b7bd644cd547d50a6c89dd3b8e17c4c
-
SHA256
6518ca0d69133ff622a3d6e168caf6edec6abc20ecfdbf9444043a7e79c7caa0
-
SHA512
6b637f6dcfadc04ccf3fb14fbd2bbc2b8fddcfef09dc90e7dbae60fae076ab50025de57b4cbeb152755377735a88cc6f80e1df8c7c8ba6ddaf300ae37181a57c
-
SSDEEP
1572864:K+xiGHpY6LR9w6BCv83y6RuHJKfx/JrL/jqL++9DpkXCWqVDu0xXEpB:K+hzD8wneKfxxDm++DK6VDX6
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Installer_X_v5.7.0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation Installer_X_v5.7.0.exe -
Executes dropped EXE 2 IoCs
Processes:
Installer_X_v5.7.0.exeInstaller-Master_v9.2.exepid process 1404 Installer_X_v5.7.0.exe 1452 Installer-Master_v9.2.exe -
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
Processes:
flow ioc 70 https://jira.ops.aol.com/secure/attachment/688199/failwhale.html -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4996 3576 WerFault.exe AppLaunch.exe 1588 3576 WerFault.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Installer-Master_v9.2.exepid process 1452 Installer-Master_v9.2.exe 1452 Installer-Master_v9.2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Installer-Master_v9.2.exedescription pid process Token: SeDebugPrivilege 1452 Installer-Master_v9.2.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Full_Setup_Installer.exeInstaller_X_v5.7.0.exeInstaller-Master_v9.2.exedescription pid process target process PID 2220 wrote to memory of 1404 2220 Full_Setup_Installer.exe Installer_X_v5.7.0.exe PID 2220 wrote to memory of 1404 2220 Full_Setup_Installer.exe Installer_X_v5.7.0.exe PID 2220 wrote to memory of 1404 2220 Full_Setup_Installer.exe Installer_X_v5.7.0.exe PID 1404 wrote to memory of 1452 1404 Installer_X_v5.7.0.exe Installer-Master_v9.2.exe PID 1404 wrote to memory of 1452 1404 Installer_X_v5.7.0.exe Installer-Master_v9.2.exe PID 1404 wrote to memory of 1452 1404 Installer_X_v5.7.0.exe Installer-Master_v9.2.exe PID 1452 wrote to memory of 4312 1452 Installer-Master_v9.2.exe powershell.exe PID 1452 wrote to memory of 4312 1452 Installer-Master_v9.2.exe powershell.exe PID 1452 wrote to memory of 4312 1452 Installer-Master_v9.2.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Full_Setup_Installer.exe"C:\Users\Admin\AppData\Local\Temp\Full_Setup_Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\Installer_X_v5.7.0\Installer_X_v5.7.0.exe"C:\Users\Admin\AppData\Local\Temp\Installer_X_v5.7.0\Installer_X_v5.7.0.exe" -p4rQNPWchybWdMZ2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer-Master_v9.2.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer-Master_v9.2.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"4⤵PID:4312
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe5⤵PID:3576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 4526⤵
- Program crash
PID:4996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 4286⤵
- Program crash
PID:1588
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:81⤵PID:4916
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"1⤵PID:2948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3576 -ip 35761⤵PID:2984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3576 -ip 35761⤵PID:4864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Installer_X_v5.7.0\Installer_X_v5.7.0.exeFilesize
83.1MB
MD50b6171cf84209d1441665c06ce80c339
SHA1fe2d66a3009497846fb928392d7a10cb4d9671bb
SHA2562e8b04e706c5dfc026de790dbcbac568063d7dfddf5f4d7592751435518adf8f
SHA5129e640a4a0e6f8deec738b37642d812fa4f4243a43b9bd29c4f2cc80314962586a0b997e92ccfd411886ad25741d324e00d3c7989d24efae957f81108768aff16
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer-Master_v9.2.exeFilesize
526.7MB
MD5a720c915abbe7a1e4f5ac3c06f669651
SHA17386123f8dbdf3f44542ef1639e967d242bf63b2
SHA256ab9d409b0b7292f719acb588af69294bb675d253c27d66efafe85552070d718f
SHA512def9579cea13298dc4b023ef23aa7dc3c293152d7e203321a4f5786ff44c50ba14bf53124229a692a7b1aa1a885ad61e564fb9d218f960eeb4663a96848223a0
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer-Master_v9.2.exeFilesize
328.9MB
MD5f7c9d8c05b3fe34e1b352a6b4b7f1011
SHA196d7b1783b07309287c334e33e284cb5cb7e0e27
SHA256c563a4b6fe19454570423e2ec898d8ab4b19540ee56597c37913ca3b33a05996
SHA5127f9df1fc6c1f3f428980db4d3cb4116f88ce3403a09eed799e22cba4657ecad9ae28346c86f5c322b60033d92d79194474347a2460b7fb118d2f1115f1c40f3a
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer-Master_v9.2.exeFilesize
388.1MB
MD56e436233d711372fb4d6db28dd01d383
SHA1da1aae79a42bc79990d6df485f28fca65429f302
SHA256db146d906dfc6d729e69fc4733a5f5b7c5c3ca7c679fe805e42c9c8ba05a015a
SHA51260b2a9e8a5b4c66661769913c22842d4686df72a7a8efdbfcabffa9014184bd0e6e3096337228bcc173a3da51739fe004be277c29afbcab1d78990131b715fa1
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n4ng1uai.2d5.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1452-27-0x00000000317A0000-0x00000000317AA000-memory.dmpFilesize
40KB
-
memory/1452-31-0x0000000031650000-0x0000000031660000-memory.dmpFilesize
64KB
-
memory/1452-24-0x0000000031C10000-0x00000000321B4000-memory.dmpFilesize
5.6MB
-
memory/1452-25-0x00000000315A0000-0x0000000031632000-memory.dmpFilesize
584KB
-
memory/1452-26-0x0000000031810000-0x00000000319B6000-memory.dmpFilesize
1.6MB
-
memory/1452-22-0x0000000000600000-0x0000000001600000-memory.dmpFilesize
16.0MB
-
memory/1452-28-0x000000003FB10000-0x000000003FB76000-memory.dmpFilesize
408KB
-
memory/1452-29-0x0000000040020000-0x00000000400BC000-memory.dmpFilesize
624KB
-
memory/1452-30-0x0000000073080000-0x0000000073830000-memory.dmpFilesize
7.7MB
-
memory/1452-23-0x0000000031650000-0x0000000031660000-memory.dmpFilesize
64KB
-
memory/1452-21-0x0000000073080000-0x0000000073830000-memory.dmpFilesize
7.7MB
-
memory/1452-78-0x0000000073080000-0x0000000073830000-memory.dmpFilesize
7.7MB
-
memory/2948-75-0x00000000767E0000-0x00000000769F5000-memory.dmpFilesize
2.1MB
-
memory/2948-74-0x0000000002900000-0x0000000002D00000-memory.dmpFilesize
4.0MB
-
memory/2948-72-0x00007FFFFA6D0000-0x00007FFFFA8C5000-memory.dmpFilesize
2.0MB
-
memory/2948-71-0x0000000002900000-0x0000000002D00000-memory.dmpFilesize
4.0MB
-
memory/2948-69-0x0000000000BC0000-0x0000000000BC9000-memory.dmpFilesize
36KB
-
memory/2948-79-0x0000000002900000-0x0000000002D00000-memory.dmpFilesize
4.0MB
-
memory/3576-63-0x0000000016610000-0x0000000016A10000-memory.dmpFilesize
4.0MB
-
memory/3576-61-0x0000000000D70000-0x0000000000DDE000-memory.dmpFilesize
440KB
-
memory/3576-80-0x0000000016610000-0x0000000016A10000-memory.dmpFilesize
4.0MB
-
memory/3576-68-0x00000000767E0000-0x00000000769F5000-memory.dmpFilesize
2.1MB
-
memory/3576-66-0x0000000016610000-0x0000000016A10000-memory.dmpFilesize
4.0MB
-
memory/3576-65-0x00007FFFFA6D0000-0x00007FFFFA8C5000-memory.dmpFilesize
2.0MB
-
memory/3576-64-0x0000000016610000-0x0000000016A10000-memory.dmpFilesize
4.0MB
-
memory/3576-62-0x0000000016610000-0x0000000016A10000-memory.dmpFilesize
4.0MB
-
memory/4312-48-0x0000000005C40000-0x0000000005F94000-memory.dmpFilesize
3.3MB
-
memory/4312-51-0x00000000067D0000-0x0000000006814000-memory.dmpFilesize
272KB
-
memory/4312-58-0x0000000018310000-0x0000000018332000-memory.dmpFilesize
136KB
-
memory/4312-56-0x0000000007910000-0x00000000079F8000-memory.dmpFilesize
928KB
-
memory/4312-54-0x0000000007C50000-0x00000000082CA000-memory.dmpFilesize
6.5MB
-
memory/4312-49-0x0000000006250000-0x000000000626E000-memory.dmpFilesize
120KB
-
memory/4312-55-0x00000000075F0000-0x000000000760A000-memory.dmpFilesize
104KB
-
memory/4312-53-0x0000000007550000-0x00000000075C6000-memory.dmpFilesize
472KB
-
memory/4312-52-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/4312-57-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/4312-38-0x0000000005B60000-0x0000000005BC6000-memory.dmpFilesize
408KB
-
memory/4312-37-0x0000000005A90000-0x0000000005AB2000-memory.dmpFilesize
136KB
-
memory/4312-36-0x0000000005320000-0x0000000005948000-memory.dmpFilesize
6.2MB
-
memory/4312-33-0x0000000073080000-0x0000000073830000-memory.dmpFilesize
7.7MB
-
memory/4312-35-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/4312-76-0x0000000073080000-0x0000000073830000-memory.dmpFilesize
7.7MB
-
memory/4312-34-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/4312-32-0x0000000004CB0000-0x0000000004CE6000-memory.dmpFilesize
216KB
-
memory/4312-50-0x0000000006570000-0x00000000065BC000-memory.dmpFilesize
304KB