a5a1dc28621d755a63091c586d1637e035af4da1751c98afbedd667fba61c526

Resubmissions

23/04/2024, 17:35

240423-v53wasac31 6

11/04/2024, 12:44

240411-pyy1waeh5v 6

11/04/2024, 12:19

240411-phjagsee51 6

11/04/2024, 11:59

240411-n5sa8seb81 6

Analysis

max time kernel
139s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SparkControl_V3.2.0.4663_Setup.exe
Size

434.6MB
MD5

9c348b6a69eacdcc17417f3901b1e53d
SHA1

2c61a15c4876644cc3ddab44700b13654c065cf8
SHA256

a5a1dc28621d755a63091c586d1637e035af4da1751c98afbedd667fba61c526
SHA512

2f8aa3c8add398fee7201fcfe6e737bb05428bdce0e87dc58195ff2027ea013dbb3d00a41dba962d3d898d15755d13b72f4ddf8c741831dde4283225a4a55e61
SSDEEP

12582912:xx5xH3JoQ9m2IP0P49BkZXPBk4TeKIQr1ww4F7aLvoTOLAmErCcxBAvm5W4qEe5I:xxjH3JoQ9m2IP0A9BkZ5k4THr1wHF7a8

Score

6^/10

discovery evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SparkControl_V3.2.0.4663_Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
3248	SparkControl_V3.2.0.4663_Setup.exe

Loads dropped DLL 5 IoCs

pid	Process
3248	SparkControl_V3.2.0.4663_Setup.exe
3248	SparkControl_V3.2.0.4663_Setup.exe
3248	SparkControl_V3.2.0.4663_Setup.exe
3248	SparkControl_V3.2.0.4663_Setup.exe
3248	SparkControl_V3.2.0.4663_Setup.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4972	3248	WerFault.exe	91
2320	3248	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3248	3100	SparkControl_V3.2.0.4663_Setup.exe	91
PID 3100 wrote to memory of 3248	3100	SparkControl_V3.2.0.4663_Setup.exe	91
PID 3100 wrote to memory of 3248	3100	SparkControl_V3.2.0.4663_Setup.exe	91

C:\Users\Admin\AppData\Local\Temp\SparkControl_V3.2.0.4663_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\SparkControl_V3.2.0.4663_Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\AppData\Local\Temp\{3FAC87C3-E0CF-409A-BBC4-083DE2618EF2}\.cr\SparkControl_V3.2.0.4663_Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\{3FAC87C3-E0CF-409A-BBC4-083DE2618EF2}\.cr\SparkControl_V3.2.0.4663_Setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\SparkControl_V3.2.0.4663_Setup.exe"
  2⤵
  - Checks whether UAC is enabled
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1480
    3⤵
    - Program crash
    PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1464
    3⤵
    - Program crash
    PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5012 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3248 -ip 3248
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3248 -ip 3248
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{3FAC87C3-E0CF-409A-BBC4-083DE2618EF2}\.cr\SparkControl_V3.2.0.4663_Setup.exe

Filesize
718KB

MD5
7f87b65007018d8a50d451593303bc62

SHA1
78888623b648f4ae8f4a74817e3ff1bbf2f15b4f

SHA256
e828e5f8177258cba473621f7d254ccce9466c9660ffaba0aa08ae33278e8cb7

SHA512
7087ab18f94f5d535b216df8f09f3d40e5c21aa055ad8c43a404e308aab35642b09a5d883e3219de4f928e5ac45c3f5e2c6bde5e0758732186134c611b5d1869

Download Submit
C:\Users\Admin\AppData\Local\Temp\{65EF6985-06CA-414E-8AE9-2E377BBB2B9A}\.ba\BootstrapperCore.config

Filesize
723B

MD5
78ded86fd983e8038a10b45818156a20

SHA1
d306f5ee3aec3c10a0888d9f9b0c7fe68ff8ba4c

SHA256
555e73c5bce79c8b7173f00b402fe38c1e2b3bc54af318d5253461469ad2a704

SHA512
8a83cd4539dfffa2fefd36e91519d95881c45d91fdd78c8da0744f377d88babc31c7c2ace8fa94bf84364d6c9a3c7c29fe00372b2392267be73853698650c537

Download Submit
C:\Users\Admin\AppData\Local\Temp\{65EF6985-06CA-414E-8AE9-2E377BBB2B9A}\.ba\BootstrapperCore.dll

Filesize
80KB

MD5
6ec4f758cf5aaff961998e3e91fda644

SHA1
34fb5a54ab65da1e11bbb8bce1e422e362338da7

SHA256
e5b064589d741bdbac1f45be8867d62551ef3a36868db0cafe98f0ca483421ba

SHA512
025fc05b0a9768354692624ad8db4fe4a80945dace304bf475f89d45873b2fe93fa464360d09b075d8ac81f60f9aba2b3d7933fb4272f649b496767d2727fe9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{65EF6985-06CA-414E-8AE9-2E377BBB2B9A}\.ba\Tecan.At.Dragonfly.WixBundleUI.dll

Filesize
111KB

MD5
3891be0e321acad81706080c842b6cf3

SHA1
dc552f82aa4eb4ce53de04bf86d4a355bc1241b2

SHA256
e95f9507b9625877ddec0e8878c3aa6e9058d19cd75a0636730aa903c5277b6e

SHA512
f7a7a2696b4be513dd9b0e5b5556fef2a046100b9cec6b9a7274f3e16181c334863c59472197ece8ca8ce3094784df94ee2110c835043572486371555ae55956

Download Submit
C:\Users\Admin\AppData\Local\Temp\{65EF6985-06CA-414E-8AE9-2E377BBB2B9A}\.ba\mbahost.dll

Filesize
109KB

MD5
1256e752d8c35dd3c3e3563562879ddf

SHA1
c4e8d13931f0e18bd6f6e9a8f618548fe4b58aea

SHA256
6adc2a6b25dea73648e6df7c311d291862fca06b2a907af33b76fd2dd9ff12f7

SHA512
00de447d37a2aa622fdba3eba18fa2ca6476127bde147f7aa82481eee3d8c43462439ef1d6892eaca85eaa111ba99f5771f5c8d9d8f7cdd591284ee02fd2fb3f

Download Submit
memory/3248-43-0x0000000073550000-0x0000000073D00000-memory.dmp

Filesize
7.7MB

Download
memory/3248-44-0x0000000005F50000-0x0000000005F60000-memory.dmp

Filesize
64KB

Download
memory/3248-49-0x0000000002B50000-0x0000000002B68000-memory.dmp

Filesize
96KB

Download
memory/3248-50-0x0000000005F50000-0x0000000005F60000-memory.dmp

Filesize
64KB

Download
memory/3248-57-0x0000000005F10000-0x0000000005F32000-memory.dmp

Filesize
136KB

Download
memory/3248-59-0x0000000073550000-0x0000000073D00000-memory.dmp

Filesize
7.7MB

Download