Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-05-2024 02:25

General

  • Target

    Setup.exe

  • Size

    6.2MB

  • MD5

    b4bf098c6c8ec941f7a1dde3789f65bc

  • SHA1

    cceac8c47843d1097ba36cdea2540abaa591ecfa

  • SHA256

    e1a094176491255c48e5220db3f97b160532bf90abca149c767a4cfb6e6e1ed5

  • SHA512

    824d1dcfcdcbaf2afda198c3c9ad7f2e26644deaaed54e7f3c1ac2a5d2e3ce8caefb8d9356c2370225ae5659017924d21ad85b2fdcea5285c7fb63d9765593c9

  • SSDEEP

    98304:nuJTxaQvnSEnz6JOyFhK/axXA+VdwVHBSK6FCExd+iXKcigylBSxrKugYWXWw:nuJTTwHF+axXA+VdwZyCAKgkBAKrWw

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:988
    • C:\Users\Admin\AppData\Local\Temp\is-DPDP8.tmp\Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DPDP8.tmp\Setup.tmp" /SL5="$7019A,5902719,227840,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      PID:312
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffecda3cc40,0x7ffecda3cc4c,0x7ffecda3cc58
      2⤵
        PID:3616
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,13031790701044124545,10806367395234796458,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1892 /prefetch:2
        2⤵
          PID:2884
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2184,i,13031790701044124545,10806367395234796458,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2248 /prefetch:3
          2⤵
            PID:4916
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,13031790701044124545,10806367395234796458,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2476 /prefetch:8
            2⤵
              PID:868
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,13031790701044124545,10806367395234796458,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3180 /prefetch:1
              2⤵
                PID:4072
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3248,i,13031790701044124545,10806367395234796458,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3348 /prefetch:1
                2⤵
                  PID:4624
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3680,i,13031790701044124545,10806367395234796458,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4612 /prefetch:1
                  2⤵
                    PID:2592
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4856,i,13031790701044124545,10806367395234796458,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4860 /prefetch:8
                    2⤵
                      PID:4584
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                    1⤵
                      PID:1100
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:1884

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        62c95c9351bf93503e4d31ccc6e370ef

                        SHA1

                        5eb8fa5dd2f5c3a4d099059e940c44143f5cf32b

                        SHA256

                        b86a6f59ed9fbe450df111eed35699fc954a3cac5d4da7aeb19151018926ebea

                        SHA512

                        ebec4c53a601fbe685a14493c0321e5ba31e5b0a09908b38fe02d13d2266377f0986933115a185a94e3a02b8ebd0c5360719fa8252c755daab668b4f15b23277

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        8KB

                        MD5

                        86f4682217fd9cf138409e92d89d6264

                        SHA1

                        b45c668f400150f823a26654f6e6c75bd8655bea

                        SHA256

                        b3a3ec39928e9a8a689910c942d07343ea131b3f0116fbd300ead259a3c5052e

                        SHA512

                        50a5bbb5f2072cc39e8345431a14c5f7be60b2782d394bd72e702929c9b7e120424cf6aab1e8119065550ea8dadca219e2682023bd301c7896af83d919bdd4e8

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        8KB

                        MD5

                        f3f079ff8c8509ac0b095dc9e5184eba

                        SHA1

                        437452d542c2fbf2ad5a20d50dffb6c973d082cf

                        SHA256

                        9915f71e772f8670c6d806d75bba7344801c144755013b7529beb4e482910f29

                        SHA512

                        1a5ec081b8282e02ef7849b15083853147c8655d2128b3cc4cd4d66116c4140f96bcd9a666fd48ed1be2204e9ae79a6c9fc5c371f54271557143a04aae6a0bfc

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        77KB

                        MD5

                        1858011a1d560f860fd0c57f764e6274

                        SHA1

                        8ff759e5c336d8ca341cdefacd6bbf26aba7e831

                        SHA256

                        1ae0ecb50ff91402f0be9493f8f9b2d4836ee3c35bf521303655fbc1a94f18bc

                        SHA512

                        64dd5066cdae2bf2be6629d379c49df2f8882cfba93812d20488989f0343d842ac6a9cc6f031b3d4c7e18d320838b4c5f0cd15576fd532b20ead22103a591788

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\Autorun1.jpg

                        Filesize

                        294KB

                        MD5

                        336b561714280385c771b7359cc2fb51

                        SHA1

                        6136cf4e6286960a80f840695108747ec70a4829

                        SHA256

                        24aa776e0437e60ae0c7877c7a26f4816deb22a900507cf6e467010dcf9e5ba6

                        SHA512

                        291c76be891cd1c69c12e5b601038acb69617c3c0b146292cb57c8d5161bf839dc56c336ba96fa72aacca98f295f71bc4b32890bea90e7e13a74f58e6cc957a6

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\Dark.png

                        Filesize

                        65KB

                        MD5

                        185d31c702a861fd7026c693513eb3fb

                        SHA1

                        4857cba77bce860ee34df70d2ed06ac51958b53f

                        SHA256

                        56e1b926b344ef760fea6a4fd862e066ea5295f7e5671fc7c0d1f1bc148e2009

                        SHA512

                        9cabac5d73a9dada0d809fdfbbb552c105d0de975a545fef70322b8c86b001691af6e2dc58e980343342a953bed12d91553dc253928cd6357836b6aaf5efb8e4

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\Exit.png

                        Filesize

                        9KB

                        MD5

                        91f97aa4b051e7b2991e5456d2c8655b

                        SHA1

                        901dd406613f3e97d8d6141bb061b242a3b5fb4f

                        SHA256

                        0ff3fbfbb177d5ffc8b577f821a91f9d39f13f5f548f9570c12cb85ccef526e3

                        SHA512

                        b664f7aff75308d416c9e479bbd9a9b840816d41fb1dc218187c01636e443c4c7976a635459f626f971961c89d0b8e3c91bb0d61940e487a36179437fb0aa296

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\ISDone.dll

                        Filesize

                        452KB

                        MD5

                        4feafa8b5e8cdb349125c8af0ac43974

                        SHA1

                        7f17e5e1b088fc73690888b215962fbcd395c9bd

                        SHA256

                        bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71

                        SHA512

                        d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\Install.png

                        Filesize

                        22KB

                        MD5

                        3a104b9ff4b59bba6dc3b30114c5b31b

                        SHA1

                        3a03ebe2b3ff5d4bac88355c82a86da3bb30cfde

                        SHA256

                        1a72008c2393b330c3a9e05bcba070e538d9d5078767adc49a86a05473226ced

                        SHA512

                        8d4d985d5003b2b7739c9f5549b8ea143adcfa78188fea45de49a73f82dd1e88709ef35a62bdcfdf360a1d3face0cb40fb8ff782d15f5081127dd6121a7e0289

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\Lockscreen.jpg

                        Filesize

                        294KB

                        MD5

                        a50d1284b3709220da74209e11bb0758

                        SHA1

                        946f94b81bbb6c6a872d454eef5a761bd8a0364e

                        SHA256

                        b8d131cbb9fcf5369fb728c16d21bd30f1760e0e647b38cd676d25e7270ecc46

                        SHA512

                        28fe1a424da12e18b9373aab640aa0cc43cd7447ce32612f5a94832793d2afb8472d5ab9061e5704cd09e1848e3f6e041ea6336c4231212213b44a7202f96e6c

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\Lockscreen_overlay.png

                        Filesize

                        77KB

                        MD5

                        f5f4fe2b811e5a07ae1184579cf36557

                        SHA1

                        9ae1594e259f1aa06734c8653796596113f2d08b

                        SHA256

                        d66bbf3a8d5f5890c3dbc95e77068abb10f3db4ebd0c71ae5dbf15d99174889c

                        SHA512

                        eded97ed79f84916e5727f83e170f3999478df537bebe39767c49a3bedf4c86cd5bc3dcfd5d767559b9333ce9e06bddeceb96469e5a70eaae47145a838438f56

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\Tile1_Background.jpg

                        Filesize

                        294KB

                        MD5

                        fa864d2e07ba7811638d5a07152f3277

                        SHA1

                        56734493764e6dbd9871e1bdad6222ea97f45eba

                        SHA256

                        fc36ef1c5559899c2c2e752cff7bc9408dafd6ba126ec51c2be859d5a44919a4

                        SHA512

                        42a87178b3000c8a28a6a1880d762b4b7e65213c04ceca5ef8ec9b52cba0be6970d4aeef909c3b9b48fa39688390460ce3d4faf099f13370e669865ebf5b6f25

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\Tile1_Icon1.png

                        Filesize

                        12KB

                        MD5

                        688231d073c8260004d860b29726e589

                        SHA1

                        33ef340a8671fe0b74cab319e7c3f2a197eb6c3e

                        SHA256

                        81ddf630398427b4d81e15b6feb595669d06923a5e95954cb36a442d7f0e26c3

                        SHA512

                        94aa5fbede7d9da05b8216c2cf451e927edbcc0f8808f89fb3ce612870e849836d2df477c9630358b92bead596d2a900fe1879b3c99fdd630a4c8cecbf5f6a6a

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\Uninstall.png

                        Filesize

                        9KB

                        MD5

                        1dbec7e15bb3fe912ea362c7f5305cb8

                        SHA1

                        8ee2dca3f834cd7809dd50681bb432fa17f982f6

                        SHA256

                        43bfe50a575e87237abe4f65eee18b23e667c0a6c9fa1fd6fc2176948edfa527

                        SHA512

                        dc46536df17a17410a4aa2b6afaee9a620612e23498d009e766411bf2d17c87da0ac3b3f5a950375c34f4355f6b2924dfdc99c52102e1e702fd55f29333fc55f

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\botva2.dll

                        Filesize

                        37KB

                        MD5

                        619bf9ddcb5fe39ee9e5b0167e7f4f0d

                        SHA1

                        6da8c0d2407d5221172765b00452efa0f361902f

                        SHA256

                        609661a14733f6e9c2c2f2ff9c274f8a4cbedaff4dd32049aa5161f8d7083d6a

                        SHA512

                        a89fc731805e83f889f408fe3fea769d0e44faf1e1dd37d3569bbf57a6086b1ffc8783778e0be8236447c7661c44051b2d4b1d3a643f7ebc35f6ef0625c6897a

                      • C:\Users\Admin\AppData\Local\Temp\is-48IGO.tmp\logo.png

                        Filesize

                        26KB

                        MD5

                        a5ba8ba0b1985ca8f6d2d8bc3ff1f09f

                        SHA1

                        e198a54f426d139bd19a836502dd226d83973f8f

                        SHA256

                        1f6fec81aae4f62d18b834e1fc634603882155b23d6d5825b786ee9dbf9ddf3d

                        SHA512

                        e457b152f85611b49ab3270ac524e1e957a24570ac036e570b45d892652890bb94fee98700898d55cf31d5f5f47ee1bfd1e3acf03875edd7db5ef94395e70181

                      • C:\Users\Admin\AppData\Local\Temp\is-DPDP8.tmp\Setup.tmp

                        Filesize

                        1.5MB

                        MD5

                        6e4e83302159ec46e10280abe1d62ce1

                        SHA1

                        eb439d7b73e64605eb9f37b9b057722861ada267

                        SHA256

                        bb22238b9de45d10013cdf18b66d13646137bf5ddc075c781a160ef8739b2fd7

                        SHA512

                        22331088377154be8b11825c95c1a2a8765d71c3394714faed00a6185ab84afac63ae95103f20f1a9e4fe447259976734e1bd905e4a45bbe0567cee5241f1033

                      • memory/312-35-0x0000000003510000-0x000000000351F000-memory.dmp

                        Filesize

                        60KB

                      • memory/312-84-0x0000000003380000-0x00000000033F7000-memory.dmp

                        Filesize

                        476KB

                      • memory/312-83-0x0000000000400000-0x000000000058E000-memory.dmp

                        Filesize

                        1.6MB

                      • memory/312-90-0x00000000006A0000-0x00000000006A1000-memory.dmp

                        Filesize

                        4KB

                      • memory/312-100-0x0000000000400000-0x000000000058E000-memory.dmp

                        Filesize

                        1.6MB

                      • memory/312-104-0x0000000000400000-0x000000000058E000-memory.dmp

                        Filesize

                        1.6MB

                      • memory/312-85-0x0000000003510000-0x000000000351F000-memory.dmp

                        Filesize

                        60KB

                      • memory/312-16-0x0000000003380000-0x00000000033F7000-memory.dmp

                        Filesize

                        476KB

                      • memory/312-7-0x00000000006A0000-0x00000000006A1000-memory.dmp

                        Filesize

                        4KB

                      • memory/988-82-0x0000000000400000-0x0000000000442000-memory.dmp

                        Filesize

                        264KB

                      • memory/988-0-0x0000000000400000-0x0000000000442000-memory.dmp

                        Filesize

                        264KB

                      • memory/988-2-0x0000000000400000-0x0000000000442000-memory.dmp

                        Filesize

                        264KB