Analysis

  • max time kernel
    24s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    02/05/2024, 13:28

General

  • Target

    setup.exe

  • Size

    22.6MB

  • MD5

    56254d5e60c6e09c13249087f71584a7

  • SHA1

    c72fbc0e68f259186e3791d0662c68d059dcfc71

  • SHA256

    7e4a4c66838d7b0d8feafe022c9a22b83fa66aec410a91929eb52c88c71cce99

  • SHA512

    385416bf1703a4692b7aaa7414629a875cf5ba06c69c795c0c8f3a795ba7214e67bdd2dfdac0944800cc3d01c7599f450f6842ec8062013533cd250f42988607

  • SSDEEP

    393216:HgORfY/PBFpIE1zpshQ2EcDj11TR/tey+iwPgXNGq6+GY2yv0bbcYks17Sl:AORfYTpJzpWQ2EYpLAiMgXNG3+GD40bk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\Temp\is-1TQ3H.tmp\setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1TQ3H.tmp\setup.tmp" /SL5="$40016,23172476,190464,C:\Users\Admin\AppData\Local\Temp\setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Europa Universalis IV\unins000.exe
        "C:\Europa Universalis IV\unins000.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
          "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Europa Universalis IV\unins000.exe" /FIRSTPHASEWND=$201D8 /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:2960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Europa Universalis IV\FreeTP.Org.url

    Filesize

    45B

    MD5

    69a62507139452e5b5f1826996482a8e

    SHA1

    3ff9b7aa788ebfcebe743120692944b4eae7e274

    SHA256

    c7b1e51a4b8c5eccc5bc4f47d1fe0dd3bdff13afb34aed209754d7300025b00c

    SHA512

    ee2447d7a0c2c86cddfe24b362632a941025064c15d5263616f8499f3eb20d91911751ad3d96c7d8ce7f4b9cda202b4e4925afbf30fc23b57efb8783c5c5c627

  • C:\Europa Universalis IV\ReadMe - Как играть по сети.url

    Filesize

    54B

    MD5

    942422521823f1c499dda411dca51c2b

    SHA1

    01c741a091cf882f2518af67051f1b6013f2e751

    SHA256

    4ecd9c8c5999e80b363fb894f45a27d87c86cc3eff8e82394e19f5237731fcf2

    SHA512

    77200973587733ae4340ea6cb2b5b79f534311953911bbb77adac9365f0e01e2157acd44f8958d7083b9b33330857fa148d6bc872a9f1b87a739e4ec4cfeceb6

  • C:\Europa Universalis IV\favicon.ico

    Filesize

    53KB

    MD5

    22e4b1028641892fc71a007d5d3d398c

    SHA1

    1d50db1c3bf302b221650ef83e892251c51f83c2

    SHA256

    a96b8976fb7cde9cf640941e623b3a5cc6ea2f13acd2582513fcf781dcad1bcd

    SHA512

    206734d3c66ef47b5dd2d12d1d30a4f20f2a1a5216bb5156a43abbe5fb54da3cea169643685b27dbf32ee177e16032dd30737abd28bab83c470227a9fb2b08a7

  • C:\Europa Universalis IV\unins000.dat

    Filesize

    54KB

    MD5

    33dfca1233a5c26c011e494d46cb554e

    SHA1

    696d7574c8586b9c6f2e234f19db79a45e808d37

    SHA256

    0ebb21787719fc18bc908ccd1b7e43ce664ecd94fb4cb096cf1fb2e6068fc2ba

    SHA512

    6a22d328c53c15e62cdad34c22febfa4ad49d796e707fc1e484d4c06af6982d5266d88544979b5229f475c7b78b874d093e0f1d6f0d1ee2131943e753be647a1

  • C:\Users\Admin\Desktop\Europa Universalis IV.lnk

    Filesize

    1KB

    MD5

    b21ece6e39824f7d043331d9d197500d

    SHA1

    6928e64725fad1b4d4f3c75563b8408098bbd17e

    SHA256

    1e63f0c46b2f2f7e96af909d9e2d258b43abce5af1234e63adc5879ad5fc3c70

    SHA512

    e65ea82c34d609a47bbada7d94edf37d07c9f53728466b15f58d2a049741eba2f1e826dd78beec06548697a196379bc71f3bf91b89bb4ffc59d20c1cceda0ee9

  • C:\Users\Admin\Desktop\Игры по сети.lnk

    Filesize

    1KB

    MD5

    a87443d1ca44e77f294516fb03c2f5b8

    SHA1

    37e2e418444481778a2c86f7acd314887cec22bc

    SHA256

    2dd85ff46029bc0a8f25f53745e779384b61474703d3ea33b985514af7553660

    SHA512

    99628060fd303516f098e809b08be5a44b14707f24a2adfe02f598d8457cb0670c2a5111719e70e4549ae1b0773acc68f5112a412db44e3286b71a9e8659aa3d

  • C:\Users\Admin\Documents\Paradox Interactive\Europa Universalis IV\mod\pdx_30945\c10a3ad0-22b9-11ec-a171-fd5ca39a35ea.zip

    Filesize

    21.8MB

    MD5

    35883106feb62ce02852ee64b9909f9c

    SHA1

    716da6df9a587f2458db87a167a6c81ab9a41d83

    SHA256

    7bfaf90dc856582d3de750ff86bb38dacf33e8535ccbc65e5ef616beaf1b5742

    SHA512

    43c220ea112147e1665b6c943b49adf5ed8b97a8becea2e03100292f9fd67dfe45c87e74fcf3acb6e76da7d7ebc7a37d4ff5f97bacd23e234ea42d9cce4868fc

  • \Europa Universalis IV\unins000.exe

    Filesize

    1.5MB

    MD5

    ac631cf28c917ccd23147e1e3b8cde11

    SHA1

    76185c5737c85b55d6350665dda0e4b0e88f4dec

    SHA256

    46e32c7e7d57f2cf38f519e3bab409a34d51d72258e74d7bdbed7eb8dec4ffa9

    SHA512

    71de79a347b2f39b91e54153f868c89d2ba26cb76b31ee42e8123d4279ae89f930b0febd1580ea1c5dc6d308de06a070a4fe6e9a66de1d4d814db7fe2386ee59

  • \Users\Admin\AppData\Local\Temp\is-1TQ3H.tmp\setup.tmp

    Filesize

    1.5MB

    MD5

    17fac68c3018078e9bedc9d58d02423b

    SHA1

    e434edc315f792d2835e8d507218890df3eea64c

    SHA256

    c87bd5d9698eb981ee384baa08305e7b94769e0cf3c1bbc97d11aab096013417

    SHA512

    bd0f62b2e4e828d2ddda98bdb337fbfc3b6c859781c499deec3130b3922fc0e71d695418881fab5bafb8da44dce6b10141f873fb94fa579d1a847468f4fb8d7f

  • \Users\Admin\AppData\Local\Temp\is-RGDSP.tmp\CallbackCtrl.dll

    Filesize

    4KB

    MD5

    f07e819ba2e46a897cfabf816d7557b2

    SHA1

    8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

    SHA256

    68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

    SHA512

    7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

  • \Users\Admin\AppData\Local\Temp\is-RGDSP.tmp\ISDone.dll

    Filesize

    446KB

    MD5

    dce6d68da86f44ba0cb70fa7718e2e84

    SHA1

    58cd39196abfc70b5b9bcc964f41a21024a61480

    SHA256

    b9bdc4a0309aa47613a7b5a680c55839aa7ba28e28f96e6b9316d4d5fe1dbe9d

    SHA512

    bd2f559640b63a46e15a2af90719c10e53e1c30020685163ed6b3bb669197d20d5dd76c7fd1052cf0841e3e1fdbd5a365a4bdb519d2f8fcad9122e77d923e8d6

  • \Users\Admin\AppData\Local\Temp\is-RGDSP.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-RGDSP.tmp\b2p.dll

    Filesize

    22KB

    MD5

    ab35386487b343e3e82dbd2671ff9dab

    SHA1

    03591d07aea3309b631a7d3a6e20a92653e199b8

    SHA256

    c3729545522fcff70db61046c0efd962df047d40e3b5ccd2272866540fc872b2

    SHA512

    b67d7384c769b2b1fdd3363fc3b47d300c2ea4d37334acfd774cf29169c0a504ba813dc3ecbda5b71a3f924110a77a363906b16a87b4b1432748557567d1cf09

  • \Users\Admin\AppData\Local\Temp\is-RGDSP.tmp\botva2.dll

    Filesize

    37KB

    MD5

    67965a5957a61867d661f05ae1f4773e

    SHA1

    f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

    SHA256

    450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

    SHA512

    c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

  • memory/2248-39-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2248-2-0x0000000000401000-0x0000000000417000-memory.dmp

    Filesize

    88KB

  • memory/2248-0-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2592-83-0x0000000000400000-0x0000000000585000-memory.dmp

    Filesize

    1.5MB

  • memory/2960-86-0x0000000000400000-0x0000000000585000-memory.dmp

    Filesize

    1.5MB

  • memory/2984-20-0x0000000002200000-0x0000000002276000-memory.dmp

    Filesize

    472KB

  • memory/2984-43-0x0000000002280000-0x000000000228F000-memory.dmp

    Filesize

    60KB

  • memory/2984-40-0x0000000000400000-0x0000000000585000-memory.dmp

    Filesize

    1.5MB

  • memory/2984-41-0x0000000002200000-0x0000000002276000-memory.dmp

    Filesize

    472KB

  • memory/2984-42-0x00000000748A0000-0x00000000748B1000-memory.dmp

    Filesize

    68KB

  • memory/2984-30-0x0000000000400000-0x0000000000585000-memory.dmp

    Filesize

    1.5MB

  • memory/2984-29-0x00000000748A0000-0x00000000748B1000-memory.dmp

    Filesize

    68KB

  • memory/2984-27-0x0000000002280000-0x000000000228F000-memory.dmp

    Filesize

    60KB

  • memory/2984-8-0x0000000000400000-0x0000000000585000-memory.dmp

    Filesize

    1.5MB

  • memory/2984-88-0x0000000000400000-0x0000000000585000-memory.dmp

    Filesize

    1.5MB

  • memory/2984-89-0x0000000002200000-0x0000000002276000-memory.dmp

    Filesize

    472KB