Analysis
-
max time kernel
24s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 13:28
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240419-en
General
-
Target
setup.exe
-
Size
22.6MB
-
MD5
56254d5e60c6e09c13249087f71584a7
-
SHA1
c72fbc0e68f259186e3791d0662c68d059dcfc71
-
SHA256
7e4a4c66838d7b0d8feafe022c9a22b83fa66aec410a91929eb52c88c71cce99
-
SHA512
385416bf1703a4692b7aaa7414629a875cf5ba06c69c795c0c8f3a795ba7214e67bdd2dfdac0944800cc3d01c7599f450f6842ec8062013533cd250f42988607
-
SSDEEP
393216:HgORfY/PBFpIE1zpshQ2EcDj11TR/tey+iwPgXNGq6+GY2yv0bbcYks17Sl:AORfYTpJzpWQ2EYpLAiMgXNG3+GD40bk
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2984 setup.tmp 2592 unins000.exe 2960 _iu14D2N.tmp -
Loads dropped DLL 11 IoCs
pid Process 2248 setup.exe 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2592 unins000.exe 2960 _iu14D2N.tmp 2960 _iu14D2N.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2984 setup.tmp 2984 setup.tmp -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 2984 setup.tmp 2960 _iu14D2N.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp 2984 setup.tmp -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2984 2248 setup.exe 28 PID 2248 wrote to memory of 2984 2248 setup.exe 28 PID 2248 wrote to memory of 2984 2248 setup.exe 28 PID 2248 wrote to memory of 2984 2248 setup.exe 28 PID 2248 wrote to memory of 2984 2248 setup.exe 28 PID 2248 wrote to memory of 2984 2248 setup.exe 28 PID 2248 wrote to memory of 2984 2248 setup.exe 28 PID 2984 wrote to memory of 2592 2984 setup.tmp 29 PID 2984 wrote to memory of 2592 2984 setup.tmp 29 PID 2984 wrote to memory of 2592 2984 setup.tmp 29 PID 2984 wrote to memory of 2592 2984 setup.tmp 29 PID 2984 wrote to memory of 2592 2984 setup.tmp 29 PID 2984 wrote to memory of 2592 2984 setup.tmp 29 PID 2984 wrote to memory of 2592 2984 setup.tmp 29 PID 2592 wrote to memory of 2960 2592 unins000.exe 31 PID 2592 wrote to memory of 2960 2592 unins000.exe 31 PID 2592 wrote to memory of 2960 2592 unins000.exe 31 PID 2592 wrote to memory of 2960 2592 unins000.exe 31 PID 2592 wrote to memory of 2960 2592 unins000.exe 31 PID 2592 wrote to memory of 2960 2592 unins000.exe 31 PID 2592 wrote to memory of 2960 2592 unins000.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\is-1TQ3H.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-1TQ3H.tmp\setup.tmp" /SL5="$40016,23172476,190464,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Europa Universalis IV\unins000.exe"C:\Europa Universalis IV\unins000.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Europa Universalis IV\unins000.exe" /FIRSTPHASEWND=$201D8 /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2960
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45B
MD569a62507139452e5b5f1826996482a8e
SHA13ff9b7aa788ebfcebe743120692944b4eae7e274
SHA256c7b1e51a4b8c5eccc5bc4f47d1fe0dd3bdff13afb34aed209754d7300025b00c
SHA512ee2447d7a0c2c86cddfe24b362632a941025064c15d5263616f8499f3eb20d91911751ad3d96c7d8ce7f4b9cda202b4e4925afbf30fc23b57efb8783c5c5c627
-
Filesize
54B
MD5942422521823f1c499dda411dca51c2b
SHA101c741a091cf882f2518af67051f1b6013f2e751
SHA2564ecd9c8c5999e80b363fb894f45a27d87c86cc3eff8e82394e19f5237731fcf2
SHA51277200973587733ae4340ea6cb2b5b79f534311953911bbb77adac9365f0e01e2157acd44f8958d7083b9b33330857fa148d6bc872a9f1b87a739e4ec4cfeceb6
-
Filesize
53KB
MD522e4b1028641892fc71a007d5d3d398c
SHA11d50db1c3bf302b221650ef83e892251c51f83c2
SHA256a96b8976fb7cde9cf640941e623b3a5cc6ea2f13acd2582513fcf781dcad1bcd
SHA512206734d3c66ef47b5dd2d12d1d30a4f20f2a1a5216bb5156a43abbe5fb54da3cea169643685b27dbf32ee177e16032dd30737abd28bab83c470227a9fb2b08a7
-
Filesize
54KB
MD533dfca1233a5c26c011e494d46cb554e
SHA1696d7574c8586b9c6f2e234f19db79a45e808d37
SHA2560ebb21787719fc18bc908ccd1b7e43ce664ecd94fb4cb096cf1fb2e6068fc2ba
SHA5126a22d328c53c15e62cdad34c22febfa4ad49d796e707fc1e484d4c06af6982d5266d88544979b5229f475c7b78b874d093e0f1d6f0d1ee2131943e753be647a1
-
Filesize
1KB
MD5b21ece6e39824f7d043331d9d197500d
SHA16928e64725fad1b4d4f3c75563b8408098bbd17e
SHA2561e63f0c46b2f2f7e96af909d9e2d258b43abce5af1234e63adc5879ad5fc3c70
SHA512e65ea82c34d609a47bbada7d94edf37d07c9f53728466b15f58d2a049741eba2f1e826dd78beec06548697a196379bc71f3bf91b89bb4ffc59d20c1cceda0ee9
-
Filesize
1KB
MD5a87443d1ca44e77f294516fb03c2f5b8
SHA137e2e418444481778a2c86f7acd314887cec22bc
SHA2562dd85ff46029bc0a8f25f53745e779384b61474703d3ea33b985514af7553660
SHA51299628060fd303516f098e809b08be5a44b14707f24a2adfe02f598d8457cb0670c2a5111719e70e4549ae1b0773acc68f5112a412db44e3286b71a9e8659aa3d
-
C:\Users\Admin\Documents\Paradox Interactive\Europa Universalis IV\mod\pdx_30945\c10a3ad0-22b9-11ec-a171-fd5ca39a35ea.zip
Filesize21.8MB
MD535883106feb62ce02852ee64b9909f9c
SHA1716da6df9a587f2458db87a167a6c81ab9a41d83
SHA2567bfaf90dc856582d3de750ff86bb38dacf33e8535ccbc65e5ef616beaf1b5742
SHA51243c220ea112147e1665b6c943b49adf5ed8b97a8becea2e03100292f9fd67dfe45c87e74fcf3acb6e76da7d7ebc7a37d4ff5f97bacd23e234ea42d9cce4868fc
-
Filesize
1.5MB
MD5ac631cf28c917ccd23147e1e3b8cde11
SHA176185c5737c85b55d6350665dda0e4b0e88f4dec
SHA25646e32c7e7d57f2cf38f519e3bab409a34d51d72258e74d7bdbed7eb8dec4ffa9
SHA51271de79a347b2f39b91e54153f868c89d2ba26cb76b31ee42e8123d4279ae89f930b0febd1580ea1c5dc6d308de06a070a4fe6e9a66de1d4d814db7fe2386ee59
-
Filesize
1.5MB
MD517fac68c3018078e9bedc9d58d02423b
SHA1e434edc315f792d2835e8d507218890df3eea64c
SHA256c87bd5d9698eb981ee384baa08305e7b94769e0cf3c1bbc97d11aab096013417
SHA512bd0f62b2e4e828d2ddda98bdb337fbfc3b6c859781c499deec3130b3922fc0e71d695418881fab5bafb8da44dce6b10141f873fb94fa579d1a847468f4fb8d7f
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
446KB
MD5dce6d68da86f44ba0cb70fa7718e2e84
SHA158cd39196abfc70b5b9bcc964f41a21024a61480
SHA256b9bdc4a0309aa47613a7b5a680c55839aa7ba28e28f96e6b9316d4d5fe1dbe9d
SHA512bd2f559640b63a46e15a2af90719c10e53e1c30020685163ed6b3bb669197d20d5dd76c7fd1052cf0841e3e1fdbd5a365a4bdb519d2f8fcad9122e77d923e8d6
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD5ab35386487b343e3e82dbd2671ff9dab
SHA103591d07aea3309b631a7d3a6e20a92653e199b8
SHA256c3729545522fcff70db61046c0efd962df047d40e3b5ccd2272866540fc872b2
SHA512b67d7384c769b2b1fdd3363fc3b47d300c2ea4d37334acfd774cf29169c0a504ba813dc3ecbda5b71a3f924110a77a363906b16a87b4b1432748557567d1cf09
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b