Analysis
-
max time kernel
92s -
max time network
78s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
08-05-2024 06:07
General
-
Target
Tangible Software Solutions (May 2024) AIO Portable.exe
-
Size
36.2MB
-
MD5
c841fec7d1df3d19d526204c57e795c6
-
SHA1
efadb477864b4f220b739770c49666aa2443c9b4
-
SHA256
f2f4cf19c2caec784bb386fc86b419d7b9891a30802828e21660740c2efd1208
-
SHA512
a309475dc149cecccda981beb9c34b3b8d17e0113559f8d3f31a5fbbedf4850258309599ad28da074ce3c701632ae95b540bbe91fd9865331fae9c09e47d93ea
-
SSDEEP
786432:u23h54sHi9gjcpeAIO8H/NuMNk3DlVN4se3RLemOi6Uj8tv1cAoQcN:fh54MiSzyN4sYhn09cAoQU
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tangible Software Solutions (May 2024) AIO Portable.exe"C:\Users\Admin\AppData\Local\Temp\Tangible Software Solutions (May 2024) AIO Portable.exe"1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\C++ to C# Converter.exe"C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\C++ to C# Converter.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\Applications\C++ to C# Converter.exe"C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\Applications\C++ to C# Converter.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\C++ to Python Converter.exe"C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\C++ to Python Converter.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\Applications\C++ to Python Converter.exe"C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\Applications\C++ to Python Converter.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\C# to Java Converter.exe"C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\C# to Java Converter.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\Applications\CSharp to Java Converter.exe"C:\Users\Admin\Desktop\Tangible Software Solutions (May 2024) AIO Portable\Applications\CSharp to Java Converter.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179B
MD5e1a8bb5edb8f1afd9af49054295fdce7
SHA1a3396dcd334c1189b60bca66aaa948b2713bf6c8
SHA256f79cbac6fcb71941fd4a2e51cea0b29a0b2a54957ac68252bb49cc5d831f3205
SHA512bb9ecd89ac6a6495e38b6b39b4e735439470382bc5f2563872a2840c2331fe90e6ffd69c586e0647e71c4cfa647889e0a82fcea9a521a2791af8f20571304c27
-
Filesize
176B
MD5dc1aed0e36148949bb7a0557cd8c6640
SHA11300232bcacca20c06ef329889410d7741fb8054
SHA256a687f921166fb8fe9db5c8708d3311b6d861f7a52cdef8a2a8de614013c20968
SHA5124fa7737cead23675a767334d3bedc24d252d6f7c0f096abbc3fc8d22c507520c83376032ab3fadbe97d6a840633b3d7a8810bfee4f7afbc3f3d59c1f0de32fb0
-
Filesize
408KB
MD5f75444ff50914212e9df556585d39e4f
SHA10452fc66d4aadb25ca68473ab59b6579adef1e03
SHA2560dc8d8b3d5b508ed96b8ad88418643c0ec7418796ab242a7dc2ba078f2681ef9
SHA512db2d81faffebb5077f8425749b4cce3f67da9f5bbaaceaed471246c586e1e5054255f3f064fefd7fcfc3a0362a5752a7199c7a69a23ffbd78062e440166a64d1
-
Filesize
187KB
MD5a6f74bbdd8791cdb668cdf891db5f37e
SHA1f1f268f08bf1e7c1a4b7d0753c58df23d12c8345
SHA2560af9e12cb71f4d44769330a5e775e21d1cb051cf232391916fc41f59c0e302ae
SHA51297a118d9e6bb097671835afa125df342fe6861c7796480dab88bd61b53c50fb8cb2feea3a0cb9771953d0753169896885d543201c2fd882634ba5ce83cb0af84
-
Filesize
934KB
MD50ca0f36db5d5fe28f71eb28ba25b508b
SHA10cf6c810bb371be033d399ed2ee8224507503a7e
SHA256228bd000cf20ed57f9f35ea6bdd79c9d45d3bde7ddd647d5aa37bd5c27e1e4dd
SHA512f1f8304795cd719252dc8a92eb9c6fde1350e024678c9959876772e15fda095dffba79c4f6cf7331e8894b556dfc408eb4f841fc45f805d60385d7d3ec18da55
-
Filesize
15KB
MD5273dcdee0ab47e4ff148c0f5c62a74f2
SHA183c335f1b1b8e87a82ccdbd3a2438edb9ee6cd6e
SHA2569a5df4aad32d0edc3238118ef186c4e21d1080a6fb1a6fec487ec400dab79715
SHA512a46e1f1a6bed1c5c3dbe57b22ecf9e117450d42c0b2dcf5ffe789272b7d257be43743cec7c8a9fe90b7d342ffaef29bbe5df88ea6297ba915d6f8f04310f6721
-
Filesize
270KB
MD5fe077826b5931fd0f07e37946f8938f0
SHA1fe66de1366d40425b8aae6e5bb6ac5a0c7dcca96
SHA256483ed72dfb49ca592387c0618fa85c41fd5747304434f74c6841fece30b9b320
SHA51258e81fdb875c4f294be0f8cf55d2807d89b450a319255fe481ad1b74cc5a41a133050e28ab7d446a7e3584da7fbec274ec627c8973d4bb9a4cc10a12f94521d4
-
Filesize
102KB
MD5bdd1bd3b1358bc4b2c48875ee29aba65
SHA14802c4e070b0471f23aedae039b3b47f4c32a921
SHA2564a8fad30780daa708ab06554ab382fa81558d6049aa8e7156ca3ebb2102988b6
SHA512fd8b0140c60c64a058a99d133e783fabf29baf312f2e66be96df1904bd80b0c0fd7a43bfb8f875912f83a6c0ac34bcc81fd273b57e90aae95cd601baeb776b7b
-
Filesize
254KB
MD53b1a48bf7680806d87da9148121fdda0
SHA1dd96305519a3fa07150cd6f073b9f841ec994a01
SHA256f8149a701dc23b65e8ef79f5fbb227718b12e3d8e99bffebebffdf1ac0d442ee
SHA512c6ee45d7caede62618d5f1fa73e31deb2d9bb99da1994e14e26f57fb678313c9858ed9dad35cfbca4d18fb1515308df7f17d63d6071588feef4bb4563d5dc493
-
Filesize
78KB
MD5a618c8abf6f0935ba9a985c2fe1a2a52
SHA1019f8a9efcd3d0c7fce4291143cd7e00bab94685
SHA2560c6ca78e9cb1e0b5e49dd0e5d81f6b9afee9acba7b90753f00740f2ebce2cc23
SHA5128a178bd224bb640dcb004fc0b2b8d3ddd08711e010fc1da1cd6736414b7bceadc71a7f7a214aac23862454f05e7d5922284d1b5b05f32be68edabc933b94a563
-
Filesize
406KB
MD568eaadbe2211bb7c28717fff6744769e
SHA12cc32fd9fa6807fa59a1ce45956416107625a852
SHA2561df976c0980d15733b19dd0e5988a75527b69d9e8dd88c1f9931eacc3a2d7424
SHA5125a2d3c9b78b8f5b81391654b280808777c06587f6a711362f12846e7b177ff46e93aa2b794a9dc218e12a904ac13d2bbf85a3db9b660f11ef149ae219eb21006
-
Filesize
142KB
MD58ca047a9ee4b97c838fb0f432b2c5e59
SHA1aef195a922c559fdcd88af2ef57a3a70b40e2e09
SHA2567b2b16d4b5e1630f9836c061b567e5a91d4590995e394cf329c5af25fa65a5eb
SHA51223dccd2a43d7c1ed7b686eca24413002c6275fccb731bd859559cef0cc5240916d66b18a29ee4f22b6bb0d8822baf18fef2763961b978b1f334e17fb531e3901
-
Filesize
16KB
MD51047a00c992b8f0a9ae2477e9f5c6953
SHA16ab36320110e1152489badd5a382342526cdd61c
SHA2567f6b26dc752424f7571dfd0552190bd405eebe243de578bb66bbbc4738df7b16
SHA512e973a969ca292fc417591a05d7641473032e65b30cbaad8fe462749134a5121040c4ccf368995d24c9daf376af61304847655e99148689b65f11fa297b9a054a
-
Filesize
1.5MB
MD58600adb112f144ed84dad18315100081
SHA1798f09697731754808f31f6247c1a49ff044c0a8
SHA256f4d8e46be7b7a9945ed7389e88aa8dc087b3f0808f2b94e78b7cac85858f5181
SHA51284e44ec1b53fe41f187bcc7f8fda1db5cbca550990bcd6877dd8f3de2b2e680f24169f9e6549e3a89874a8d80f6618096c8964869a5c38057749b715f008a969
-
Filesize
130KB
MD5bb2b8b8773cb6f9f649b62c0c0aa48e1
SHA1dcefd79a28edcef2bb1c360ce95e5a2d6ddadf88
SHA25625e59b582caf47e0781ab58ec115d32e1efee1f6acc55badac189292d89465bd
SHA51261d123c97e42e75492ffb5fbfc7e09e78b7d0aa102d0b331be154403e76f5709c90ff4a67efdbc32510728d7c48dd5947b96345d0fc32b83471974d69e6227a1
-
Filesize
154KB
MD5b7d5077a386ca5d264c0a2b661309fda
SHA18b7fdb1720dde2ab80697dcb0888d39898501283
SHA256eed2a84ef0b6f8abea617ad64415e9ae47d46946757324bc04bc2081e6c438ec
SHA51295de16425d27e92ae01923f8f897554c53c79472e70bf0f8a3bea07ae0cfd7ad0f9169117053acc1db5086407bd93f94ce140816a783595f6673af85733f7ce5
-
Filesize
1.7MB
MD5c1cd6ba656d19c7b1c3fb9f87f22f98f
SHA10141fa8cc34b9fe9b39bb855958e8413bd90f475
SHA256b6005be7a266917c62c48f131d717f7de5afb9444ca6650230ac98b863d8c334
SHA5122258c1979c002fb25b694fde2a266c55bd7572ef6ab340e6ae8f4f1a7a978d40e007b07efd17120aad8c1e085ea8bb8cfeef6234b3af81287ad414e755a5291c
-
Filesize
110KB
MD57df102cc6ff83e5127e82c7035a24e93
SHA1fa24c484a2fc5a78c6739d556bfaaea078f23c61
SHA256488521ad9c01674945d419d40af7f57dde5a41d27bbded82b0e5b3890c6055f0
SHA512d4f1a519d2bf87aa73e7d40fa72ae9d8a4801cbe7505b0af3975959a284daca817f0bbf8135639400142abd2c2ccb742e1f4eca6e5683b5dae3a6c83b2011050
-
Filesize
226KB
MD53b7d349405200cc2ab8bcdfdd660b8f0
SHA10fb78b3e5125f565428b95caa60b0c045a6b7ed6
SHA256ed0d2d4650da88cc16d02693d40e6e5363fbbf82408e43a6fd83584e7f1aae25
SHA512100fa87d12c9b9d352efdb7a5e094304416a7d6e791644efbd34acf25085e84bcb2d2a79ae53fc8bcdbd1e098a7c1d96210ea64ad9d4cec414398b8373d8d67c
-
Filesize
654KB
MD525456277d629562168751bc619ad9b18
SHA1a3f9614627ee11ac5162692e82fadf26a81d6f55
SHA256b841d30a395bc0267b7e1cc2866c1b68a2437e5e2a94a7f2e6c492ff13265534
SHA5128e5f3bd05cdd62af9734a48ba3c79966a5e4653b0c806c5407e12b57937abab6b6591d955115f758c06c488af8a0705b79414365bc14e1f315cc5b67479c7021
-
Filesize
530KB
MD5b1cf02ff69d4b1ddc35636211e1e64cd
SHA1f7903c00fc19b381f6647830aed3eeb1fb6895f2
SHA256a48f2eb20835e6fce79134c54b82c37c6fe638a56db7f1389fb1b2c0d472ef88
SHA512837b5676d7bf9f77f28f1d0e9268027cc725b7e645c60fae48c72273741cc594436d77c60e8e9dca083b7b5a0892c12b613734cd31ba1d79229d4f133855a00f
-
Filesize
12.6MB
MD58f5cda3da1a76745d2e00c26e18f4281
SHA1c2f91a5bb567441a255c8080af0e065433e0c64e
SHA256a23be3c7507fa77c5ef608a81bbcf88fef70f79325b47537be8aec1286594819
SHA512ae173cfc645d60cf4f0b0d9cd81341d654446a20111388bca66374010e56d18d8d5ac5892ec6f621b07a854fb84007be34927aaeefbe0192f48acb1533bef6dc
-
Filesize
254KB
MD538cf95cdc001de40c05460da8effa173
SHA172406dd7080b36074859556a62763db6f409cdac
SHA2563269fab79ecfd241d4a477a38472406916fa5b9fe2e68b1f9c9db15aab3f9c92
SHA512990e1ca3364aff7c302e708fd0eb1811a67971e736215abd4f1c2dc79bd2bedab66d3c10a991ce918462520caff2e07d2fd1f79fe32a7bab20b03039e8ece15e
-
Filesize
94KB
MD56a2feb6e4612a64ced5cde53879d52a1
SHA1d7ab5f79d369f98ea85c04bf71bcd0d190e659e3
SHA2561c0f82813d95871af2db46f490f4b44d8616fec42ab8720e4db0a958d09546f8
SHA5124e893b231d52e064df09104201dce468f98689aba336d919d018aef2529aeb72aa8ec10ccaddda6fb53d776f471b2ffeb46c416eabeebaede913fc498ceb83fc
-
Filesize
42KB
MD5be5614444e68cdcd724b10a9d5843772
SHA1f9a76a8dabd7c86e5f77c4b443a64157534fc6d3
SHA256f4dfc05c7a1a8c9124c28b66a9c95e858e95f462f1939651432f04dba509e278
SHA512abc1ad3066501f995558e78b0129d48da1d6f5c139ac036566b765360b966fb9f7c502b01ff6caf91b747a8601be27b61a707820e43ed8a4096d1e4afb652f39
-
Filesize
2.0MB
MD5934bb8924051ee7d77966dedbe69c39b
SHA1c4620a6c34800fbc1ddc1eb0ea628a607053bcbd
SHA256f15c9918dba6223f1ee81f1df09fa510476410b45d82d9db27d94e7871b77e19
SHA512ff2c1990b58fb04d235dcdca21faa869b9b3232ab957044e0abaaa1d4ac9e4d97bde563aa6f659f0d241584c6c23c656b7ca9cd765eae394a1dc68dbb7bfa4f0
-
Filesize
15KB
MD54a866627a07f9a2fb5908f88ede6c5bb
SHA11b11657f6c8d02abcba5f110ad8ec236d22c6c2b
SHA2568ad353c5a4b22a150a309e0e465b29da80b1ed74bec690eaed6805c33530043a
SHA512d85e77c8c923250a0177891ce2040340d38ee1a8c390f7658482822bd22bba53bcbd3cf224e0ace646aa975bf18adfd9d0c1016736553228fee8f3c8c0d79ee4
-
Filesize
15KB
MD5eb84c31d5717b79bb1255c934cc755d1
SHA19ca632d9c36c4ee2aa29a592106e121060dd601e
SHA256b572cfe9bd5a9240d5991e81c6c75c69e74bddbcc819108cd50f54ddeb0d2416
SHA512eade5c6a28ca1ab8fe6417fb6f04d1c0be405616518d231ae31034528de7800215cb40b8ae46b70dc27eee1a87799065865994ab4d96c92ecbee3db29e78b353
-
Filesize
82KB
MD567755effcd1c45bb1e4e773a3d89250b
SHA138ab579c3c0f9ff9ef0652c5e30e1a5835b3271a
SHA256afa1451c889665f69a5336749c2f31d2a2a84476722f3ece9782af83b4435601
SHA51214d5f45ff64fe1733af54c0d92212588815c391774aba4cbfd2664db5e56ca0ceeeb7dc1ac68a5450852e873724f02d192b6a4260ec8fb5354ce59d746341ff2
-
Filesize
2.9MB
MD5391ed273efed37486a19db2987ecba08
SHA1ab2d0db47b9991a51acd3a4db169139876f9808d
SHA25681e4df44f911b85d621350d1f36e310a8851a3696d3099633edd08d36618cacc
SHA5121fe82c02adc4896724ae464322f59a1df0dae2d76e8062bd790c20164a6e4b6f507a852a5dbe63bafe3986987dfa6d51bb5f90516d79b12179808a574d28c74b
-
Filesize
12.9MB
MD5ab4c567e1b4a0492f19efa33c94eb802
SHA10e65ef1f61a3a0b3e9619512b79fc632b98bb16a
SHA25655cfd4e80307def1a814b7509be4cf9e724ebf727bb02685b4e29fe9bce688d3
SHA5125473fd274ce50a6a6945588c978bb07608223449090afefd314de436f2f82c2c3e8cac1280fa5fa66738e86cc6db478f16c83fe84288d1899b902b702363d140
-
Filesize
1.7MB
MD5cb70e80769008632d6987af31de3d2b9
SHA1558d5fdd11d06e0d2ed26876e8935bb5ce4c8804
SHA256280802a0542f723e3853df2c41191c4726a8e20cdbf2d9b91b5c0a32b80de865
SHA512f6b02a56b761f41a3c7fba49f6621d3512df2b070c11da696efb7b5d11bcad5e3f0c3352eb60b997a034d3a217356c2b5bee302a0febdac39389757dac545932
-
Filesize
4.8MB
MD573df1c808f8a5fd1928928faaaabad3c
SHA1cc7f4b6bccddb6907e8a1d06aa8f3c424636fc39
SHA25611f53a07c5cde93a0ab9e2505377905d85f1583cd5542dabd6713a4c5c2ba63b
SHA512c549536d36a3e8fe8b0e12cf553301886d355d6e80576b6796c096701f4d3f1ab9ab493418e4a59e0798c2ad180ab17d3abc6feba878074424e7415e1535772d
-
Filesize
346KB
MD55c2c09481ab395ac6262d8cda3313339
SHA1287da959a828d3d5dbf236f4a7c46b57a63495a1
SHA256ccc93ab0e150e842357e9a93833a0dcfd08b9da49cb57543ac1f4da890fa60f8
SHA51226d08b4ada8890d8f4ec71676c653f661e03b4951df1c859d5f70dc59f38e4c50ff4a47ca4e558ab55bcb84c40587779c6bb764dccc9c894bdc65afe2d65b123
-
Filesize
390KB
MD5d0fe3c44f4cba3d2205edd97ae3176f6
SHA1fff90624c067b9867fa7c44baa34780108da4a2b
SHA256a3866d43dc4d4a0dfe645ce57fcfceb34384977d4b8ccd1346eecde8e2d4f10d
SHA512c52cb1bba138fb1eeb2eb663ec97c86d2c27b1f5bee18cddc4707a466237a43452241452106b4d82ccafb1cc4e0f7e62a11bd9e45ad344bbc55c4c929001a8f5
-
Filesize
38KB
MD5c8aad133d0d47dc4538d8edf34e2d58e
SHA11b85074a1d889d2355a9ac281789086298c7c1ba
SHA2567aa994c59767bc91eb781e0a1d8c4337907799466b47fabb49b63610e89f1674
SHA512e76a430cd636797a10dbc3b4771047a7a1114d581e96c5c1f1fd73c841cd9e0521ec0ac8f25fb5fad22646a85ca3c10f140e701b4e63ff63666c828a5a8f77ed
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB