fa33a79cef198b9720dcd8c28a345e5532a6bc8c9b79db6640a2a5f6ad56ef82

Analysis

max time kernel
368s
max time network
1608s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bindu Software/HASPUserSetup_8_15.exe
Size

21.0MB
MD5

9e95296d454027e9365660a34d89d2d6
SHA1

580d6611d3fd5103a2b283f0d7c1846c99c48cae
SHA256

9783154b3e678fe812f19c7b0b4e8eed86a7394d6215ad470305ad88d4693b89
SHA512

cc8b9d3e6f4fcb04caec8c5822a52667cdea355b21941f64db7cb62470add4c2f2283aeb227cb894736963ad82ea0f57fe75d5fd3956534b733c3d510b684a83
SSDEEP

393216:Kq4RRYTALrCibyHUNQEt68bmIEVVRO6pnjzR6tV054zAG8AMiM3OI+:KpRRIACVHu4omIETRO6nI0djiAOI+

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2404	HASPUserSetup_8_15.exe

Loads dropped DLL 1 IoCs

pid	Process
5008	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2124	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2124	MSIEXEC.EXE
Token: SeSecurityPrivilege	4340	msiexec.exe
Token: SeCreateTokenPrivilege	2124	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2124	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2124	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2124	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	2124	MSIEXEC.EXE
Token: SeTcbPrivilege	2124	MSIEXEC.EXE
Token: SeSecurityPrivilege	2124	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2124	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	2124	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	2124	MSIEXEC.EXE
Token: SeSystemtimePrivilege	2124	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	2124	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	2124	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	2124	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	2124	MSIEXEC.EXE
Token: SeBackupPrivilege	2124	MSIEXEC.EXE
Token: SeRestorePrivilege	2124	MSIEXEC.EXE
Token: SeShutdownPrivilege	2124	MSIEXEC.EXE
Token: SeDebugPrivilege	2124	MSIEXEC.EXE
Token: SeAuditPrivilege	2124	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	2124	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	2124	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	2124	MSIEXEC.EXE
Token: SeUndockPrivilege	2124	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	2124	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	2124	MSIEXEC.EXE
Token: SeManageVolumePrivilege	2124	MSIEXEC.EXE
Token: SeImpersonatePrivilege	2124	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	2124	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	2124	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2124	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2124	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2124	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	2124	MSIEXEC.EXE
Token: SeTcbPrivilege	2124	MSIEXEC.EXE
Token: SeSecurityPrivilege	2124	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2124	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	2124	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	2124	MSIEXEC.EXE
Token: SeSystemtimePrivilege	2124	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	2124	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	2124	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	2124	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	2124	MSIEXEC.EXE
Token: SeBackupPrivilege	2124	MSIEXEC.EXE
Token: SeRestorePrivilege	2124	MSIEXEC.EXE
Token: SeShutdownPrivilege	2124	MSIEXEC.EXE
Token: SeDebugPrivilege	2124	MSIEXEC.EXE
Token: SeAuditPrivilege	2124	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	2124	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	2124	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	2124	MSIEXEC.EXE
Token: SeUndockPrivilege	2124	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	2124	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	2124	MSIEXEC.EXE
Token: SeManageVolumePrivilege	2124	MSIEXEC.EXE
Token: SeImpersonatePrivilege	2124	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	2124	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	2124	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2124	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2124	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 2404	4696	HASPUserSetup_8_15.exe	74
PID 4696 wrote to memory of 2404	4696	HASPUserSetup_8_15.exe	74
PID 4696 wrote to memory of 2404	4696	HASPUserSetup_8_15.exe	74
PID 2404 wrote to memory of 2124	2404	HASPUserSetup_8_15.exe	75
PID 2404 wrote to memory of 2124	2404	HASPUserSetup_8_15.exe	75
PID 2404 wrote to memory of 2124	2404	HASPUserSetup_8_15.exe	75
PID 4340 wrote to memory of 5008	4340	msiexec.exe	78
PID 4340 wrote to memory of 5008	4340	msiexec.exe	78
PID 4340 wrote to memory of 5008	4340	msiexec.exe	78

C:\Users\Admin\AppData\Local\Temp\Bindu Software\HASPUserSetup_8_15.exe
"C:\Users\Admin\AppData\Local\Temp\Bindu Software\HASPUserSetup_8_15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\{D3E3A5B2-22CA-4B79-9B60-7926EB0BA3B5}\HASPUserSetup_8_15.exe
  C:\Users\Admin\AppData\Local\Temp\{D3E3A5B2-22CA-4B79-9B60-7926EB0BA3B5}\HASPUserSetup_8_15.exe /q"C:\Users\Admin\AppData\Local\Temp\Bindu Software\HASPUserSetup_8_15.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{D3E3A5B2-22CA-4B79-9B60-7926EB0BA3B5}" /IS_temp
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{D3E3A5B2-22CA-4B79-9B60-7926EB0BA3B5}\HASP_Setup.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\Bindu Software" SETUPEXENAME="HASPUserSetup_8_15.exe"
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2124

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 03EE4D2E973429628B0B98B5D5A5D80C C
  2⤵
  - Loads dropped DLL
  PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI879F.tmp

Filesize
165KB

MD5
9ac43e9f162f01eb026d136b819a9e1e

SHA1
e63f01850981fb921ee15710844ba97cd5dbd664

SHA256
1ce5a14e6a556722280b67c6a146dcc0a5a09e7e6a84b3b15ff36f3055ee5eea

SHA512
65b6e48c1416c76e9d19e388dee9055345dcc62bf057daec9cd22db210be63076308fe0de1ae4eb311c75a0ba2da51c92414c2962df638941ca01f7f5037ff0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D3E3A5B2-22CA-4B79-9B60-7926EB0BA3B5}\0x0409.ini

Filesize
21KB

MD5
a108f0030a2cda00405281014f897241

SHA1
d112325fa45664272b08ef5e8ff8c85382ebb991

SHA256
8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

SHA512
d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D3E3A5B2-22CA-4B79-9B60-7926EB0BA3B5}\HASPUserSetup_8_15.exe

Filesize
21.0MB

MD5
9e95296d454027e9365660a34d89d2d6

SHA1
580d6611d3fd5103a2b283f0d7c1846c99c48cae

SHA256
9783154b3e678fe812f19c7b0b4e8eed86a7394d6215ad470305ad88d4693b89

SHA512
cc8b9d3e6f4fcb04caec8c5822a52667cdea355b21941f64db7cb62470add4c2f2283aeb227cb894736963ad82ea0f57fe75d5fd3956534b733c3d510b684a83

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D3E3A5B2-22CA-4B79-9B60-7926EB0BA3B5}\HASP_Setup.msi

Filesize
20.5MB

MD5
444b43c22316577e7b307697e49f0caf

SHA1
3589a8c7920ba624916b26c5be359a87b3d50c5a

SHA256
edc7ce5037bde11b571c565ed70430f928be25ee47d0264e337cb64c8d6f9db8

SHA512
c32d03f66146acbf676126822ca2a9f0306aa0a1a12523e39a77537b46f64be9afea3e7da1414546a0386f7eac534c2c3cec458c380424c1d3ef3eef7b76a207

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D3E3A5B2-22CA-4B79-9B60-7926EB0BA3B5}\_ISMSIDEL.INI

Filesize
644B

MD5
7061b94db6d837f02e6bc8ca117f07f6

SHA1
77672f88cb0738a162ac7e0f015bb61707dd9687

SHA256
be607778a7489ee69b5d97d8e06fe338c23f2ba7910f106a712be7803af2692c

SHA512
e5e4d253c0f67e1fcec625e1e29c52b59b3b0cd0ca76093538f575e53751621a73a9bf2072c76261d92644c7e44f41c8d00ffcacc82771952d470f190f267927

Download Submit
C:\Users\Admin\AppData\Local\Temp\~6A83.tmp

Filesize
5KB

MD5
72bfb1892a498d1edd2167a9df514902

SHA1
c972129a7643e63549f728fe0a6336571b2456eb

SHA256
ec055886d82cc2e888c452f1ad974586f0a73b162639f9ce2f625f2b9be2adda

SHA512
f65438740d41ac26ad66d08a149bb4db7e1e8e8ff1774bfe11858dd43212588f46bbbea9f0a10c2c1b9f34d17a099fab7ab310d674589b6470cad80a3e99c9e2

Download Submit