Overview

overview

9

Static

static

3

01bf8b7817...3e.exe

windows7-x64

9

01bf8b7817...3e.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 16:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe
  • Size 8.3MB
  • Sample240517-typjnagd64
  • SHA256 01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
oss_ak

Malware Config

Signatures

  • detect oss ak 1 IoCs

    oss ak information detected.

    oss_ak
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe
    "C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DeepLSetup\DeepLSetup 1.0.0.0\install\DeepL_Setup.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1715722692 " AI_EUIMSI=""
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      PID:4008
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 20C0D83214A997B60C2D1EF6C5ECE460 C
      2⤵
      • Loads dropped DLL
      PID:5108
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4F0FB3F94B1E9AE4681089E5C6C76CB1
      2⤵
      • Loads dropped DLL
      PID:4708
    • C:\Windows\Installer\MSI4F8E.tmp
      "C:\Windows\Installer\MSI4F8E.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe"
      2⤵
      • Executes dropped EXE
      PID:3760
    • C:\Windows\Installer\MSI507A.tmp
      "C:\Windows\Installer\MSI507A.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe"
      2⤵
      • Executes dropped EXE
      PID:4748
  • C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    PID:1376
  • C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe"
    1⤵
    • Executes dropped EXE
    • Modifies registry class
    PID:1148
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:804

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e574ad7.rbs
          • Path C:\Config.Msi\e574ad7.rbs
          • Size 421KB
          • SHA256 433cd21e93bf51dc26776f96f322938d0eb2bbfadf80180aadb80ef3423032d0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DeepL_x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe
          • Size 4.2MB
          • SHA256 0037c9895723fb712b57b144cbb429f319ab5a3c1e4c44a3ffefa351486bcdaf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSI48A3.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI48A3.tmp
          • Size 587KB
          • SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          WindowsProgramInstaller.exe
          • Path C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe
          • Size 3.6MB
          • SHA256 ba42b868a8618ca9ef05a27031c483d9306b944927cde7e9dd54c833447e9e91
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DeepL_Setup.msi
          • Path C:\Users\Admin\AppData\Roaming\DeepLSetup\DeepLSetup 1.0.0.0\install\DeepL_Setup.msi
          • Size 2.2MB
          • SHA256 d22ddab47c5ba6fdc5f2b4c4d41644597d832a56bc91a2074092a55923bf3843
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DeepL_Setup1.cab
          • Path C:\Users\Admin\AppData\Roaming\DeepLSetup\DeepLSetup 1.0.0.0\install\DeepL_Setup1.cab
          • Size 2.9MB
          • SHA256 f00693121cb98dd585afcc1718256b2f29179812a8ca91168a48c247d8f4d384
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSI4CCD.tmp
          • Path C:\Windows\Installer\MSI4CCD.tmp
          • Size 709KB
          • SHA256 1a3c0e60aad0a3bb92a6e0b786df93920aed7b0c7ec56ab49f2692102ac5adec
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSI4F8E.tmp
          • Path C:\Windows\Installer\MSI4F8E.tmp
          • Size 419KB
          • SHA256 f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1376-69-0x0000000000F20000-0x0000000001358000-memory.dmp
          Download

          memory/1376-77-0x0000000001C70000-0x0000000001C8A000-memory.dmp
          Download