Analysis
-
max time kernel
148s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 02:28
General
-
Target
SecuriteInfo.com.Program.Unwanted.5065.12293.4062.exe
-
Size
28.4MB
-
MD5
19af89225259bf9ee269a74bbe85e6c2
-
SHA1
f9455e4e7f68de76304567ee41d8dc4f1126a1f3
-
SHA256
754eb8ab055095715c03f76840a42588e375b8f7b72d2c8bb7580456b26524b4
-
SHA512
381424332a501c805661501a1e7f5e257be48cbe9a99d1a06bda5a73c7486b171983a03396248f2913104829c1b8abb28cd1dbb654163d7527dbcdded4f4596f
-
SSDEEP
786432:ek67n39eN9LkC75Suthgp2tF+IUT8mCN0tqMYsiFJn4FV:g39eF7YurgQ/MJzFV
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5065.12293.4062.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5065.12293.4062.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UCLLM.tmp\SecuriteInfo.com.Program.Unwanted.5065.12293.4062.tmp"C:\Users\Admin\AppData\Local\Temp\is-UCLLM.tmp\SecuriteInfo.com.Program.Unwanted.5065.12293.4062.tmp" /SL5="$6011C,29020551,139264,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5065.12293.4062.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QENLF.tmp-dbinst\setup.exe"C:\Users\Admin\AppData\Local\Temp\is-QENLF.tmp-dbinst\setup.exe" "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5065.12293.4062.exe" /title="Driver Booster 11" /dbver=11.4.0.60 /eula="C:\Users\Admin\AppData\Local\Temp\is-QENLF.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /noemailpage /nochromepmt3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
24KB
MD56265a3d8b6ea027b596c0c6e9afd5c38
SHA14502ff9bccfcbee6d6fc5d65e5381288f2d9f3a0
SHA256193facd48ea0e183c7825c5efa2638c594cb73d9b40a1505a5ce14b478c6fb2e
SHA51254b3492a3f4bfaf9f6b02b6d95710a5f7b0b8ef1078623ea77303f253bd0e1d44dad3e725afe0afa12a433b21b8d0cfea55c0214bf09213de7a3cebbf78fd8ad
-
Filesize
848B
MD5f416840345a7824380e817e81d93ab2d
SHA13848b6513e7721dc9e6de8471059be375feda5a1
SHA25623931733560dec7d46169fa9ee8bf12229f01408a05a6fb884c46982dd10cb6b
SHA512055a4a4ba43ba711fdb20cc8d99c3bce2b080577dd04dd9f4add3ccf18b1d2931ba9f7d155c6d498e366091204fe734a91966042928ed00bc26a31bd829909e4
-
Filesize
5.8MB
MD5d47bdf9814e9682443fff06e7950b6ce
SHA1c1ad32b2a4f7ecf123bb2487ff5370a8a52a4d7a
SHA25602444937bdf1a642bee51b67231cb8de89b0107ace32fea4a0ccdb103f0d77cd
SHA512d2118477319d0a8d08b84c6ad4cc7deeb733f80ed06284afaf657e5ff648f819f623cb9f5e2722df3dd3a414e1da04d6640f1c832317585c20e04400dc2f7bae
-
Filesize
28KB
MD5b0381f0ba7ead83ea3bd882c1de4cd48
SHA1c740f811623061595d76fce2ebb4e69d34316f3b
SHA25644bc9472169403484a0d384f1ca81989ef7e4b07441758e8a0110078933cbcb5
SHA5126cfb8bc562d22843d043411720db97d0b4cbac96a20983d83d19e59b8428ec202f2532cc5af254438dc34fca4161abbd3f6bac8d397590e41b6d41e60700e78a
-
Filesize
1.2MB
MD5048f89f1be0ce17f10350b121c08b6bd
SHA1d0746f79ab4c1c6712e787d30e7896cf02439d1a
SHA2568dfc033ff5a1ebac9282f15f14ab048b73fb058fec927a1f5d188a359315c6eb
SHA512f21b627324fb58f2a585c99df6309e11ae11f895e6f5b6f0d4f9b02368ec9982728e43a3aba5d346d3ca45419fc593293665305f067d9d9f41753d201a9ea90a
-
Filesize
176KB
-
Filesize
68KB
-
Filesize
176KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB