d047f39babae81dbfbde5afee704e1b0d2314159691c8e0cee95dfaa8958e885

Analysis

max time kernel
102s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/PW001.exe
Size 879KB
Sample240604-c436kaae7y
SHA256 b65bd44fcbcbe3bd70e1a665dc8f9e8a878c24eb230d0ebf5bf0e1adb017ec01
MD5 4c9ec35033d6049fc2b772d5bd7f063d
SHA1 59fb04eb6a4ea03aa98967683a6bc58be98cd68a
SHA512 720a0d43693cdc5549c204dc352b2d55e65790575cba3f7f35b2a5ee5dce7f1b7c9989c34608d27d335dcc00460a305b500579d7a0959e3419e50af80c099e53
SSDEEP 24576:jG50ZfFK6ln+3Med97Mjn9foX4OoIVRY0dGxsAI02F+02+tsC:jG5UfgQ+/w9fMhGx59Ov
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3744	installer.exe
4756	GenericSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4756	GenericSetup.exe
4756	GenericSetup.exe
4756	GenericSetup.exe
4756	GenericSetup.exe
4756	GenericSetup.exe
4756	GenericSetup.exe
4756	GenericSetup.exe
4756	GenericSetup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	GenericSetup.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 3744	1008	PW001.exe	84
PID 1008 wrote to memory of 3744	1008	PW001.exe	84
PID 1008 wrote to memory of 3744	1008	PW001.exe	84
PID 3744 wrote to memory of 4756	3744	installer.exe	86
PID 3744 wrote to memory of 4756	3744	installer.exe	86

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PW001.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PW001.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\AppData\Local\Temp\7zS0F3DC367\installer.exe
  .\installer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Users\Admin\AppData\Local\Temp\7zS0F3DC367\GenericSetup.exe
    C:\Users\Admin\AppData\Local\Temp\7zS0F3DC367\GenericSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BundleConfig.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS0F3DC367\BundleConfig.xml
Size 10KB
SHA256 1e1781015cb7b19556b9613a758a61b4d05e2f333a1d2376aee333687b3c6cb4
MD5 6e2b4cde6f1fa4c3043072883fafd1d0
SHA1 f4adab6ad68475179bc2efff8a61bb659a959e47
SHA512 0477fa18883f177e301ce5ea1db01b0d99ac24307c7944ac0c7b4a5a2ab172458390046ab11a8a8a967355ed350906dbc7bb3c87b856b2f153eee0b4a11d969c
SSDEEP 192:VoodiWunhBGoSfIhp1iJYvZXMHiWunhBGXcofbmPCdP7j+J8MfWtrod:VoodXcBl31U8MHXcBecofwUPfYWUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

DevLib.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0F3DC367\DevLib.dll
Size 296KB
SHA256 e45c76469790518202dbc2604e8d08ef1c484eac140897587287abee4f69bfa1
MD5 722451f2f61d2539a6a7d9c00ab34cab
SHA1 f27462048194205e038377a2acb0ec6c7ebc9416
SHA512 6a1dc187280ac0cfa2b335ec774ab22cffb4e8f45cea0b6af04f33587c00b645de04f2b7979fe0c92da67133cfe13a4110883a21318abd241a156b7cc1193fac
SSDEEP 3072:IX3AZ/w7Vq+AiDjtO7qRAbdauZVzlCM+E35fw+4ZswFlbuVbjUI1byXwVygtSmaZ:3/ib9hO7qRALIvE31t4ZDFlbkUcPYekl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GenericSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0F3DC367\GenericSetup.exe
Size 63KB
SHA256 970eb68e2918579ff7d38561342c5101cb0ee195d2dc92bf917b5e411e1e6070
MD5 412fd76263cfbd6bb9d09a432788f677
SHA1 7f026fad4c65a493ca7bfe76427b59f1788ec693
SHA512 5c721c42d281dbab1cb3f3b058c4d55b79902f8a5c939d0368a8fcd8eb8c4481d0eb9cfc34d672f95b87d24edf5c73fb2ff23a306a5dd4e5a0722f74f8cd3df2
SSDEEP 768:3AE+/58613Bwtxw0w3zeG3DSG332vUkRxitYcFroo6K1n+0/NbJ:3AV/58Aoat3DZ3QUkzOrool1R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

GenericSetup.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zS0F3DC367\GenericSetup.exe.config
Size 1KB
SHA256 983df9cb0d6adf973fde5b32ab77fd14396f9fc03a36ac496114d7a549f80f06
MD5 5f4599dfb551f9408e5e983568fdd394
SHA1 e21e38521fce364c1dc6181b65f9973cdbe03412
SHA512 3a34ad6b8e1eb704759e6c263b5f0bd249fdbf53848384263f004ac0d3c96f1ea92b56322cf2c39733c0dd685f6967862a379c0eee0f210e06a6befac33bf7cf
MD5 SHA1 SHA512

Submit Download

WizardPages.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0F3DC367\WizardPages.dll
Size 56KB
SHA256 46e7f18fc5d64d0f52243c9c47112911f0d3436e89108893f2e6b00f0c916d37
MD5 65947900d9d3019018c794b6b50b471c
SHA1 9479ea6b19bf1c38e06e83a2b2324dc4f922e167
SHA512 52d2c7a50d5e297cc2eba2c4e2ee37dbec02292bd248b9291d022462d937228c91fc848d1689d32ab95e817b3562878cf6ec345edc936ce2e303328a06811bef
SSDEEP 768:vqctE6OVHn3bDkdC+Ya/uMloameNmstIs+0/1:vqcOVPklpqad7tIwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0F3DC367\installer.exe
Size 1.5MB
SHA256 67f4625cf7b08dbb8276d91542507c06489dc1b6ef32b68d4c4bea1c27dc3756
MD5 5e1f66b215cc6dadbb4a1e0d9c02babd
SHA1 bfe54a6febb4008ad20bde41e90e98f84ca851e8
SHA512 e7f03c913049391f138e9f3a4fb8baa0c397422b7407104d35cb4e2ea2b37918f6834d6fc6c9e6a793f5f616ef6a6a01aeea9443c4bf410ef91a4db115c48377
SSDEEP 49152:Pcyczrbk6H/TNifx4KZsv6nAKF6YmmHgBl5cwZ0Jyyi+E+6TTm:Pc5/vh2NmmAL5CJv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4756-38-0x000000001AE90000-0x000000001AEE0000-memory.dmp

Download

memory/4756-36-0x0000000000390000-0x00000000003A4000-memory.dmp

Download

memory/4756-44-0x00007FFF19150000-0x00007FFF19C11000-memory.dmp

Download

memory/4756-47-0x000000001B440000-0x000000001B454000-memory.dmp

Download

memory/4756-35-0x00007FFF19153000-0x00007FFF19155000-memory.dmp

Download

memory/4756-57-0x00007FFF19150000-0x00007FFF19C11000-memory.dmp

Download

memory/4756-63-0x00007FFF19153000-0x00007FFF19155000-memory.dmp

Download

memory/4756-64-0x00007FFF19150000-0x00007FFF19C11000-memory.dmp

Download