Analysis
- max time kernel
960s - max time network
944s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
13/06/2024, 23:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AutoInstall.bat
Resource
win11-20240508-en
windows11-21h2-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
CommandLine.exe
Resource
win11-20240611-en
windows11-21h2-x64
7 signatures
300 seconds
Behavioral task
behavioral3
Sample
Commands.chm
Resource
win11-20240419-en
windows11-21h2-x64
1 signatures
300 seconds
General
- Target AutoInstall.bat
- Size 182B
- Sample240613-31e8fazfpp
- SHA256 c0f77a4a8363707b252eead4e8a6c24ee1745d35383dc5247d6c19fbbc90b3f1
- MD5 469a1bde70c70c9d415c6c2bfcd1cb7f
- SHA1 e51f2a04100672a6b0348b6ad999080ff806d0fd
- SHA512 d3a08ca84ef23f3e865383b01f84ba74e95792a4924a39360e83063a44199062408ecc51ea3510c3ef1decda9515f99df2b9fb855b00fa9b459ac883378af437
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2656 irsetup.exe - Loads dropped DLL 1 IoCs
pid Process 2656 irsetup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 44 IoCs
description ioc Process File opened for modification C:\Program Files\CommandLine\build\CommandLine\Tree-01.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\Tree-02.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\xref-CommandLine.html irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\xref-CommandLine.html irsetup.exe File opened for modification C:\Program Files\CommandLine\icons\commandline.ico irsetup.exe File opened for modification C:\Program Files\CommandLine\Uninstall\uniFC6C.tmp irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\Tree-00.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\Tree-01.toc irsetup.exe File created C:\Program Files\CommandLine\Uninstall\uninstall.xml irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\EXE-00.toc irsetup.exe File created C:\Program Files\CommandLine\Uninstall\uninstall.dat irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\Analysis-00.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\CommandLine.exe.manifest irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\CommandLine.pkg irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\EXE-00.toc irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\PYZ-00.pyz irsetup.exe File opened for modification C:\Program Files\CommandLine\Uninstall\uninstall.dat irsetup.exe File opened for modification C:\Program Files\CommandLine\Uninstall\uninstall.xml irsetup.exe File opened for modification C:\Program Files\CommandLine\CommandLine.spec irsetup.exe File created C:\Program Files\CommandLine\icons\commandline.ico irsetup.exe File created C:\Program Files\CommandLine\Uninstall\IRIMG1.JPG irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\PYZ-00.toc irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\Tree-00.toc irsetup.exe File opened for modification C:\Program Files\CommandLine\Uninstall\IRIMG1.JPG irsetup.exe File created C:\Program Files\CommandLine\Uninstall\IRIMG3.JPG irsetup.exe File created C:\Program Files\CommandLine\CommandLine.exe irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\Analysis-00.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\PYZ-00.pyz irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\warn-CommandLine.txt irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\warn-CommandLine.txt irsetup.exe File created C:\Program Files\CommandLine\uninstall.exe irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\CommandLine.pkg irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\Tree-02.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\PKG-00.toc irsetup.exe File created C:\Program Files\CommandLine\Uninstall\uniFC6C.tmp irsetup.exe File created C:\Program Files\CommandLine\lua5.1.dll irsetup.exe File opened for modification C:\Program Files\CommandLine\CommandLine.exe irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\CommandLine.exe.manifest irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\PKG-00.toc irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\PYZ-00.toc irsetup.exe File created C:\Program Files\CommandLine\Uninstall\IRIMG2.JPG irsetup.exe File created C:\Program Files\CommandLine\CommandLine.spec irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\base_library.zip irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\base_library.zip irsetup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Delays execution with timeout.exe 3 IoCs
pid Process 3116 timeout.exe 1404 timeout.exe 1980 timeout.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings cmd.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4704 NOTEPAD.EXE - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2656 irsetup.exe 2656 irsetup.exe 2656 irsetup.exe 2656 irsetup.exe 4604 hh.exe 4604 hh.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 756 wrote to memory of 1980 756 cmd.exe 78 PID 756 wrote to memory of 1980 756 cmd.exe 78 PID 756 wrote to memory of 4012 756 cmd.exe 79 PID 756 wrote to memory of 4012 756 cmd.exe 79 PID 756 wrote to memory of 3116 756 cmd.exe 80 PID 756 wrote to memory of 3116 756 cmd.exe 80 PID 4012 wrote to memory of 2656 4012 CommandLine.exe 81 PID 4012 wrote to memory of 2656 4012 CommandLine.exe 81 PID 756 wrote to memory of 4704 756 cmd.exe 84 PID 756 wrote to memory of 4704 756 cmd.exe 84 PID 756 wrote to memory of 1404 756 cmd.exe 85 PID 756 wrote to memory of 1404 756 cmd.exe 85 PID 756 wrote to memory of 4604 756 cmd.exe 86 PID 756 wrote to memory of 4604 756 cmd.exe 86
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AutoInstall.bat"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\system32\timeout.exetimeout 32⤵
- Delays execution with timeout.exe
PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\CommandLine.exeC:\Users\Admin\AppData\Local\Temp\CommandLine.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5617698 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\CommandLine.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2457560273-69882387-977367775-1000"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2656
-
-
-
C:\Windows\system32\timeout.exetimeout 102⤵
- Delays execution with timeout.exe
PID:3116
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\License.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4704
-
-
C:\Windows\system32\timeout.exetimeout 102⤵
- Delays execution with timeout.exe
PID:1404
-
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\Commands.chm2⤵
- Suspicious use of SetWindowsHookEx
PID:4604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\CommandLine\Uninstall\IRIMG2.JPG
- Size 49KB
- SHA256 cbf37d70834a4f739db3c649cdf38f5abb9d78582f71a65f95bd40619ea57ac9
- MD5 6e6a077e106d26ba4a7064c355472cde
- SHA1 878ab7196eff24b8967ab98c4e930758d2574fc2
- SHA512 3b1c0f1893e78047989142435f26eee89980470b44dcf9442787799b7e81d0f4153bd7950876aea8313e2a1f460b2094630b674e1630965ed5b003242560260a
- SSDEEP 1536:Kd3icoK/7NbTnbCACOkP5yDS53ZuZU2ozT:MVNvbr9SZuZU9/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\CommandLine\Uninstall\uninstall.xml
- Size 4KB
- SHA256 d875985090ca0fc1ac15dffdacbde7424dc7e3b50f99518f64325a04b2f53d3e
- MD5 fe8247a981df71d5e172c3f7c2a02484
- SHA1 1c25764133efc56e84ebdf7b81d83849b1a9ae3d
- SHA512 4a8bd546d3ca390c56931502367c779521f932bce69ed44c4b39ec6bff49e37367af533a0ff8d4196044d10cfea103b578e0d7406e16d73d70d489de7dd74f6e
- SSDEEP 96:kT1uMOVFHs+VFH1VFHUVFHwlVFHnVFH5VFHwEVFHxVFHGVFHKaVFHKrVFHKYVFHq:eIVFHjVFH1VFHUVFHgVFHnVFH5VFHwEu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\CommandLine\Uninstall\uninstall.xml
- Size 10KB
- SHA256 e5cdcb299773f45ea2c9dcae8ce818d94afde43801a198f5e37a4bd5c1a4a461
- MD5 bd0b41d8b089da6537fa0af025775d1c
- SHA1 22c57029c4dad1e94ad3c88c170c21e7cfc0de20
- SHA512 0f2d3330bc46bfd74db82af935baf288dbd371afcca7f4bf74bd90213c665a177aa2208562795a1cb49c2c4e1153bda365e5dfadd29b4212073a5f66d5b6625b
- SSDEEP 192:eFVFHjVFH1VFHUVFHgVFHnVFH5VFHwEVFHxVFHGVFHTVFHCVFHJVFHcVFHoVFHKh:lZcCX+O3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG
- Size 5KB
- SHA256 d5e3cd5adcfdc47b3b9ed57c59960efc8792a820e404ac8dda85ef943de7904b
- MD5 d472a0189aa52f36633ac3d89f5e1219
- SHA1 4fb2aed9b3527cc29178150696865d22a719b868
- SHA512 30cf1c5a676657006e5e94c8967df2f6596e801d865df2405231fe2fab9be759810e559a97ee7085e3dd1d84ede84862351a8cfa4181bafd96c2c95469ddc0ad
- SSDEEP 96:sfzpZNOxFG1cN3p3Rp/r8nPeY2BY2BY2BYX0gx3feXoMpB888888888888pGbPu8:sFZkxycNtfoPeYEYEYEYkm/MpB88888T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.JPG
- Size 30KB
- SHA256 6a321bbb3fc68ca597217b87c042b7f1f7b136cc1ddfb29f0dd396c14568e779
- MD5 f4e6420595b0418ac0379d33fd264fc0
- SHA1 c938bc5cad43977ad769f997a7da8d89bf9fa023
- SHA512 09f83e41a7b7fee76cde0ccd3461bcbd888c9dbed505f734af88ed11f97fc2217b3ec59f3e989c51be00786ec262f56f971ef8e138263dbf8f80f821477a240f
- SSDEEP 768:5HcEGJL4rLWmTfTWXWb6UWM58mAgXdmoG6ufEYRskITQUi:5vGuW3mqmAgSAYyTQUi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
- Size 4.9MB
- SHA256 328a619c49507fa22c2b5d41816fbd00395a97c275775a341f8b5ae2a54b255a
- MD5 8fe724c7dda6a2da19ff769b774092e5
- SHA1 d53eef3f5a88ebef4476a26e08294ca9d40d06bd
- SHA512 56b59b3f333afefa82b058041d05596069d3d25a4cc39deac074311fc94d8050cf8b91fec8f05660c665eeb986a151b360f35b0e3c349a4d55e9002c3483a62f
- SSDEEP 49152:ie7ANZGpIenJjYscBNEYTKFOtE8yYEncIQ3L3C2MBAEeX01UzKM7Jpcnz+voUr8U:b0FH0F83X3L3D7jcnq+6FDl+zeFJ1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
- Size 350KB
- SHA256 94527323fad2c5c04a765814511a9d0a760ebe489ebc17ac308d52d2240b8409
- MD5 d324ada9cd439bba70395997602f6e3f
- SHA1 73f49d146787c72416cbea119a46719f6c4b0393
- SHA512 d17f47f14bfb04d06f08a50ffb183015fb4eca4b7a37fff9c302c5ad958bd01b5f498a8cd4b4e2a1e50fe1437be8e4cf25ffb5920d15eef3e91040ba365a854b
- SSDEEP 6144:B69Kz8bp39xTdy2q7tJ8p4ac931N4cyZZ38ez0dokd:BGKz8FtxJTC8pfHJKdoC
- MD5 SHA1 SHA512 SSDEEP