Analysis
- max time kernel
213s - max time network
282s - platform
windows11-21h2_x64 - resource
win11-20240611-en - resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system - submitted
13/06/2024, 23:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AutoInstall.bat
Resource
win11-20240508-en
windows11-21h2-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
CommandLine.exe
Resource
win11-20240611-en
windows11-21h2-x64
7 signatures
300 seconds
Behavioral task
behavioral3
Sample
Commands.chm
Resource
win11-20240419-en
windows11-21h2-x64
1 signatures
300 seconds
General
- Target CommandLine.exe
- Size 51.6MB
- Sample240613-31e8fazfpp
- SHA256 6a82152992020dcd185d7a52cffac8ab63278c53430750cb21c52697c619e536
- MD5 7e58e18cf6a0d332dafbc05f95952f54
- SHA1 356c8843b342dfea946d98bfd54972bc5a641651
- SHA512 1ca694bdc9f80a884f8e522a210f5366efc6d6b71decd302231aa02d9f756050b6a1097486c6a3214e8c94a008a3f1ece2dc1a299e14c8bc6993112bfd20e952
- SSDEEP 1572864:jeyj8XKQGQkejX7uGzv+sU56tpnD0tm/V:yq8asJv+sU5snDQmN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3288 irsetup.exe - Loads dropped DLL 1 IoCs
pid Process 3288 irsetup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 44 IoCs
description ioc Process File opened for modification C:\Program Files\CommandLine\build\CommandLine\Tree-01.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\Tree-02.toc irsetup.exe File created C:\Program Files\CommandLine\icons\commandline.ico irsetup.exe File opened for modification C:\Program Files\CommandLine\Uninstall\uninstall.dat irsetup.exe File created C:\Program Files\CommandLine\uninstall.exe irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\Analysis-00.toc irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\base_library.zip irsetup.exe File created C:\Program Files\CommandLine\Uninstall\IRIMG1.JPG irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\CommandLine.exe.manifest irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\PYZ-00.pyz irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\warn-CommandLine.txt irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\warn-CommandLine.txt irsetup.exe File opened for modification C:\Program Files\CommandLine\CommandLine.spec irsetup.exe File opened for modification C:\Program Files\CommandLine\Uninstall\IRIMG1.JPG irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\Tree-01.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\CommandLine.exe.manifest irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\EXE-00.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\PYZ-00.pyz irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\PYZ-00.toc irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\CommandLine.pkg irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\PKG-00.toc irsetup.exe File opened for modification C:\Program Files\CommandLine\Uninstall\uniFD6B.tmp irsetup.exe File created C:\Program Files\CommandLine\Uninstall\uniFD6B.tmp irsetup.exe File created C:\Program Files\CommandLine\CommandLine.spec irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\Analysis-00.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\Tree-00.toc irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\Tree-00.toc irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\Tree-02.toc irsetup.exe File opened for modification C:\Program Files\CommandLine\icons\commandline.ico irsetup.exe File created C:\Program Files\CommandLine\lua5.1.dll irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\base_library.zip irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\EXE-00.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\PKG-00.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\CommandLine.pkg irsetup.exe File opened for modification C:\Program Files\CommandLine\build\CommandLine\xref-CommandLine.html irsetup.exe File created C:\Program Files\CommandLine\Uninstall\IRIMG2.JPG irsetup.exe File created C:\Program Files\CommandLine\Uninstall\IRIMG3.JPG irsetup.exe File created C:\Program Files\CommandLine\Uninstall\uninstall.dat irsetup.exe File opened for modification C:\Program Files\CommandLine\Uninstall\uninstall.xml irsetup.exe File created C:\Program Files\CommandLine\CommandLine.exe irsetup.exe File opened for modification C:\Program Files\CommandLine\CommandLine.exe irsetup.exe File created C:\Program Files\CommandLine\Uninstall\uninstall.xml irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\PYZ-00.toc irsetup.exe File created C:\Program Files\CommandLine\build\CommandLine\xref-CommandLine.html irsetup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3288 irsetup.exe 3288 irsetup.exe 3288 irsetup.exe 3288 irsetup.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4412 wrote to memory of 3288 4412 CommandLine.exe 80 PID 4412 wrote to memory of 3288 4412 CommandLine.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\CommandLine.exe"C:\Users\Admin\AppData\Local\Temp\CommandLine.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5617698 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\CommandLine.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1276817940-128734381-631578427-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\CommandLine\Uninstall\IRIMG2.JPG
- Size 49KB
- SHA256 cbf37d70834a4f739db3c649cdf38f5abb9d78582f71a65f95bd40619ea57ac9
- MD5 6e6a077e106d26ba4a7064c355472cde
- SHA1 878ab7196eff24b8967ab98c4e930758d2574fc2
- SHA512 3b1c0f1893e78047989142435f26eee89980470b44dcf9442787799b7e81d0f4153bd7950876aea8313e2a1f460b2094630b674e1630965ed5b003242560260a
- SSDEEP 1536:Kd3icoK/7NbTnbCACOkP5yDS53ZuZU2ozT:MVNvbr9SZuZU9/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\CommandLine\Uninstall\uninstall.xml
- Size 4KB
- SHA256 d875985090ca0fc1ac15dffdacbde7424dc7e3b50f99518f64325a04b2f53d3e
- MD5 fe8247a981df71d5e172c3f7c2a02484
- SHA1 1c25764133efc56e84ebdf7b81d83849b1a9ae3d
- SHA512 4a8bd546d3ca390c56931502367c779521f932bce69ed44c4b39ec6bff49e37367af533a0ff8d4196044d10cfea103b578e0d7406e16d73d70d489de7dd74f6e
- SSDEEP 96:kT1uMOVFHs+VFH1VFHUVFHwlVFHnVFH5VFHwEVFHxVFHGVFHKaVFHKrVFHKYVFHq:eIVFHjVFH1VFHUVFHgVFHnVFH5VFHwEu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\CommandLine\Uninstall\uninstall.xml
- Size 10KB
- SHA256 2261b121d0542406ff0b52f1f3487b6fcfb9816ef31063d91a451e6a255035d9
- MD5 a4144f4e45042a412a2b6da00050c918
- SHA1 07f6cc5958971cc38d5f5e13a6635cdbaeb85501
- SHA512 73311c0060971e265b9308f8c7b0d3d44b482d27ace4c0db5a55b3b54086734c67ccacc220bde4682d008e36e0a41460054212d8ac28629af9b24bf5f01a8093
- SSDEEP 192:eFVFHjVFH1VFHUVFHgVFHnVFH5VFHwEVFHxVFHGVFHTVFHCVFHJVFHcVFHoVFHK3:lZcCX+ON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG
- Size 5KB
- SHA256 d5e3cd5adcfdc47b3b9ed57c59960efc8792a820e404ac8dda85ef943de7904b
- MD5 d472a0189aa52f36633ac3d89f5e1219
- SHA1 4fb2aed9b3527cc29178150696865d22a719b868
- SHA512 30cf1c5a676657006e5e94c8967df2f6596e801d865df2405231fe2fab9be759810e559a97ee7085e3dd1d84ede84862351a8cfa4181bafd96c2c95469ddc0ad
- SSDEEP 96:sfzpZNOxFG1cN3p3Rp/r8nPeY2BY2BY2BYX0gx3feXoMpB888888888888pGbPu8:sFZkxycNtfoPeYEYEYEYkm/MpB88888T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.JPG
- Size 30KB
- SHA256 6a321bbb3fc68ca597217b87c042b7f1f7b136cc1ddfb29f0dd396c14568e779
- MD5 f4e6420595b0418ac0379d33fd264fc0
- SHA1 c938bc5cad43977ad769f997a7da8d89bf9fa023
- SHA512 09f83e41a7b7fee76cde0ccd3461bcbd888c9dbed505f734af88ed11f97fc2217b3ec59f3e989c51be00786ec262f56f971ef8e138263dbf8f80f821477a240f
- SSDEEP 768:5HcEGJL4rLWmTfTWXWb6UWM58mAgXdmoG6ufEYRskITQUi:5vGuW3mqmAgSAYyTQUi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
- Size 4.9MB
- SHA256 328a619c49507fa22c2b5d41816fbd00395a97c275775a341f8b5ae2a54b255a
- MD5 8fe724c7dda6a2da19ff769b774092e5
- SHA1 d53eef3f5a88ebef4476a26e08294ca9d40d06bd
- SHA512 56b59b3f333afefa82b058041d05596069d3d25a4cc39deac074311fc94d8050cf8b91fec8f05660c665eeb986a151b360f35b0e3c349a4d55e9002c3483a62f
- SSDEEP 49152:ie7ANZGpIenJjYscBNEYTKFOtE8yYEncIQ3L3C2MBAEeX01UzKM7Jpcnz+voUr8U:b0FH0F83X3L3D7jcnq+6FDl+zeFJ1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
- Size 350KB
- SHA256 94527323fad2c5c04a765814511a9d0a760ebe489ebc17ac308d52d2240b8409
- MD5 d324ada9cd439bba70395997602f6e3f
- SHA1 73f49d146787c72416cbea119a46719f6c4b0393
- SHA512 d17f47f14bfb04d06f08a50ffb183015fb4eca4b7a37fff9c302c5ad958bd01b5f498a8cd4b4e2a1e50fe1437be8e4cf25ffb5920d15eef3e91040ba365a854b
- SSDEEP 6144:B69Kz8bp39xTdy2q7tJ8p4ac931N4cyZZ38ez0dokd:BGKz8FtxJTC8pfHJKdoC
- MD5 SHA1 SHA512 SSDEEP