e984a62feb739ce0a07f1d2397bdad1cf99fa7b5f4b33abccd89a2361b441b9a

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Muon Tau Bassline Mk2 VSTi v10/Setup/Setup.exe
Size 1.6MB
Sample240613-b595tszdja
SHA256 a8d56c67cb1f4c27aa998dedaf7bcd38fd95f303e00beb6d27a6118ec46349a1
MD5 a519799ff8753e9561d7571b4521a6e0
SHA1 7edd216f6941837b42f5e14ddf5d6aa18c18eb80
SHA512 d0fe36a8d8b53cddeade36c8368bcec2be2ab59fc9fc6a5f9b090f4b1cd02769cf381c62488a8a624de23c6c055adc5270e85b72aa5d8281e79a169b99ce3ea8
SSDEEP 49152:q3uyvd1Uct3E7Lv1X/lKmgjM5U2TwfSj5TI6:q+yvX9E7b1X/lxgAUFfSj5TL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
676	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
676	irsetup.exe
676	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 676	648	Setup.exe	90
PID 648 wrote to memory of 676	648	Setup.exe	90
PID 648 wrote to memory of 676	648	Setup.exe	90

C:\Users\Admin\AppData\Local\Temp\Muon Tau Bassline Mk2 VSTi v10\Setup\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Muon Tau Bassline Mk2 VSTi v10\Setup\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Users\Admin\AppData\Local\Temp\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\irsetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IRIMG1.BMP

Path C:\Users\Admin\AppData\Local\Temp\IRIMG1.BMP
Size 7KB
SHA256 64349bc9c60a2e3fc75792f3e882adfe331f33809e99cdb9bb33da926d26e82c
MD5 3fd06a0a07335fa2855f0fe5b4104981
SHA1 329796d0523b15e47cebd6b220c104e9a7a4778b
SHA512 f1802e76baa72590fd9da2503a27957b59490db775a95b86d19583770adff4a090ba127c0932f17d8d3c6af265ad2a7061858bf1995ba4b647c70f116b0e73ff
SSDEEP 96:hUWbPcBQTnfl1HaxleqMQfSpBFYvSWKWgD6RsMai3DZvBn+yAmYoxBC9ysv3KXSt:hU/QDwqQmFYDvzrZ3DZvBHC8sE9uf
MD5 SHA1 SHA512 SSDEEP

Submit Download

IRIMG2.BMP

Path C:\Users\Admin\AppData\Local\Temp\IRIMG2.BMP
Size 7KB
SHA256 cb6a88b59e1ef7ffd02813fc0de44d6751a6f3ee22973d32d5f7be1cd286a0e4
MD5 6e8bc79c0dbc46629977e63be936c984
SHA1 73b960c4ef13f63775cb7220d09bbd6cce134b5f
SHA512 a5d6af026bcd8d303671692996b42e0d268fec0e42e2d9e532d2d696b4540116616e4eeff978bcfbcd962b475e83a36ef6cb4eedc1ffc4ca789437fdc12446af
SSDEEP 96:7mxboKBySTDqLqMKMCXbJtpPa3vj04IeuJ8SRP88zAM6mWkgb54E5f:7mxb9Q3cXbJbPQjFudRPPzAHmWjb54sf
MD5 SHA1 SHA512 SSDEEP

Submit Download

irsetup.dat

Path C:\Users\Admin\AppData\Local\Temp\irsetup.dat
Size 7KB
SHA256 719dea86aab9f76de6e611d2e314b6dc372cc46c48db35c2bd2cdd31c6c85bbc
MD5 fbd521205b0406bd8bb82feea70674fb
SHA1 f577f3cb2cc6eb2f4719205df2fb062d66e17b11
SHA512 015118c90c98726e3616cfe92d3c1018941870514f141a92689b224f6686162d6b030f7b097ba00644aaacb1978036021834bac283e24b0cf9ced17caaab77f8
SSDEEP 192:lAsJRAEIAOApGrAb2NAr/mEgTgx5zUgRAKA3xcKHf:l5zBIRrrL6ZZRxwxcKHf
MD5 SHA1 SHA512 SSDEEP

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\irsetup.exe
Size 704KB
SHA256 ff0b872a6b7dcdab47e13b3dc6cad51934d1923f0e70a84e595fb7dcf300dc7a
MD5 65577ef62a45aa9a29639bec2649fb72
SHA1 80836c68ae49434adcbb300ba36c9530f09f81d2
SHA512 2e04a1fecd1528b42809b4d0d2ac637a0fc8a7820879b61935ae462feed45e7356390481c5965663ef08e46c61a6a97a64b73b20fb8be489693b2d58c1aad4d1
SSDEEP 12288:HrbsLzB6op883NNU8xNM0B1Q1nmscUMXpShs1iV45j5wgpwuVmhVfPQbUhM6:Hr8V3QBtRMZSS1iyHnwomh5Po
MD5 SHA1 SHA512 SSDEEP

Submit Download

irsetup.ini

Path C:\Users\Admin\AppData\Local\Temp\irsetup.ini
Size 115B
SHA256 575a7b018f13c7b24a2c3a0f4858e441a4e3b3cc42b24c3cc01879124cb4e988
MD5 5f0314e3318faf2a237586cdc6288a3e
SHA1 ca5db47b5811eb440c6eed3e60161a10016cc9a1
SHA512 713a1c7e1299a0237496a72774f8c564b6a3a034dd6c511e41896c73ecb03aa9952dcabc165dfbdfbf754bc9623694318a5c6cdd25045ae66b42972af12a4d9b
MD5 SHA1 SHA512

Submit Download

suf6lng.9

Path C:\Users\Admin\AppData\Local\Temp\suf6lng.9
Size 15KB
SHA256 de4baa540b128b303c3bd6f33e1f7ee7b840143fbdaa3f931519a36d6e9063bc
MD5 65a07854a4ac46c7fcdfafce978a032d
SHA1 2766e37c4a49c4a2b65593061e59ce8e49363c25
SHA512 0e6ce00d1d34042fa4aa3e273b186de0bc600197dce37a9418f8653f8d6bb507d4c78d33804cbf7740e02920d4962de684060a5463df458f3764033a4da045c8
SSDEEP 192:or8WiNJI5sPVjUAZ/PH6DQCjyeXl0vFCslNb3arIlguAOal4jBqr+D0bLoGofxXB:8f5sHZ3a03u0tCsl7gf4o+YX+x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads