a0c5041e32f1ebde261eb9daeb85ce9c5a3aeeaca33262d55e73d44da4b344e7

General

Target

setup.exe
Size

4.0MB
MD5

e49e7e5e95c9c86abbe66d2f6d7c6c1f
SHA1

8b7aafb26e8bae4ef5b0a8cafe3a2f514d9ea25d
SHA256

a0c5041e32f1ebde261eb9daeb85ce9c5a3aeeaca33262d55e73d44da4b344e7
SHA512

f625848971039b417d6630396a3e0c7353db15b6b1bf171e424e9462e04ae13b3c46ca416c4b6cb0bf038b4ddc94090b55dd42b3e88674271c7d2eb13d80ea66
SSDEEP

98304:pdlw2F+9nc637/IYLFfz47OFx6/c/7+evRxYO:22F+9c63TVfdnr/zxp

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4324	setup.tmp
2140	unins000.exe
1384	_iu14D2N.tmp

Loads dropped DLL 6 IoCs

pid	Process
4324	setup.tmp
4324	setup.tmp
4324	setup.tmp
4324	setup.tmp
4324	setup.tmp
4324	setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4324	setup.tmp
4324	setup.tmp

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4324	setup.tmp
4324	setup.tmp
1384	_iu14D2N.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 4324	3588	setup.exe	82
PID 3588 wrote to memory of 4324	3588	setup.exe	82
PID 3588 wrote to memory of 4324	3588	setup.exe	82
PID 4324 wrote to memory of 2140	4324	setup.tmp	89
PID 4324 wrote to memory of 2140	4324	setup.tmp	89
PID 4324 wrote to memory of 2140	4324	setup.tmp	89
PID 2140 wrote to memory of 1384	2140	unins000.exe	90
PID 2140 wrote to memory of 1384	2140	unins000.exe	90
PID 2140 wrote to memory of 1384	2140	unins000.exe	90

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Users\Admin\AppData\Local\Temp\is-9NLOS.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9NLOS.tmp\setup.tmp" /SL5="$1401C4,3485911,269824,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Games\LEGO Marvels Avengers\unins000.exe
    "C:\Games\LEGO Marvels Avengers\unins000.exe" /VERYSILENT /NODELSAVE
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\LEGO Marvels Avengers\unins000.exe" /FIRSTPHASEWND=$2024C /VERYSILENT /NODELSAVE
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Games\LEGO Marvels Avengers\unins000.dat

Filesize
27KB

MD5
3c0773e87e579e0c5ac431a0d18b5211

SHA1
1a647aa601ba166b5cedb99bd8f865d4604e135c

SHA256
82c61d2b852b297f0a44c227cbc65bca77d277ee21c29d945f6ffb60eede7521

SHA512
5fc750b35818a50fb9ee833e8e25dd7e8bd0be9add9b6846875236e4de28a413039716a03e667c04900055f222912803ee31a61696ed9b780f0aef5554164615

Download Submit
C:\Games\LEGO Marvels Avengers\unins000.exe

Filesize
1.3MB

MD5
5e73a2673c358a50439b2776cf0e9333

SHA1
f1efab803e94ab118d5872b19a582a5ca057bb4a

SHA256
3d6b74ae1d3df91882f3ef3a491f1e6084a9bea037515e4508bc6ff34baaa651

SHA512
afd8c59c153a3c13df01593890e83707513edd088170f066068a9957ddca7fe687a3252df55d415ffe011678fe0893d26001ee4d53af4c417912ba1f6f2ab03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6MVRF.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9NLOS.tmp\setup.tmp

Filesize
1.3MB

MD5
8a426240f636ac16d883651bdbb0924b

SHA1
2067d630c8cb75ff6afc3fb87b698fd925268b1f

SHA256
d279c47071900d7d893d70d79dbb92224ab909d24b11818fa1497b8ce9a62e80

SHA512
6e03076a97ecad676f63b2af4ddf884ba761d8ca053358aaf5ba791059f5d6ab1e6bb08c2a9ee7fe8221eb964086c1c637dcf7dd62781d24104667081870f1e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PI1HQ.tmp\ISDone.dll

Filesize
453KB

MD5
34b88e02562a274b786f3e2a2caa4697

SHA1
8e9b2217a223cb197537bf0d4e288f9152a2609d

SHA256
367e83cd3122c3ea8518bf080ae161d350a63a3eda13ab901997aa72b6217ac8

SHA512
2bdc4c145ee94224a9750fb81b1f7b3a968d525b3e8dad06ad9fbed2bfd4aab54425a0326a3a3e221863dd767a38898027b7912543bd178ef028995bae24deaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PI1HQ.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PI1HQ.tmp\callbackctrl.dll

Filesize
4KB

MD5
f07e819ba2e46a897cfabf816d7557b2

SHA1
8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

SHA256
68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

SHA512
7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PI1HQ.tmp\wintb.dll

Filesize
16KB

MD5
9436df49e08c83bad8ddc906478c2041

SHA1
a4fa6bdd2fe146fda2e78fdbab355797f53b7dce

SHA256
1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435

SHA512
f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf

Download Submit
memory/1384-100-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/1384-92-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/2140-88-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/2140-97-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/3588-43-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3588-124-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3588-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3588-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/4324-48-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/4324-56-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/4324-60-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/4324-62-0x000000006B080000-0x000000006B08D000-memory.dmp

Filesize
52KB

Download
memory/4324-20-0x00000000034F0000-0x0000000003567000-memory.dmp

Filesize
476KB

Download
memory/4324-7-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/4324-52-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/4324-53-0x00000000034F0000-0x0000000003567000-memory.dmp

Filesize
476KB

Download
memory/4324-50-0x000000006B080000-0x000000006B08D000-memory.dmp

Filesize
52KB

Download
memory/4324-44-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/4324-45-0x00000000034F0000-0x0000000003567000-memory.dmp

Filesize
476KB

Download
memory/4324-123-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/4324-46-0x000000006B080000-0x000000006B08D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing