Analysis
- max time kernel
258s - max time network
273s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2024, 17:06
Static task
static1
Behavioral task
behavioral1
Sample
wlsetup-all.exe
Resource
win7-20240221-en
23 signatures
300 seconds
Behavioral task
behavioral2
Sample
wlsetup-all.exe
Resource
win10v2004-20240611-en
2 signatures
300 seconds
General
- Target wlsetup-all.exe
- Size 131.0MB
- Sample240620-vmp7gssfkn
- SHA256 072424c82f942f2b43b68b9154e1f3e0c61b7ee39a08372048ed34e09bd2554a
- MD5 906689a666d3d9ab4cc951ed6354d0b1
- SHA1 14e848bd6b69c4c94c65dd87c1cf70bf8f00992d
- SHA512 acc63586c9ef81fceb20ada7ecedd9db390ab7273060e50079e03296e13aab6944140fcd186c4f1263ec497ba1e79100079800718a0911c8f50a7aacf508353a
- SSDEEP 3145728:r4jjdxiTIhcTDaT67AaQIxCYMBS4UR8RZuMcUvEkjvHjX:r+WIhGIoXsG8ruMcRkjvz
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Windows Live\.cache wlsetup-all.exe File opened for modification C:\Program Files (x86)\Common Files\Windows Live\.cache\wlc5249.tmp wlsetup-all.exe File opened for modification C:\Program Files (x86)\Common Files\Windows Live\.cache\cache.ini wlsetup-all.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4704 wlsetup-all.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~3\MICROS~1\WLSetup\wlt51FA.tmp
- Size 225KB
- SHA256 21679dca7b22f90fb864b4a30d7ef032710804b04bfd9c369305f50d8ad6e81c
- MD5 cbf9a63a3faccbb98f8056b9ee1118e3
- SHA1 2a1404023097cdfc07a578e0a8b5b5abe4db7b90
- SHA512 b20458b6c80503e62a282c872dfa4fb40b53bbc079ab43ce721f47910b72cc7e5cb77123b5da8e4b72fb0a2b87b4151bd5467ef7fa2f7424ed49762b25184d47
- SSDEEP 3072:C9wG719ZYOA7uH847WMvL6vNM4vjhdZAt0X8wBo0PDkiCY1S78FCHscxSMNJ8b:Cf77ZcCHJvL6vRr2V48Y1jCQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\062017~1\tmp4FF5.tmp
- Size 38KB
- SHA256 ac1a5b92fc478ed69aec3d94c6c0ba328789bb4e44a9c56598a4f961edfcb09c
- MD5 8274c233094ab59f40135619f32848cc
- SHA1 cb588154fc7e951e0199d2a56dc494010e7a994f
- SHA512 08434975e41233ac9efe507d87743fa3962321b2b556b1066514745d9a885f62ceab2d0bb6eb8d045186e5b9d1efee561851a7fdd5726495658ebf4d7693d105
- SSDEEP 768:R356tH8+laSVtixuQKhzxxoZRheuTwpitc3IW0R8atJAwDbBcfSLMi2jpvs0:RpqH8+kkkuQKhzLozhH0pnk8atXDbBcx
- MD5 SHA1 SHA512 SSDEEP