Overview

overview

10

Static

static

3

FastAimX64.exe

windows7-x64

8

FastAimX64.exe

windows10-2004-x64

8

Automatic_...p4.exe

windows7-x64

10

Automatic_...p4.exe

windows10-2004-x64

10

install.bat

windows7-x64

1

install.bat

windows10-2004-x64

1

install_python.bat

windows7-x64

8

install_python.bat

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2024, 06:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FastAimX64.exe
  • Size 36.9MB
  • Sample240701-gseq2s1ejn
  • SHA256 7e190e48165cf7c72173ce84e0f0b164fbe794d3e45069408055ba7496da1497
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Powershell Invoke Web Request.

    execution
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 30 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\FastAimX64.exe
    "C:\Users\Admin\AppData\Local\Temp\FastAimX64.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MyApp\install_python.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5112
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4700
      • C:\Windows\SysWOW64\curl.exe
        curl -L -o python-installer.exe https://www.python.org/ftp/python/3.10.9/python-3.10.9-amd64.exe
        3⤵
        • Drops file in Program Files directory
        PID:3392
      • C:\Program Files (x86)\MyApp\python-installer.exe
        python-installer.exe /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Windows\Temp\{44BAE41B-50BF-47EE-9CF5-0FC8A8CA1D24}\.cr\python-installer.exe
          "C:\Windows\Temp\{44BAE41B-50BF-47EE-9CF5-0FC8A8CA1D24}\.cr\python-installer.exe" -burn.clean.room="C:\Program Files (x86)\MyApp\python-installer.exe" -burn.filehandle.attached=552 -burn.filehandle.self=560 /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1392
          • C:\Windows\Temp\{CBD32421-C4E1-480B-8A93-71CDA562A703}\.be\python-3.10.9-amd64.exe
            "C:\Windows\Temp\{CBD32421-C4E1-480B-8A93-71CDA562A703}\.be\python-3.10.9-amd64.exe" -q -burn.elevated BurnPipe.{26768FDA-BB6C-490F-AA6A-8FE6356765A2} {4832029F-7DA8-43FC-ABB1-3FD37D73F6D6} 1392
            5⤵
            • Executes dropped EXE
            PID:3780
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2860
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4428
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
        PID:4380
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4500
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
          PID:892
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdb9d09758,0x7ffdb9d09768,0x7ffdb9d09778
            2⤵
              PID:2480

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e59c211.rbs
                • Path C:\Config.Msi\e59c211.rbs
                • Size 8KB
                • SHA256 ef1fc15bc7bd68d817c3d60919ff129055a62bab30eae232b70a5bce1e0095cb
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                e59c216.rbs
                • Path C:\Config.Msi\e59c216.rbs
                • Size 12KB
                • SHA256 243515709a39a04c3464a3eb46e767a80797392ac871d53f564679e45e794e6c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                e59c21b.rbs
                • Path C:\Config.Msi\e59c21b.rbs
                • Size 40KB
                • SHA256 aad798bfb7ea082b786c45a3f23d178769132a54cb56b64a11c7f70664dc9198
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                e59c220.rbs
                • Path C:\Config.Msi\e59c220.rbs
                • Size 179KB
                • SHA256 a0888673a903c51f0885b9d14786b1111eb8fba8915e4b72944bbd549f599d07
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                e59c225.rbs
                • Path C:\Config.Msi\e59c225.rbs
                • Size 29KB
                • SHA256 a19439d3589b469d88eb2dacdfa756b781c031a5bda1395ec50aca1849d36682
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                install_python.bat
                • Path C:\Program Files (x86)\MyApp\install_python.bat
                • Size 686B
                • SHA256 94008c8135d149fecd29ca62aded487f0fbfa6af893596ffc3e4b621a0fe4966
                • MD5 SHA1 SHA512
                Submit Download

                python-installer.exe
                • Path C:\Program Files (x86)\MyApp\python-installer.exe
                • Size 27.6MB
                • SHA256 b8c707fb7a3a80f49af5a51c94f428525a3ad4331c7b9e3b2e321caf5cb56d7d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                lib_JustForMe
                • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
                • Size 8.0MB
                • SHA256 82863adf2f36198611da2238991d9c8032c6cf59c3d2dd125658358b6672f3ce
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                tcltk_JustForMe
                • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
                • Size 3.4MB
                • SHA256 eaf03e94a9f3421a69b9fd8a1f0723ebc4e59884f6c5b93f330d7fbc98d8940f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                tools.msi
                • Path C:\Users\Admin\AppData\Local\Package Cache\{1F097B66-81E9-46FB-BBAC-315C5F50CF94}v3.10.9150.0\tools.msi
                • Size 212KB
                • SHA256 0c32783b07c04ffb8a923ecd9c097061a693a9e882dfbb7cc9aedad7be486f76
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                core.msi
                • Path C:\Users\Admin\AppData\Local\Package Cache\{9802C929-A3F0-480D-A4B2-DAD129F2236E}v3.10.9150.0\core.msi
                • Size 1.6MB
                • SHA256 107453ad1bb2d97c4947ba12d91738e7e7aa43470f9a8f954383fa6eb483b707
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                dev.msi
                • Path C:\Users\Admin\AppData\Local\Package Cache\{E2BC2EBD-7260-458B-A42C-3322DCB0B82F}v3.10.9150.0\dev.msi
                • Size 300KB
                • SHA256 068163c992a1e372c8e23d69f8ad13e2a9e01be2649c9845d450aad5a7a6eff9
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                exe.msi
                • Path C:\Users\Admin\AppData\Local\Package Cache\{F115E5B8-9719-4BDF-8B0D-551809BB677D}v3.10.9150.0\exe.msi
                • Size 608KB
                • SHA256 7a6715deb76123241816c77c6cc5dc4e6a881bb8de846c454f0d5cd833305cb2
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Python 3.10.9 (64-bit)_20240701060452_000_core_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_000_core_JustForMe.log
                • Size 1KB
                • SHA256 53b1dedb6b21bb0345d4f6aff37015f4d2e1e4707c378137ffaba95bf6d20d18
                • MD5 SHA1 SHA512
                Submit Download

                Python 3.10.9 (64-bit)_20240701060452_001_exe_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_001_exe_JustForMe.log
                • Size 1KB
                • SHA256 7b2bc38f5abb49ca00bb9e036eb7a20f83d00a43e497a57dd2ad96aeee4dc036
                • MD5 SHA1 SHA512
                Submit Download

                Python 3.10.9 (64-bit)_20240701060452_002_dev_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_002_dev_JustForMe.log
                • Size 1KB
                • SHA256 b0a5a74f5e70e37e876312b46f13dfd4c1374d320ec47c2310af9ae86ada38df
                • MD5 SHA1 SHA512
                Submit Download

                Python 3.10.9 (64-bit)_20240701060452_003_lib_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_003_lib_JustForMe.log
                • Size 1KB
                • SHA256 9975c5bb6748d36a3e6aa7ed4ca35be63e0e32f2e7fab992f8d54a8b235d0288
                • MD5 SHA1 SHA512
                Submit Download

                Python 3.10.9 (64-bit)_20240701060452_004_tools_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_004_tools_JustForMe.log
                • Size 1KB
                • SHA256 5b862af57f18604c6ffd4d06e3534714e84f96bd3afd0a8d2ca07a9805031ded
                • MD5 SHA1 SHA512
                Submit Download

                Python 3.10.9 (64-bit)_20240701060452_005_tcltk_JustForMe.log
                • Path C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_005_tcltk_JustForMe.log
                • Size 1KB
                • SHA256 6d422f2f5f06028fdf584f1338cdb72882a49ad79c14c86ccf4befe002f901e1
                • MD5 SHA1 SHA512
                Submit Download

                __PSScriptPolicyTest_k4hblizl.n3z.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k4hblizl.n3z.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512
                Submit Download

                python-installer.exe
                • Path C:\Windows\Temp\{44BAE41B-50BF-47EE-9CF5-0FC8A8CA1D24}\.cr\python-installer.exe
                • Size 849KB
                • SHA256 ae5f3d9aaf871d4cf62b3106a7babb66a5c52fdf5ea9b93467c45bd047319c66
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                PythonBA.dll
                • Path C:\Windows\Temp\{CBD32421-C4E1-480B-8A93-71CDA562A703}\.ba\PythonBA.dll
                • Size 650KB
                • SHA256 c016025b6e3c1335eef8f544cb88a948d7c785fd5247b994c8ec91a4fce5f899
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SideBar.png
                • Path C:\Windows\Temp\{CBD32421-C4E1-480B-8A93-71CDA562A703}\.ba\SideBar.png
                • Size 50KB
                • SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                launcher_AllUsers
                • Path C:\Windows\Temp\{CBD32421-C4E1-480B-8A93-71CDA562A703}\launcher_AllUsers
                • Size 516KB
                • SHA256 d557952fdea4a50bd4901cf6152e17e46168fedb663080aaf438da80926921b7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/4700-26-0x0000000006170000-0x00000000061BC000-memory.dmp
                Download

                memory/4700-14-0x0000000005960000-0x00000000059C6000-memory.dmp
                Download

                memory/4700-28-0x0000000007610000-0x0000000007C8A000-memory.dmp
                Download

                memory/4700-27-0x0000000073AB0000-0x0000000074260000-memory.dmp
                Download

                memory/4700-32-0x0000000073AB0000-0x0000000074260000-memory.dmp
                Download

                memory/4700-25-0x0000000005940000-0x000000000595E000-memory.dmp
                Download

                memory/4700-20-0x00000000059D0000-0x0000000005D24000-memory.dmp
                Download

                memory/4700-29-0x0000000006420000-0x000000000643A000-memory.dmp
                Download

                memory/4700-13-0x00000000058B0000-0x0000000005916000-memory.dmp
                Download

                memory/4700-12-0x0000000005810000-0x0000000005832000-memory.dmp
                Download

                memory/4700-11-0x00000000050B0000-0x00000000056D8000-memory.dmp
                Download

                memory/4700-10-0x0000000073AB0000-0x0000000074260000-memory.dmp
                Download

                memory/4700-9-0x0000000073AB0000-0x0000000074260000-memory.dmp
                Download

                memory/4700-8-0x0000000002920000-0x0000000002956000-memory.dmp
                Download

                memory/4700-7-0x0000000073ABE000-0x0000000073ABF000-memory.dmp
                Download