Overview

overview

7

Static

static

1

Nextware_V033048.msi

windows10-2004-x64

6

RUN.bat

windows10-2004-x64

Analysis

  • max time kernel
    32s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 06:47

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    RUN.bat

  • Size

    828B

  • MD5

    d4dcacb2d8247368193696f5bacff810

  • SHA1

    ee2ec8d85a98d415d2aa30623a37ab01011407f5

  • SHA256

    c615c922a29d2083f6c9ef68cbfe110a3c0e315947eda9dcee74da8c35e84401

  • SHA512

    84f551d54ed1cc1df7361eb4092032665a87dcefa59c9b814fb28e76431133127ce109075f24d09327ffa3874f9ff12969bdafb1167942502166cb1028545547

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RUN.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:2396
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic product where "name='Nextware_V032932'" call uninstall /nointeractive
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3608
      • C:\Windows\system32\msiexec.exe
        msiexec /i "Nextware_V033048.msi" /qn
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4452
      • C:\Windows\system32\PING.EXE
        ping 127.0.0.1 -n 2
        2⤵
        • Runs ping.exe
        PID:3416
      • C:\Windows\system32\shutdown.exe
        shutdown -r -f -t 15
        2⤵
          PID:4632
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 16AFEE753C306B9ACA76548108248F58
          2⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1876
          • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2F893FF7-254F-4E24-8EFC-7714490BD047}
            3⤵
            • Executes dropped EXE
            PID:3520
          • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{07A6F4BB-8482-4EE5-93AA-C32F2EBD77DD}
            3⤵
            • Executes dropped EXE
            PID:2880
          • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B5008B21-AC0E-4FF2-9605-D90D20361B4A}
            3⤵
            • Executes dropped EXE
            PID:448
          • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{720800CB-AE68-4375-AB1B-3A58A7C9251F}
            3⤵
            • Executes dropped EXE
            PID:3764
          • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8EB778AE-B617-4F31-96BB-C50B61BC59AB}
            3⤵
            • Executes dropped EXE
            PID:2420
          • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CCBB6925-BCBC-487C-AD01-6F0A612CBA19}
            3⤵
            • Executes dropped EXE
            PID:3292
          • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F3438648-F8B7-4FA0-BE3D-FD1A179F6F56}
            3⤵
            • Executes dropped EXE
            PID:3536
          • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{80B400CA-7CA4-4884-A33D-3ABB28470BAB}
            3⤵
            • Executes dropped EXE
            PID:4272
          • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C89BFAF4-E2A8-4FA4-BA82-A3BCCAB9318B}
            3⤵
            • Executes dropped EXE
            PID:5084
          • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5CF27DE3-1442-4080-9743-5002CD364092}
            3⤵
            • Executes dropped EXE
            PID:4360
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa395e055 /state1:0x41c64e6d
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:3604

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e575dd2.rbs
        Filesize

        654KB

        MD5

        53fe3b025e7234410938118fdba506c7

        SHA1

        a3d1e897e541bb07a2f652a4a9dd3205685424b8

        SHA256

        13e69115dc57ff7be5f21accec0c37a1ab46935107d04977b206cf9545e80a57

        SHA512

        2afe5da131bd0234676455b091ff7f0d70baa781704272e0498d33cb4d5ec438932bc490143c1e4823f4836547da5ab1e083dc6bb4a96a0d8dcc46b05b8dcb58

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISBEW64.exe
        Filesize

        177KB

        MD5

        7eb57876ff781f17adce41ffc70d1f31

        SHA1

        3a358773608e315d8e1ec97476e670802e9f1ec6

        SHA256

        1f0d8dfbd8b2b9c0ceb8a827ffdd1559d1fb26e86836a9080dfd168759c03bbe

        SHA512

        d967395f5ddb5df40949a737ec9b4c5e675c0355733938d9a17801f98aad9af2fd2e6660786c13ebb2f2a66fcb76fc99ee064acd87796a7931e21a973772576e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\ISRT.dll
        Filesize

        422KB

        MD5

        77f4ad122b04f2e11d3841b611596785

        SHA1

        133d1935811929e5aa5bc0c97c826d0fe7c6b4fb

        SHA256

        eefcb7fb1ce56e30a8b6c82ba8afc4ecbbaaa50028104e5873de620fc3803982

        SHA512

        a4c10caa98887b158bd7513c6115ded655602bf5f129c2738c3428444a73a650fda69193c3e76d76c6a684d6c5977a7e0f69bbf3cc08d078b96fb4531d8ae901

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\{AB2F5AC0-7878-493D-B5B8-64AFDD374BBB}\_isres_0x0409.dll
        Filesize

        1.8MB

        MD5

        16113c70b9d149484530e8e71096d454

        SHA1

        bc04da8a76927ac88a77b6eafdfdbd0e8371f8d0

        SHA256

        a948907b44d23cf4797f984a875f7eecd3b8c4a81218d7b124708ec8d0f26062

        SHA512

        1d69d1342ef27c1508f8cf84750178037a17c00b6392be006fb2bb107420c32173dfc500047ef921158ccd0452daad7158a2641eae89925a85389b681c1a194a

        Download Submit

      • C:\Windows\Installer\MSI5E3D.tmp
        Filesize

        2.5MB

        MD5

        a050535fc7f71f6f92ae4a989b737ad1

        SHA1

        c5ba2b9178187e033f1cf27781000605e74d343f

        SHA256

        399aed01b905ef1a5b2f8def5d1b2f2c258b7ccc0be2fa90853f63a39d7bd3c3

        SHA512

        7480f330670e955eca6e93a951e4bfab69dc137ff5e29c1c36bf6f045db163a0c8ec2800a86317558604366576a9229259ae35ed834965bf624add81cccd0261

        Download Submit

      • C:\Windows\Installer\e575dcf.msi
        Filesize

        9.8MB

        MD5

        e67579e51e9a5853c34c08565ac6d37a

        SHA1

        8419a63958537c050f84694faa9f92098dd07180

        SHA256

        e2ae290e8a74a1864369730e469f2245c223149ad392a82b8a23314940c316a2

        SHA512

        d9ba71bb9a707b3e01c173c261a0e5fad5df26593645d167be6bb2fa07a9de05c3c653112a67426055858c7b71c2e454e20696e008e71a7191abc0548deeb6a3

        Download Submit

      • C:\Windows\Installer\{22FE95D5-ADE4-4BA0-A6FD-1F719CEE259B}\NewShortcut7_D201188D5C8A440A8812E37A9CBD6C21.exe
        Filesize

        44KB

        MD5

        463a689b634c44592a75c22751ccfe81

        SHA1

        28720ed46b1949b9a3abbb0b6874a0ac42af004b

        SHA256

        ce0f66b53b7b6b68acb8010418cbdec1d819dc660cd8c3816771d051c14ea2b5

        SHA512

        0b9a83ee8f7faf8cd3f63743ca1fdb7bce357f634d98cfb247921378b8eeaad171a9217f71cb33974daef9ea546597b24e4f9381e1aeaff9d680d1510defce26

        Download Submit

      • memory/1876-24-0x0000000010000000-0x0000000010112000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/1876-31-0x0000000002C20000-0x0000000002DE7000-memory.dmp

        Filesize

        1.8MB

        Download