Analysis
-
max time kernel
148s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01/07/2024, 12:32
General
-
Target
SamFwToolSetup.exe
-
Size
56.8MB
-
MD5
a3a38db6f62269ed7cee99fabb676135
-
SHA1
39f4958ae7481b2a3e7452c2dffb648ea5e200be
-
SHA256
7640282150d51c407ffdfe2fab35f2c60b93b0dc56ac93ad2459b16789aec61b
-
SHA512
e340b323bba664fd2b2d819da151c886ec66849ba3798377cf0e8cbcf253f9604ce248e62b22ac184939e5947f87a2f5964ee649099d6d14971c71270894771d
-
SSDEEP
1572864:lCRAP2DnTG0r6OFxObdjUW8Odiw1NF3Zh4aNfv/VG:lDknTdGO2ZjUezFjv9G
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SamFwToolSetup.exe"C:\Users\Admin\AppData\Local\Temp\SamFwToolSetup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-65174.tmp\SamFwToolSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-65174.tmp\SamFwToolSetup.tmp" /SL5="$B004E,58690757,832512,C:\Users\Admin\AppData\Local\Temp\SamFwToolSetup.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\SamFwTool\data\7za.exe"C:\SamFwTool\data\7za.exe" x "C:\SamFwTool\data.7z" -o"C:\SamFwTool\" * -r -aoa3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\SamFwTool\SamFwTool.exe"C:\SamFwTool\SamFwTool.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16.0MB
MD599b1e36598e55933e350430519b53b34
SHA1202174440b5bbf8483e60a209b33f92576d5e0a9
SHA25672b4e02b59b6cf1bfec786e2b1acf98d31cdceb906beb115b52f3bbf07e02fb3
SHA5121db4ff19d90bc4fd909c29cff97c08bf60ab0a9673a2bab5756b17646213c397e552079519e7f5193fe7bdd7320d5d8456036273ae96b62a98c525e5c22d0eaa
-
Filesize
39.6MB
MD5e2a12d6e1340e12e29f8d5113fabb6eb
SHA1f57e4a9e4b39018cd8aa294ffb372e3dd5071d7b
SHA25677a2961a5c03c5c972e53083ddc81c37b3aa3dc6b2dbf4934064035949fa4b9f
SHA5129d5e658a8cb68ea01e11dc26ce713a091088d7629d2baff20cf9b43002c55e15eca3ec7dcbc53bf5e4a4b8b3d98b5f649f59280c4a625f239474a87b79174424
-
Filesize
676KB
MD52e3309647ce678ca313fe3825a57ccb9
SHA1792fdeccddd3cc182eac3a1ecd7affe5b48262c8
SHA256e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4
SHA5125eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc
-
Filesize
166KB
MD53935ec3158d0e488da1929b77edd1633
SHA1bd6d94704b29b6cef3927796bfe22a2d09ee4fe7
SHA25687cbd1f3bf5ab72089a879df110263784602a574c0ae83f428df57ae2f8115db
SHA5125173891b1dfad2298910236a786c7b9bbcfce641491a25f933022088c81465fb93fd2385d270e9a0632f674355538da464d1edacf511140d6f31d91d1afe64fc
-
Filesize
3.1MB
MD5c40a8a7891124f63f741ee4e36ae459c
SHA112fbe834dd5d52cdb4dddca392604721872d259d
SHA2567e865f2ab27c2cdc895cc42ba887c4968a85619d435d74c556cc8f8ce47e615c
SHA512f7043fc31cd692eb52b00a24f3085609b0c616b04b7ec0ff22c7d34d27c34c07ec7f27424256fec2cf975ddc277c2005cc96e3668bf11ad112db77b750e9d92a
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
12.2MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
472KB
-
Filesize
208KB
-
Filesize
584KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
728KB
-
Filesize
864KB