Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03-07-2024 13:40
General
-
Target
Keyscape_Patch_Library_Update_1_6_0c.7z
-
Size
115.5MB
-
MD5
a081c39479edc4ff4de4095e99cbbc30
-
SHA1
547feb409db1aec87e169136508d216ef7714946
-
SHA256
44ccbfa290da0ee7b940747f925789f66152b0bee5eec3380766d09d9b518f0d
-
SHA512
8425d240bdb07a441424037c2f6e2995fb282a8a375950e33487a5904525910b3f2cd6f69856246d84efbe4d5989791b1326121b5668567bcaec5e4f89415a70
-
SSDEEP
3145728:73it/h2wvRCxIsv8Nro6y7txE6FDdlZ1ax:7ive0PUE0ax
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Keyscape_Patch_Library_Update_1_6_0c.7z1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Keyscape_Patch_Library_Update_1_6_0c.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Keyscape_Patch_Library_Update_1_6_0c\Spectrasonics - Keyscape v1.5.0c -MORiA.exe"C:\Users\Admin\Desktop\Keyscape_Patch_Library_Update_1_6_0c\Spectrasonics - Keyscape v1.5.0c -MORiA.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FPJOS.tmp\Spectrasonics - Keyscape v1.5.0c -MORiA.tmp"C:\Users\Admin\AppData\Local\Temp\is-FPJOS.tmp\Spectrasonics - Keyscape v1.5.0c -MORiA.tmp" /SL5="$2024A,16753967,1187328,C:\Users\Admin\Desktop\Keyscape_Patch_Library_Update_1_6_0c\Spectrasonics - Keyscape v1.5.0c -MORiA.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\Desktop\Keyscape_Patch_Library_Update_1_6_0c\Windows\Keyscape Data Updater.exe"C:\Users\Admin\Desktop\Keyscape_Patch_Library_Update_1_6_0c\Windows\Keyscape Data Updater.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-748RT.tmp\Keyscape Data Updater.tmp"C:\Users\Admin\AppData\Local\Temp\is-748RT.tmp\Keyscape Data Updater.tmp" /SL5="$A01F4,57856,57856,C:\Users\Admin\Desktop\Keyscape_Patch_Library_Update_1_6_0c\Windows\Keyscape Data Updater.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Users\Admin\Desktop\Keyscape_Patch_Library_Update_1_6_0c\Windows\Keyscape Data Updater.exe"C:\Users\Admin\Desktop\Keyscape_Patch_Library_Update_1_6_0c\Windows\Keyscape Data Updater.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1TSQQ.tmp\Keyscape Data Updater.tmp"C:\Users\Admin\AppData\Local\Temp\is-1TSQQ.tmp\Keyscape Data Updater.tmp" /SL5="$7021C,57856,57856,C:\Users\Admin\Desktop\Keyscape_Patch_Library_Update_1_6_0c\Windows\Keyscape Data Updater.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
MD5aa806a4551f668e6b07f6698faea0c73
SHA1feab23804a39666e3f15910b8828bbe032044404
SHA25619feb9bd6d8430a7a6a3e710879ae5ae58d81875151b883c0cce6f12aa671f2e
SHA512a3fadb75538cae874851f451ffd38d3c936d02b35beb98af28161b4b00a19a25691d277b25737735b5557c32a0e0522753cf25aa42e971506e773c6b24d7c0ac
-
Filesize
152KB
MD53924b50a894d15e508b6389caee45c06
SHA17d4a0e852ef5300f46637c83af21fb193d95212d
SHA2567dfd62c24ed6612343a62c094cf9173dced77a831b43901e1002bfaacee0f8a0
SHA5120e862fefc99014cf9ddcbd4c1bc04ad0faeaad53f4aee8b555064b9401254fde32285aca67d49af75e28ae8188bef58d8139bdca05915ee5de2d1e300130ead0
-
Filesize
707KB
MD52ab84137ba148b292a6a512a9d8f88f5
SHA1327785b814c047feff518c2f337f8cc6218283a4
SHA256f58d6e78753cbd29a5d087aac2ff2f91217567d122e60477c778244227c50911
SHA512b0dca8f5f9755c761cd4d5508e21866fb1c9bf1b909a4a6cb8754d0700042012ed29234154a8e757ec505bff33bb265c1a5123bd285cba731772ab95db633de8
-
Filesize
3.4MB
MD568c9f08c2029666317669ec67d3a6ea6
SHA1f00d16dc4886c83bf9e244b32780ba488fd21714
SHA2567abed03a5bfd9ebb03a1efa1ef23ed9956a98b8453e699a349abc68c893f7e99
SHA51235fd278f9863c7650818547acd02b49ebfa13bcfb931f274b746fb638922d14b79a4f390d93627d7a321102daa37431682b69c5f5177f3640b9a6ed956fcea09
-
Filesize
433B
MD5cce52e6ad54ade4baca104c02562e8a5
SHA1302ec23849ce90c08db2448ccfeb249bf02640b8
SHA256dbbbffb1022e2bd33585ed10d4175eafc92d1e6f36b95b63a4539bf5aaa0022a
SHA512baa9224853d77c06751ceb51acebb3cb74a1fc1188270523aad9f878f28e57cec407c34897461f4c1fd90ae1b695fd9f678969354b18b5094157afc5d401227f
-
Filesize
17.2MB
MD500d47637e1b24cf64a6f2659637aa2ae
SHA176da58e7fe1c4eb7ed8e94c4fe5b9188b28889f1
SHA256a8962e90f77681782aa1fc5049d294d3700997aec2590af93b2e98d0bfeca0a0
SHA5122177a85f7c418290b367b60f0cb9efbae1af9611a6e6fdb4018ec4b34e9312e23515415888d29d279f43db693255b28a4fd2a0d0f7d016fbce48e2758c165cf1
-
Filesize
369KB
MD5577d37ac619f06898e7e617f64969e64
SHA1d88405f90cb92becde70725dfc7bdc875750b9d0
SHA2566f139c4520456940f954cf09675fcd32a23e54547e2824c24192974a6714ac2a
SHA5125b825e6ec7c0f6daaa3a2cc411f249274eb7f3239f5215e82be33e09ed1d73a2330c299bdaac93ec3c93ef97f8cb872c5f71202cf0f5134d4903b375e4e73332
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.4MB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB