Overview
overview
10Static
static
3x64__setup...xe.dll
windows10-2004-x64
1x64__setup...ep.exe
windows10-2004-x64
1x64__setup...PS.dll
windows10-2004-x64
1x64__setup...pi.dll
windows10-2004-x64
1x64__setup...np.dll
windows10-2004-x64
4x64__setup...te.dll
windows10-2004-x64
1x64__setup...OR.dll
windows10-2004-x64
1x64__setup...er.dll
windows10-2004-x64
1x64__setup...xt.dll
windows10-2004-x64
1x64__setup...al.dll
windows10-2004-x64
1x64__setup...Is.dll
windows10-2004-x64
1x64__setup...40.dll
windows7-x64
1x64__setup...40.dll
windows10-2004-x64
1x64__setup...ov.dll
windows10-2004-x64
1x64__setup...re.dll
windows10-2004-x64
1x64__setup...up.msi
windows7-x64
6x64__setup...up.msi
windows10-2004-x64
10x64__setup...ce.dll
windows10-2004-x64
7x64__setup...SP.dll
windows10-2004-x64
1x64__setup...ss.dll
windows10-2004-x64
1x64__setup...ct.dll
windows10-2004-x64
1x64__setup...bj.dll
windows10-2004-x64
1x64__setup...st.dll
windows10-2004-x64
7x64__setup...ct.dll
windows10-2004-x64
1x64__setup...in.dll
windows10-2004-x64
1Analysis
-
max time kernel
0s -
max time network
2s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
x64__setup__build_18957/Sysprep/en-US/sysprep.exe.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
x64__setup__build_18957/Sysprep/sysprep.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
x64__setup__build_18957/fmapi/SEMgrPS.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
x64__setup__build_18957/fmapi/fmapi.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
x64__setup__build_18957/fmapi/sppnp.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
x64__setup__build_18957/fmapi/tzautoupdate.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
x64__setup__build_18957/hal/KBDKOR.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
x64__setup__build_18957/hal/duser.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
x64__setup__build_18957/hal/fontext.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
x64__setup__build_18957/hal/hal.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
x64__setup__build_18957/msvcp140/PeopleAPIs.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
x64__setup__build_18957/msvcp140/msvcp140.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral13
Sample
x64__setup__build_18957/msvcp140/msvcp140.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
x64__setup__build_18957/msvcp140/ngccredprov.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
x64__setup__build_18957/msvcp140/provdatastore.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
x64__setup__build_18957/setup.msi
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral17
Sample
x64__setup__build_18957/setup.msi
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
x64__setup__build_18957/spoolss/MSAMRNBSource.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
x64__setup__build_18957/spoolss/ReportingCSP.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
x64__setup__build_18957/spoolss/spoolss.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
x64__setup__build_18957/spoolss/stobject.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
x64__setup__build_18957/sysmain/devobj.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
x64__setup__build_18957/sysmain/eapphost.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
x64__setup__build_18957/sysmain/shacct.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
x64__setup__build_18957/sysmain/sysmain.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
x64__setup__build_18957/fmapi/sppnp.dll
-
Size
269KB
-
MD5
ce2827a201e3df7986f1db198081c1c1
-
SHA1
c4f9077fc98e5d70545daef31007a9dd9b589f32
-
SHA256
207816a107793a554f18e480b59de9b5f98b0bbd54a7e81ecf666e538e0e363b
-
SHA512
8aee1936800ff447deb172c6110dbb6593cba3cbbf5f6185049af250602bb50e4c20029e7fed033c574717065bd924272b30516e57422b5094b1b3d8445db151
-
SSDEEP
3072:OAiWbUe6ZATojLurmI6hUsRuG79fMj5k9kVZ4UQebrPA48dLrJGyCM7X8AuSVcVq:3YVGmI67945V2ebrPA48dLrbBcIzh
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags rundll32.exe