Overview

overview

7

Static

static

3

setup_loss....0.exe

windows7-x64

7

setup_loss....0.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    125s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2024 04:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_lossless_scaling_2.9.0.exe

  • Size

    5.9MB

  • MD5

    3f484fb41e85aa1875ab0e966a13fbff

  • SHA1

    f2591e8c9e46520a10cbfbb4f80fa0cff1722701

  • SHA256

    32fec5f5a1e77d6fdb8b27016d70c923429b9530459850d8207c925e563dfe09

  • SHA512

    d761369016596a51a3a8c2ee8364f0608771e05c95517ac256126eb74a77ef5ff87e39949d33ce0c7b046ad7f642d6354513968842035e6206a974e8eca54b8d

  • SSDEEP

    49152:kBuZrEUNBUJiQXPfoYV7hZiRZieAlA89hAnqQQDI7QPmJLJZ2iZ3vxm3c7ldk:6kLNAXXoYTZblA89hAqQsOQPCXvm3chG

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 57 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 23 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_lossless_scaling_2.9.0.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_lossless_scaling_2.9.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4716
    • C:\Users\Admin\AppData\Local\Temp\is-CBIHV.tmp\setup_lossless_scaling_2.9.0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CBIHV.tmp\setup_lossless_scaling_2.9.0.tmp" /SL5="$B0052,5281693,844288,C:\Users\Admin\AppData\Local\Temp\setup_lossless_scaling_2.9.0.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2196
  • C:\Program Files\Lossless Scaling\LosslessScaling.exe
    "C:\Program Files\Lossless Scaling\LosslessScaling.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4652
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:552
  • C:\Windows\system32\control.exe
    "C:\Windows\system32\control.exe" /name Microsoft.DeviceManager
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4180
    • C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1972
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:244

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Lossless Scaling\Lossless.dll
      Filesize

      259KB

      MD5

      021db5d732b50c2a59050a4b273bef23

      SHA1

      6748e468f6ffbfb812699242f7a108b512a9bce5

      SHA256

      a2415b8f51f767408ec19d4c50ee46eb6f490aaa7e147c5f555f1202ecf8f518

      SHA512

      44cf4bbda762ed47586816752396b42faaf2f07d173e6b69e6e49f75f0dcacafde48fa0ea5735b70b89be6a7eb56883614d7c78c104968e24d5c40561a884ffd

      Download Submit

    • C:\Program Files\Lossless Scaling\LosslessScaling.exe
      Filesize

      962KB

      MD5

      4c8d9566dc1e5f1eae914a546ee819a0

      SHA1

      8b16f43b0c84a43eecb24aad51d33795752a3b07

      SHA256

      b5b9671a6e309afd15a595ca96ce2d294f26519c73e68c4909418a3129c6db68

      SHA512

      5a7ded63ec2c6d3320d14bdc876c4f51c1a7c6e1c8a89028f646c03a2b393262db3b16d66b58903a83f0aa34218a8649aeeec0cf49a0ac9a404d29336bf85532

      Download Submit

    • C:\Program Files\Lossless Scaling\LosslessScaling.exe.config
      Filesize

      174B

      MD5

      2a2df45a07478a1c77d5834c21f3d7fd

      SHA1

      f949e331f0d75ba38d33a072f74e2327c870d916

      SHA256

      051099983b896673909e01a1f631b6652abb88da95c9f06f3efef4be033091fa

      SHA512

      1a6dd48f92ea6b68ee23b86ba297cd1559f795946ecda17ade68aea3dda188869bba380e3ea3472e08993f4ae574c528b34c3e25503ee6119fd4f998835e09d7

      Download Submit

    • C:\Users\Admin\AppData\Local\Lossless Scaling\Settings.xml
      Filesize

      2KB

      MD5

      9722d4173cdb869a507c57629b6aecdd

      SHA1

      e816426039ca9a684a60b8923780550c19c85ccd

      SHA256

      5d1b53f734db6ae2c37c6dbbeefa03c6745dd033c7b55ffeeb03a11aae6bc8c2

      SHA512

      488e3a82ffba4f8d4e5eca9c3d81302e075bfc2c2319fe9c1d3c1d6025c2b0ddc752dd53d06a6cebab1fc0720a0e11068b2295d683069db6a33aadb06e3438d7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\is-CBIHV.tmp\setup_lossless_scaling_2.9.0.tmp
      Filesize

      3.0MB

      MD5

      d7b514bf909e1e4d0f26a0595d3354ec

      SHA1

      88fd37a48fadb910a3a96d0e8c0b5ef559ab210d

      SHA256

      4e1ed66e3aa81ae7e561324d504088482c73f97fa2c0bccd59e83512b78b1259

      SHA512

      997bb2d23c217e1f7b589bd4440b26177a6d061b3406892368c5527f569283b56db0f6d48cb74f9a00c534ede50d05e19268e2b04fc28ec33cf5c5dcc87eb9de

      Download Submit

    • memory/552-354-0x0000019E19D60000-0x0000019E19D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/552-363-0x0000019E19D60000-0x0000019E19D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/552-353-0x0000019E19D60000-0x0000019E19D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/552-355-0x0000019E19D60000-0x0000019E19D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/552-360-0x0000019E19D60000-0x0000019E19D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/552-361-0x0000019E19D60000-0x0000019E19D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/552-362-0x0000019E19D60000-0x0000019E19D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/552-359-0x0000019E19D60000-0x0000019E19D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/552-364-0x0000019E19D60000-0x0000019E19D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/552-365-0x0000019E19D60000-0x0000019E19D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2196-11-0x0000000000400000-0x0000000000717000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/2196-303-0x0000000000400000-0x0000000000717000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/2196-9-0x0000000000400000-0x0000000000717000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/2196-6-0x0000000000400000-0x0000000000717000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/4652-321-0x0000029AF2930000-0x0000029AF2968000-memory.dmp

      Filesize

      224KB

      Download

    • memory/4652-345-0x00007FF8ACDB0000-0x00007FF8AD871000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4652-320-0x0000029AF29F0000-0x0000029AF2AAA000-memory.dmp

      Filesize

      744KB

      Download

    • memory/4652-317-0x00007FF8ACDB0000-0x00007FF8AD871000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4652-322-0x0000029AF34E0000-0x0000029AF34E8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4652-324-0x0000029AF3500000-0x0000029AF350E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4652-319-0x0000029AF2880000-0x0000029AF2932000-memory.dmp

      Filesize

      712KB

      Download

    • memory/4652-340-0x00007FF8ACDB3000-0x00007FF8ACDB5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4652-342-0x00007FF8ACDB0000-0x00007FF8AD871000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4652-308-0x00007FF8ACDB3000-0x00007FF8ACDB5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4652-314-0x0000029AD6A70000-0x0000029AD6A7A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4652-431-0x00007FF8ACDB0000-0x00007FF8AD871000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4652-313-0x0000029AD6A60000-0x0000029AD6A68000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4652-312-0x0000029AEF290000-0x0000029AEF2B6000-memory.dmp

      Filesize

      152KB

      Download

    • memory/4652-311-0x00007FF8ACDB0000-0x00007FF8AD871000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4652-310-0x0000029AF01B0000-0x0000029AF0296000-memory.dmp

      Filesize

      920KB

      Download

    • memory/4652-309-0x0000029AD4C70000-0x0000029AD4D66000-memory.dmp

      Filesize

      984KB

      Download

    • memory/4716-2-0x0000000000401000-0x00000000004B7000-memory.dmp

      Filesize

      728KB

      Download

    • memory/4716-8-0x0000000000400000-0x00000000004DB000-memory.dmp

      Filesize

      876KB

      Download

    • memory/4716-304-0x0000000000400000-0x00000000004DB000-memory.dmp

      Filesize

      876KB

      Download

    • memory/4716-1-0x0000000000400000-0x00000000004DB000-memory.dmp

      Filesize

      876KB

      Download