Analysis

  • max time kernel
    1801s
  • max time network
    1786s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-07-2024 20:06

General

  • Target

    FlyByWire Installer.exe

  • Size

    155.8MB

  • MD5

    0f22f7485f93daf96991ce37ad5e5a3b

  • SHA1

    eba6bf79fa95ec3486f83ed6018fae2d3e35f192

  • SHA256

    765b138addb66d32074c9ca00408b2c0192c14238767a8ac0c1c3a9bcff6dcc8

  • SHA512

    21f4cf53da472f71bc08219f3448c869825a3cb6c2515ea805dddd85ca1fb1390b5eeeee0d7c4f0efe887a7270d6a0ad244be707310af8a7cfb8cc1b1b888dd4

  • SSDEEP

    1572864:9yORhgkU5GDVG0inyE3ZKlWa9l9jEMJGuviC+b7kyp6Kn4cRsOVW99B95NeRLjTE:n+BJujFTaaoKvkKVB22MlIft

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FlyByWire Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\FlyByWire Installer.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\Users\Admin\AppData\Local\Temp\FlyByWire Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\FlyByWire Installer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\FlyByWire Installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1720 --field-trial-handle=1724,i,470658672605713037,15539491913575610431,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:4584
      • C:\Users\Admin\AppData\Local\Temp\FlyByWire Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\FlyByWire Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\FlyByWire Installer" --mojo-platform-channel-handle=1992 --field-trial-handle=1724,i,470658672605713037,15539491913575610431,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:4888
        • C:\Users\Admin\AppData\Local\Temp\FlyByWire Installer.exe
          "C:\Users\Admin\AppData\Local\Temp\FlyByWire Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\FlyByWire Installer" --app-user-model-id="FlyByWire Installer" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2224 --field-trial-handle=1724,i,470658672605713037,15539491913575610431,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Checks computer location settings
          PID:4028
        • C:\Users\Admin\AppData\Local\Temp\FlyByWire Installer.exe
          "C:\Users\Admin\AppData\Local\Temp\FlyByWire Installer.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\FlyByWire Installer" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3176 --field-trial-handle=1724,i,470658672605713037,15539491913575610431,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4548

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\Network Persistent State

        Filesize

        1KB

        MD5

        ac8adcebd4ab7106f3d3da6c046e865f

        SHA1

        599c1b3109df33145619d7e5f62bc951333098db

        SHA256

        4b222ca4f19277d95c75dd5ee670e2f658ce4bf2c5f5332604c415789dd9d520

        SHA512

        ac1f8155093239f956e2ec8c523369334d0986d9b2cd25f03242316318ed15b28f8ffe7515d831027ea1969e968c42f26fb87e8232950f9d46f65f9676613551

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\Network Persistent State

        Filesize

        1KB

        MD5

        cabf6f593a1d1ff3c481ab6ef7bdfd2d

        SHA1

        faaf663d32e6ab036cc53bf966d1c871e63d2a76

        SHA256

        322b9f5cbef076667ac119d5e4b92e330c3fe04054676444ae9a043bd200b5ab

        SHA512

        e226f211ef579d9943519b0a866c5d08a8449febc4c1de204e4248db02bac7facc5a12a8f974233247940facf471e3bb8c10e5a7947bf1a94f50163bc1eeb711

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\Network Persistent State

        Filesize

        1KB

        MD5

        6ad43500e33ce3f600932e1b92ab1163

        SHA1

        213eb0cef97d4bf80defb6aac08a7d321facfee6

        SHA256

        8d3eefbd630a83d02f2e7f5242e915d68aee7c2da2180b83b074e33fd77173dc

        SHA512

        43d147c9af14ab3257cc5bdd4912eb190e130d889989e1f7eb475df2e2ef90cb39898b7279260d89fd20d208794cdd06f0b6d48c0d8de83909508bf69496b408

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\Network Persistent State

        Filesize

        1KB

        MD5

        dc2affc3c9b3abdfd9bac20bea18fada

        SHA1

        8ed9c894264172b5c06234ab92b5cbb8dc7ab06c

        SHA256

        dd2e870f6a559e90cba80c544106ad00443cefa2f76da0d80f081ab6b1348239

        SHA512

        9de8bbba06739cecc95dffe1d48eeb3942ae7aa3db669ab1c24c6d900f664443af96b3e8778a3ffec659bf277f8dca5b2de9cdcc5380f27cdcd90185abe57cd5

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\Network Persistent State

        Filesize

        1KB

        MD5

        1b1ef6b3999b41fab5a117651797d276

        SHA1

        97160bd391b63fde3818b7b9aa7b1e63648f4b7e

        SHA256

        9e4674aa58b31b4a7ebbf5129b8890f1f0a046567637b0d78f7407a36c0b856b

        SHA512

        30e8c8c56b18a8b3e985e821eb6d70fe965721c0051489d4cdf0fb301f93962d88d5cb06c0ad1bd5c0d1fdddea591c03a607f0c2648f6657358de5b7c1042e36

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\Network Persistent State

        Filesize

        1KB

        MD5

        c9fb3a254c05cc37ab4493ea84888fa0

        SHA1

        ca60d16bbfc02bab88a2bbe977846985d3208493

        SHA256

        0997e1a829df26cc016a97e0d7cad9a97f4d776f7ee71b221c217abe38e3e88f

        SHA512

        fe8998f293fae34d2e07a1fe645600e00abe121091f970e3aff9f06affa9a2f2f6f4a210a3a09cd9aaf9b140e122eed671e7392505e2284238455ae395a028d9

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\Network Persistent State~RFe58ceb5.TMP

        Filesize

        59B

        MD5

        2800881c775077e1c4b6e06bf4676de4

        SHA1

        2873631068c8b3b9495638c865915be822442c8b

        SHA256

        226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

        SHA512

        e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\TransportSecurity

        Filesize

        690B

        MD5

        83f7af5bb8352c79db3a3d85acd50239

        SHA1

        6ae462882ffaf5d60bcfdc5150ba26e36a855283

        SHA256

        0c32567afc2d5be11bae4c78e10763c35c3cf8c7a125621edd8a55cafdb5e979

        SHA512

        32445efadbf86f902b3d3d91d7adbaf9a44fe72f8953ebe30a3b400422174154f2ee9573f9b454a47098a40a45b61b0938b1872d3690ef53f2a39ad0480f412f

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\TransportSecurity

        Filesize

        690B

        MD5

        f592f7d3ba8d03797b6b786f620dbe23

        SHA1

        cbd3ae98f2ecb3c006b4e40423855a7c629e9041

        SHA256

        8c43b3483a6b18a849659cbe6ecd6616c1db2e33058aa19c3b82986bf87c8486

        SHA512

        48c6164ed159732ecf2af929b2080d6c44e0a197aeebc715df15d83a2c60f6b9e66a3a321576146963a048c61b15e214a6300c195c9c236dc6fd2bfcbefe4bbe

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\TransportSecurity

        Filesize

        690B

        MD5

        7d6a6102b187e56494dcb42082a2a8a1

        SHA1

        98a188106adf9344c2840941323cf7fa0a9e2b2f

        SHA256

        46d381fd4be9a83cd28ddee39af287ca3b038ab95a79a1a694ea87766ac2ae18

        SHA512

        38278dacf93173371f9bcf08a46b9ed85524aaf31a9fac343dab992c5851c8e4bbf7637a102e8f85d9a2a30a6ec528fa1065f41236e44652f8611c8dcb999544

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\TransportSecurity

        Filesize

        690B

        MD5

        d2a2de5130f23883630171b1a4ebc221

        SHA1

        799654e9d73fbf6d16c39e808188b1ec56afdc19

        SHA256

        ed2242629d3166dbb004852596631c31a57b884dd2f6f2fcf0f35fd699918cd1

        SHA512

        bfa46ba297dda7b581bd9ec76c38fb469388006353c3939d9b861e2175a4c69297ee1279b77bc2e2bdc7331aa7cd729bac3e299a945c4e6b030636bfdb44cc87

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\TransportSecurity

        Filesize

        690B

        MD5

        5d96d3dd957154900fc0dd7dbb56fce0

        SHA1

        9a4e3a711b297f5cadae7b4c8903b4792ed55604

        SHA256

        0cd3c472378dfae248675b418079d6b476e05f4516d9854d658723eefcc483fa

        SHA512

        b46a3f2c62102cae3f598a852cfa1b3c96ebec7d189240bc1e823c83b707ce9dd74fd7b62869c403458edeab613a0e23364a0240222fc1615a65da0a42806f95

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Network\TransportSecurity~RFe5c7cd8.TMP

        Filesize

        690B

        MD5

        754b0fe13ffda2b0f181fcf9890d51e8

        SHA1

        67216f5a1e1ce87d541182752f35ad570b6f074d

        SHA256

        a4e175fc48d5db90a22bfe8dbaaf799dc33bf2bc1b006c6bff6e30c41ab9c2d3

        SHA512

        4fd94f2fc8683f7a0f12f61b6eded10ef15509a7e14698701a9fb8d6af1ebbe539b0468ea9ed589609c7a8b5e0a15454b4836a4bb8daee81873e420ae6e59907

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Preferences

        Filesize

        57B

        MD5

        58127c59cb9e1da127904c341d15372b

        SHA1

        62445484661d8036ce9788baeaba31d204e9a5fc

        SHA256

        be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

        SHA512

        8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\Preferences~RFe57e465.TMP

        Filesize

        86B

        MD5

        d11dedf80b85d8d9be3fec6bb292f64b

        SHA1

        aab8783454819cd66ddf7871e887abdba138aef3

        SHA256

        8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

        SHA512

        6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\config.json

        Filesize

        728B

        MD5

        4d20b56f9d468c90eef20d0028ed46e8

        SHA1

        ef29f9169208f4d94763d4bd7078f5f39c4fc24c

        SHA256

        637e6f561a356325f1f023709e480949a8434368cad1d3bd939ffa97199ca30e

        SHA512

        686595c27648b6639b9857c754a7473435809d1179a42075eb91dae91b735dc502b28885cd601a356223e3590c53ea8be40b131dc6e8a5684c8f7fe12f405600

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\config.json

        Filesize

        728B

        MD5

        47831bcf61948ea19968009247dc49b8

        SHA1

        056b2b5a25b7628adbee6c445ae6f259c376aa2b

        SHA256

        024f282743c93e9ae6f241b539888c04bcd58f2bd39f12ad5c263909f2cb9fe4

        SHA512

        c885c608dfe5d537b532d8f516266f678319886998dddfab751dceaabbd6f50b681afbeb480e565760e57d165429576ffe5fd6b6031c31ff6fd2c79bf53ba2b5

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\config.json

        Filesize

        733B

        MD5

        87fdd4910669ca521496207408cea40b

        SHA1

        d75c23632466a81b4e915ed8df525e2ab217bc92

        SHA256

        a5182d12cf7063fe63f0c794854b961c14929e34a7f8aec4871734c7fccd20b4

        SHA512

        d7dcfc791a7d99cbc616d70e063a04a41978623594a1fa68f0ec20732be31e1653c2423442a67ba0dd3e8a9dd95d42675d450814654b0cd1bde807381107ea3f

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\config.json

        Filesize

        716B

        MD5

        d690d09a0a9ccc9b74193f029a1c6c14

        SHA1

        a4e1b747fdc2de90ef6435ffcc4d4a7fba1a3cf6

        SHA256

        22874e5cf0ade327968d66eedac3979cb3f8e154f49643c65910f3fe7d8e8e57

        SHA512

        badd757823f88078b9cef865606223d11b971b43576b548c6f7128caacdd8c63139f9fdb462598a99dba93462c6f2e25d328e29079e84f274ef9c10317514502

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\config.json

        Filesize

        784B

        MD5

        6d771fbd10c4dc1866df513cf3d80854

        SHA1

        2872449257a241335fc91ddcd73a9f6d6f52bf08

        SHA256

        c9cdbd088b4e6a41f554c5719a90ec2f944caf0cdc6c0c300d9c2553fe12505f

        SHA512

        55d1e276e9eeed17dafb4f0afe8240c448a894a1e81de42d3bd8b04e15e7e3c4ed153346ee2b92a121b8906b996d111fe11a1a17edae8604952df506953cfb9d

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\config.json

        Filesize

        798B

        MD5

        3ced43adc49ca4f4c6744c3ab51564c5

        SHA1

        60470cc4d32cf19535cccd168aff08fa1ad5e027

        SHA256

        49ac7d11ff32a6acb3ac0db2e75c90b8af4c55f695fbcf8a822cdc90a7bb36eb

        SHA512

        9cfc1ea62b24355dda612bf1c9ab819a4ac3064dfa0b9cea3d271d3d2385ad7273c8204bc8c393b5e078fd8107373bc101057a505b87517a37eddc00998fc1d9

      • C:\Users\Admin\AppData\Roaming\FlyByWire Installer\config.json.tmp-12470908496b821c

        Filesize

        803B

        MD5

        7a0db45da14af265aab112258cb3bce3

        SHA1

        2d5925b8f3c7c1235e93284fa4a5424596b906d6

        SHA256

        9aec3855fea087f7e1902568a590618f7baf9d49191b54c8da2f93b1a2681304

        SHA512

        549dd84ab8d588c9685a9b791c2e1b7cd28c5b3e0a46992a3c97c9eaefaf4684d2eca23324a238f9d5d8406a9e8d5f356c249ce41114b083d8afbf2dac71ddb5

      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

        Filesize

        2B

        MD5

        f3b25701fe362ec84616a93a45ce9998

        SHA1

        d62636d8caec13f04e28442a0a6fa1afeb024bbb

        SHA256

        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

        SHA512

        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      • memory/4548-249-0x000001CF9A590000-0x000001CF9A591000-memory.dmp

        Filesize

        4KB

      • memory/4548-238-0x000001CF9A590000-0x000001CF9A591000-memory.dmp

        Filesize

        4KB

      • memory/4548-240-0x000001CF9A590000-0x000001CF9A591000-memory.dmp

        Filesize

        4KB

      • memory/4548-246-0x000001CF9A590000-0x000001CF9A591000-memory.dmp

        Filesize

        4KB

      • memory/4548-247-0x000001CF9A590000-0x000001CF9A591000-memory.dmp

        Filesize

        4KB

      • memory/4548-248-0x000001CF9A590000-0x000001CF9A591000-memory.dmp

        Filesize

        4KB

      • memory/4548-239-0x000001CF9A590000-0x000001CF9A591000-memory.dmp

        Filesize

        4KB

      • memory/4548-250-0x000001CF9A590000-0x000001CF9A591000-memory.dmp

        Filesize

        4KB

      • memory/4548-245-0x000001CF9A590000-0x000001CF9A591000-memory.dmp

        Filesize

        4KB

      • memory/4548-244-0x000001CF9A590000-0x000001CF9A591000-memory.dmp

        Filesize

        4KB