Analysis
-
max time kernel
143s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
18-07-2024 15:07
General
-
Target
keymanager_setup.exe
-
Size
2.1MB
-
MD5
568bc261204f476b2b231cc86a5f56bc
-
SHA1
ccfa43f9b3bde80bdfbdfc6c8bf3459f6ad3ad47
-
SHA256
1a817d66dd70b9e04ab7aebd99bc97d167f77d68f9551f617bdece2d7b2716be
-
SHA512
33836a062ac001463e6f53c7a99619bc4b436b93e5b5fd8c3122ae1b8d26a0c8d7b2314d36b3f4fe6608f576f4ea9aa833bf9ac5c5be9f4ad38a62ea3e3f2a6c
-
SSDEEP
49152:E+xyvwIuPwcbvOVMrLHHkFevC4qGqr4UuWEpOO9GCkvf+ocky:04mcjrLY4Pqr4UTMG9X+oNy
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 7 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\keymanager_setup.exe"C:\Users\Admin\AppData\Local\Temp\keymanager_setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HINJ4.tmp\keymanager_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-HINJ4.tmp\keymanager_setup.tmp" /SL5="$401AE,1675432,121344,C:\Users\Admin\AppData\Local\Temp\keymanager_setup.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ATNSOFT Key Manager\keymanager.exe"C:\Program Files (x86)\ATNSOFT Key Manager\keymanager.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5f1d3ff8443297732862df21dc4e57262
SHA19069ca78e7450a285173431b3e52c5c25299e473
SHA256df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
SHA512ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
-
Filesize
3.8MB
MD571289680572d02e75a7f83c24ba7894d
SHA1f732d66cbc33d4e55dee04c06308f1e288590bd5
SHA256ed0d7eb35b6696be5638e3db7a9f1503db2d8c91b9732ae83ba58dbaf1596a09
SHA51275619c84cc44b1257279062418a1aee69c199cd9c27381fc53faf2ba486f643588d5a3beac3937f7581f890a436f8654bf001bb8624f12fef689af66133e3a0d
-
Filesize
1.2MB
MD523753ae5d0a9db6215a037575e84d557
SHA1295fb6921dc903db58fd91cd89de0d496708f88c
SHA256093f33b70d42e3d6d613669e75e1d2239b6f0ab11328ae3315508e99b305aafd
SHA512e27ca3c7d6e02f16f16d428b0f0fa49e1dbdd1d702bbc32b43efb06480635c22ff29e7f68bf3046a8d766a86afbd719fdea4f75a3eca5edfba406453ee1e025c
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
68KB
-
Filesize
160KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
6.6MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB