Overview
overview
7Static
static
3VistaMasterSetup.exe
windows7-x64
7VistaMasterSetup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...rk.dll
windows7-x64
1$PLUGINSDI...rk.dll
windows10-2004-x64
1$TEMP/Goog...ed.exe
windows7-x64
7$TEMP/Goog...ed.exe
windows10-2004-x64
7Animations.dll
windows7-x64
1Animations.dll
windows10-2004-x64
1DefragMaster.exe
windows7-x64
6DefragMaster.exe
windows10-2004-x64
3DriverMaster.exe
windows7-x64
1DriverMaster.exe
windows10-2004-x64
6FileEncrypt.exe
windows7-x64
1FileEncrypt.exe
windows10-2004-x64
1FileShredder.exe
windows7-x64
1FileShredder.exe
windows10-2004-x64
1FileSplitter.exe
windows7-x64
1FileSplitter.exe
windows10-2004-x64
1IEMaster.exe
windows7-x64
1IEMaster.exe
windows10-2004-x64
1Interop.IW...ry.dll
windows7-x64
1Interop.IW...ry.dll
windows10-2004-x64
1Lighting.dll
windows7-x64
1Lighting.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 06:36
Static task
static1
Behavioral task
behavioral1
Sample
VistaMasterSetup.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
VistaMasterSetup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/processwork.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/processwork.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$TEMP/GoogleToolbarInstaller_zh-CN_signed.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$TEMP/GoogleToolbarInstaller_zh-CN_signed.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Animations.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Animations.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
DefragMaster.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
DefragMaster.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
DriverMaster.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
DriverMaster.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
FileEncrypt.exe
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
FileEncrypt.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
FileShredder.exe
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
FileShredder.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
FileSplitter.exe
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
FileSplitter.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
IEMaster.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
IEMaster.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
Interop.IWshRuntimeLibrary.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Interop.IWshRuntimeLibrary.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
Lighting.dll
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
Lighting.dll
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
f2c993a0c726386d72e4640967cef83e
-
SHA1
efe88db252b5e9edff2d859e783fcf1a349e553f
-
SHA256
6739a2c8075cc383620a867e983957de0b4ae9ef0453baadd1469132893d7301
-
SHA512
3873a87ba360702c72a6d3e853a0b6f2df219593cf5436d12a9d4d169029e939993c45330212008b628184da64ae98d6a7ab42b30d5f82c896acfc89d558169f
-
SSDEEP
96:qBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8XQB0NKndY7ndS27gA:q6n+0SAfRE+/8k0NKdqn420
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2652 2404 WerFault.exe 31 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2404 2924 rundll32.exe 31 PID 2924 wrote to memory of 2404 2924 rundll32.exe 31 PID 2924 wrote to memory of 2404 2924 rundll32.exe 31 PID 2924 wrote to memory of 2404 2924 rundll32.exe 31 PID 2924 wrote to memory of 2404 2924 rundll32.exe 31 PID 2924 wrote to memory of 2404 2924 rundll32.exe 31 PID 2924 wrote to memory of 2404 2924 rundll32.exe 31 PID 2404 wrote to memory of 2652 2404 rundll32.exe 32 PID 2404 wrote to memory of 2652 2404 rundll32.exe 32 PID 2404 wrote to memory of 2652 2404 rundll32.exe 32 PID 2404 wrote to memory of 2652 2404 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 2443⤵
- Program crash
PID:2652
-
-