b0410c03a893377b1726c7d31fed5796ae24c8ba55061aa7a02f04fd96a32af5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
InstallKit_24313_win64.exe
Size 21.4MB
Sample240721-qr9pgavanj
SHA256 b0410c03a893377b1726c7d31fed5796ae24c8ba55061aa7a02f04fd96a32af5
MD5 65a1f593552de7934b0bcb782abc43c4
SHA1 b379c45dcfd03680bb1d97e34a27d1eec8b398a4
SHA512 0ebceed4be166581b00d7aa73e439ccee8bd2170d1073fe2b269aa0d1a3c04dd26fb4add4b4aa77a8b69a9adff06365310306172e1003303fbe90b2aad3077bc
SSDEEP 196608:6Y/W2TrybPU3ENBlut4E/iUous5kW+bD5Pc90umN40vyv+SQBVluw9a+Y:6aWqrybhNBlu3/i5X5kpD5GmHv1nRY
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

execution

Malware Config

Signatures

An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs

pid	Process
1532	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	InstallKit_24313_win64.tmp

Executes dropped EXE 2 IoCs

pid	Process
3408	InstallKit_24313_win64.tmp
1412	InstallKit_24313_win64.tmp

Loads dropped DLL 2 IoCs

pid	Process
3408	InstallKit_24313_win64.tmp
1412	InstallKit_24313_win64.tmp

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5004	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1412	InstallKit_24313_win64.tmp
1412	InstallKit_24313_win64.tmp
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1412	InstallKit_24313_win64.tmp

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 3408	532	InstallKit_24313_win64.exe	87
PID 532 wrote to memory of 3408	532	InstallKit_24313_win64.exe	87
PID 532 wrote to memory of 3408	532	InstallKit_24313_win64.exe	87
PID 3408 wrote to memory of 4988	3408	InstallKit_24313_win64.tmp	88
PID 3408 wrote to memory of 4988	3408	InstallKit_24313_win64.tmp	88
PID 3408 wrote to memory of 4988	3408	InstallKit_24313_win64.tmp	88
PID 4988 wrote to memory of 1412	4988	InstallKit_24313_win64.exe	89
PID 4988 wrote to memory of 1412	4988	InstallKit_24313_win64.exe	89
PID 4988 wrote to memory of 1412	4988	InstallKit_24313_win64.exe	89
PID 1412 wrote to memory of 1532	1412	InstallKit_24313_win64.tmp	94
PID 1412 wrote to memory of 1532	1412	InstallKit_24313_win64.tmp	94
PID 1532 wrote to memory of 5004	1532	cmd.exe	96
PID 1532 wrote to memory of 5004	1532	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\InstallKit_24313_win64.exe
"C:\Users\Admin\AppData\Local\Temp\InstallKit_24313_win64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Users\Admin\AppData\Local\Temp\is-LTHCI.tmp\InstallKit_24313_win64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LTHCI.tmp\InstallKit_24313_win64.tmp" /SL5="$602D0,4828351,725504,C:\Users\Admin\AppData\Local\Temp\InstallKit_24313_win64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Users\Admin\AppData\Local\Temp\InstallKit_24313_win64.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallKit_24313_win64.exe" /VERYSILENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\is-U9872.tmp\InstallKit_24313_win64.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-U9872.tmp\InstallKit_24313_win64.tmp" /SL5="$702D0,4828351,725504,C:\Users\Admin\AppData\Local\Temp\InstallKit_24313_win64.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C p^o^w^e^r^s^h^e^l^l^.^e^x^e^ -^N^o^L^o^g^o^ -^N^o^P^r^o^f^i^l^e^ -^E^x^e^c^u^t^i^o^n^P^o^l^i^c^y^ ^R^e^m^o^t^e^S^i^g^n^e^d^ -^F^i^l^e^ "C:\Users\Admin\AppData\Local\Temp\is-G955U.tmp\\D59C3EEV.ps1"
        5⤵
        An obfuscated cmd.exe command-line is typically used to evade detection.
        Suspicious use of WriteProcessMemory
        
        PID:1532
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\is-G955U.tmp\\D59C3EEV.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_gbhj0sz0.f3h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gbhj0sz0.f3h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

D59C3EEV.ps1

Path C:\Users\Admin\AppData\Local\Temp\is-G955U.tmp\D59C3EEV.ps1
Size 723KB
SHA256 63760f40b6cda43eb12b6f114f4f84f58bfc2808ef2ff1f42a5fa91dae312c98
MD5 57b69d97abcec8125167a903957a8a4e
SHA1 ff7f77c6125734965adb87d3dc16ee22383b3625
SHA512 e0bbdeab342d8f6474cec561914d83af2acd61e55c898b2ea72767c913b6a657e9b57330935c148e192c39d82ee7fa211c94325141fd3f63bb94544b06c2aadd
SSDEEP 1536:jCGvwrGpzhv2NLwX7YpPwXngeiURWcrQIKbp6KCavYkqJIvRqXe4bOFDjbe7irbE:3
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallKit_24313_win64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LTHCI.tmp\InstallKit_24313_win64.tmp
Size 2.9MB
SHA256 117e88047fa7f0e326e02ecdadd4bbf0ff0acc897a3499c5728a530a566aa796
MD5 a0ec6f52e2963da51e7718fa893dfe9b
SHA1 281a97ba2b01e57f17bb57a85cd8a2f79e2dbdd3
SHA512 941b2509ebd1a5376b97ee4f2ee8658a974aded1f3a424dcc56872987a134057c36bec5780d529ab481fedec69a1e14529f3a45d174897a81621582b66fa38ee
SSDEEP 49152:hdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtde333Yd:nJYVM+LtVt3P/KuGP+VYNCuG3338
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-P5K2U.tmp\_isetup\_iscrypt.dll
Size 12KB
SHA256 4bb34fe74f86ab389763863ee395a93d73e2d9548c224819ec9055d7c8c4b480
MD5 47cfd05fde4babe79530c7ea730f6dc0
SHA1 2c055fa81f19d6f024f1f3d5b2dd0d5fde51d87e
SHA512 ece4b4268e0d346e438f6f59fe333f7b6f95e3287791c517ef477935704ad2788e544a877b39abf542cd90a23966302d44cf03fb71e95c4f84ea11e634b3cbd0
SSDEEP 192:8VT+PBo21ZtDYNDxEGRjDZ1t7r+51q5CMqrHPTSofousUwz2T3+4Doma:2N2mNDyeV7r+5w56SofousWu4DU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/532-19-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/532-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Download

memory/1412-23-0x0000000000400000-0x00000000006F2000-memory.dmp

Download

memory/1412-57-0x0000000000400000-0x00000000006F2000-memory.dmp

Download

memory/3408-17-0x0000000000400000-0x00000000006F2000-memory.dmp

Download

memory/3408-6-0x0000000000400000-0x00000000006F2000-memory.dmp

Download

memory/4988-13-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4988-15-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4988-48-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4988-59-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/5004-37-0x000002595F870000-0x000002595F892000-memory.dmp

Download