Resubmissions

24-07-2024 20:14

240724-y1a69sxfnb 8

Analysis

  • max time kernel
    122s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2024 20:14

General

  • Target

    FastReporter3_64_Bit/EXFO FastReporter 3 (64 Bit).msi

  • Size

    15.6MB

  • MD5

    36886a7accc259b8e611f0ba6f0bed43

  • SHA1

    468a9215909ebfa8195665742c6d876cd0824384

  • SHA256

    fb3f244231f276a492aa628168614492c40294fabbdea018ddc376920f41e41b

  • SHA512

    de7df31af2357c5866e802512ecd3edf557fc00ba8afadf5ec169c126691492b45220a7435e92c6813253f6c60ced6f1371a8347a67d01b3b740d92b567d1d43

  • SSDEEP

    98304:vGKhoqLy+ghNb/1Yy1KYRul66MyseMWdRCjljm6ep4kCLwH4KNFMx:vNhVgNdVjm6epb

Score
6/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 31 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\FastReporter3_64_Bit\EXFO FastReporter 3 (64 Bit).msi"
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2408
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 57B2CE29D7C1F524277142D986D015AD C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4A91A35E-2BEA-4A4D-9031-9B62BB0F8F2B}
        3⤵
        • Executes dropped EXE
        PID:2000
      • C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{54B8F966-C75D-4715-B76F-62C44F7C932A}
        3⤵
        • Executes dropped EXE
        PID:600
      • C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9FAB8910-6959-4E1E-A260-BDD178CF77E1}
        3⤵
        • Executes dropped EXE
        PID:1624
      • C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{178DABD7-5641-4F4E-8EDF-54D00B9477A0}
        3⤵
        • Executes dropped EXE
        PID:1160
      • C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0DA7E6A8-6528-4506-9B57-0E790338B687}
        3⤵
        • Executes dropped EXE
        PID:2704
      • C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F6C638D5-6483-4A35-9CA9-9E6A8892F9B6}
        3⤵
        • Executes dropped EXE
        PID:1532
      • C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F28C2F28-7858-4BF0-9AFD-E7F9B27F1EA0}
        3⤵
        • Executes dropped EXE
        PID:1560
      • C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{17BC4E5A-A599-4127-9BA9-1624EB31A1A2}
        3⤵
        • Executes dropped EXE
        PID:1760
      • C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EC5DBB97-F228-48A4-AB34-E8CAD8877D48}
        3⤵
        • Executes dropped EXE
        PID:844
      • C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7E723CBE-35CB-4C53-BF26-C706C86EEB3D}
        3⤵
        • Executes dropped EXE
        PID:2996
      • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5E26FB14-D2DD-4A68-8691-B97FCBF8FA57}
        3⤵
        • Executes dropped EXE
        PID:568
      • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2A233AE9-651E-4957-AA2D-6DFEDD023948}
        3⤵
        • Executes dropped EXE
        PID:2080
      • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0EFE0BFC-0772-4252-9429-C2A768EBF2FE}
        3⤵
        • Executes dropped EXE
        PID:2068
      • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E8A3C232-DB71-4EA3-93F3-6AED83916C94}
        3⤵
        • Executes dropped EXE
        PID:1580
      • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B5D66D7-E620-4461-85EA-CCF9622DF37D}
        3⤵
        • Executes dropped EXE
        PID:628
      • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D562F546-D0BF-4E30-A6FA-1CCF9EA5FF73}
        3⤵
        • Executes dropped EXE
        PID:2416
      • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E44EE5A2-D199-49EB-8F2C-8C01C4847293}
        3⤵
        • Executes dropped EXE
        PID:2532
      • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{28168447-4243-4ECA-872B-E2DE42B833CC}
        3⤵
        • Executes dropped EXE
        PID:2892
      • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{378B5550-BA53-4D5A-B4F0-C0B43924948F}
        3⤵
        • Executes dropped EXE
        PID:2288
      • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A940508D-B93F-4889-A763-2F04B87AE5EC}
        3⤵
        • Executes dropped EXE
        PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabCF71.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\MSID27E.tmp

    Filesize

    153KB

    MD5

    1a42ff9ff5945cb3a3589a74eb683de1

    SHA1

    a463b74e1919c3c60a9daf5462de9338b426de9e

    SHA256

    cde61e213903f7bfb46efe6db64e5946d01cfb169a6859358df20c3302dcd2ed

    SHA512

    b485a878e43a39934c9715a271f7d5d1612257ef508817feffdf759dfc890bd31ed3c6051a84982f73d3d5915b4739fd3557635b7ce30afdc7b9d29aeb9020bf

  • C:\Users\Admin\AppData\Local\Temp\MSID2EC.tmp

    Filesize

    320KB

    MD5

    2640e1c49399712536e995c4d3144dce

    SHA1

    1bc508458539f4b1947c1cdf6f17e1f7c20aebd7

    SHA256

    14f978cc08214b85557af426efc2ece84b0b77ea502990616f043effbf7342ed

    SHA512

    335af96bd9d85b5224709e65789cd9c9a824e53a5094e54f173e13ad8ef9ec84191623558a93a6f83bff9bc20430ac0e26e2f20593f7838b918a78124bad8451

  • C:\Users\Admin\AppData\Local\Temp\MSID30C.tmp

    Filesize

    144KB

    MD5

    7bd433f5a3c6d2d13ca44c317a1556ee

    SHA1

    991ba8ed59e0ae44e45251fb583e078ab969c5e4

    SHA256

    765ccdbff230e75109898ab3a44cf0ffb17feca6f6ea8f137251590f64cf222f

    SHA512

    75ae703052916ea59e8ef1215d7316392033bc7fb629138b5289e2ac6eaa9b26effc868e1cc18d4962680e5e0d78556660ed72524be4eb12bec375a1f23d9fb2

  • C:\Users\Admin\AppData\Local\Temp\MSID3B9.tmp

    Filesize

    2.5MB

    MD5

    18e5c693323bc7b09eba8e0fd01c053e

    SHA1

    fec0fdad9d8759370be13910a370c6ab0a82b669

    SHA256

    3c811c955a228434ca50e404a4204f89e44712738b6f562a983dfb4f35e04582

    SHA512

    9fd38885f0a7fe652aab88b0a3e4eee872e000bd8378c7d9ab6876eb6c0b45572ce51daec15442e36496c2a6e8751ed3273a4a8895042c49ebf2d9e975a65aec

  • C:\Users\Admin\AppData\Local\Temp\TarCF74.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\IsConfig.ini

    Filesize

    211B

    MD5

    267b5fcb549f829cbef8cab902d3bfc5

    SHA1

    11df4d5089d6cf459d9bdb2031bc7d9fd283670f

    SHA256

    6410a2fcabc5e14c4e567b629ae6b8446405b1f47a3dc7930ed241db4269fccb

    SHA512

    716b7185691d943edf514535d52345b06304bc7d2b36ed516d623a0ee28f396e8f7bb6bfb298d348e0a22b533a9f41d8146c58e60c050ed5809052d8f2880619

  • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\String1033.txt

    Filesize

    186KB

    MD5

    04a892d731647d00d7e1af40e7ef0524

    SHA1

    7437487968dea86c9d9f5a8d2fc5e4ca7d524a87

    SHA256

    eb087aaeb0737182861c12af07b59e907f398b4371d2690c6976001e456f4528

    SHA512

    eeee0fb3a902ef36cb4c19d0304ea44449ac4bc8a2291e5d308592490bb4498f6301b6fe6f900d39a4e47127d8562b1a3483e66796373152c0c519013ed09b05

  • C:\Users\Admin\AppData\Local\Temp\{F580A081-BE13-446C-87EC-C980A81F1E55}\setup.inx

    Filesize

    264KB

    MD5

    a8227d4f9c54a395f337bd777e066921

    SHA1

    e54ecad390a87d63a1330c4e28e1978eb24aae37

    SHA256

    bfa73c92a8fed819242abcc088aac5f326d95224645bdde963ef41af2bd6d761

    SHA512

    8841f440399dfd31a97d211a16f9f68d11fe882e236c427b88022820f693cf08d11a3a8d1f3c11e6639b4716ee68e754032d4b52af8e8870c42e7797d0f81fb3

  • \Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISBEW64.exe

    Filesize

    177KB

    MD5

    82e1a9d1e3d0107f7e1253fa92f86b10

    SHA1

    f8cae61e8d474ba1279baba932b76dc3003ccab6

    SHA256

    7d6a80ad2527b9769742749d091f17865c700452a2cd192b7c6ccac6580a9235

    SHA512

    dc569b11c4e22a075a22c6ef0d2f86b8989e76d30dbcb63fc46bfa77f50861b8f8b80e40d49a02f608ffe16fb94681fb0667fdf4bdd3ecfe0e11b40b81bac400

  • \Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\ISRT.dll

    Filesize

    423KB

    MD5

    25ddb7e609d08fe8bc83d452e38bfee1

    SHA1

    e7f34c41b9ba7ddd18f7821aa93c305075c53bdf

    SHA256

    e6daf03f2814583e163372b873a938829f57782d581ee931214c92350d18e903

    SHA512

    99eabdcb2bd1ec77ee5a0a30194b25ca2889bb810572b26b89460caab4dfad7cf65189d2d08054d00723e286188a1004620cf31aa94d8b632dc3d8b65d292c60

  • \Users\Admin\AppData\Local\Temp\{9CE69754-B96B-4175-826A-B68C1F101ABA}\_isres_0x0409.dll

    Filesize

    1.8MB

    MD5

    4f18ab4c0bcc2eda6c5d97bc801402d7

    SHA1

    b5786cdc91e50a7f75ccd2a63f59ed565a86694f

    SHA256

    919937f108f49eb6d7860717a7abc576c68017e394b8373f01defb2a000cc602

    SHA512

    ed5ae3b58b46f9261f264a62b37029ad0362fdaabc6ced9450048e1f748fdff09836c266e706b79c3b2be63d190dfc8d0e94724151471d082df02d7b8a95fcd2

  • memory/2424-124-0x00000000031C0000-0x0000000003387000-memory.dmp

    Filesize

    1.8MB

  • memory/2424-121-0x0000000010000000-0x0000000010112000-memory.dmp

    Filesize

    1.1MB

  • memory/2424-184-0x0000000010000000-0x0000000010112000-memory.dmp

    Filesize

    1.1MB

  • memory/2424-187-0x0000000003150000-0x0000000003317000-memory.dmp

    Filesize

    1.8MB