Resubmissions

24-07-2024 20:14

240724-y1a69sxfnb 8

Analysis

  • max time kernel
    141s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 20:14

General

  • Target

    FastReporter3_64_Bit/setup.exe

  • Size

    151.5MB

  • MD5

    ed35731f91fa9f827c03c8c247f3b69b

  • SHA1

    04ac0c3cb70b498318425654bffed8125785441b

  • SHA256

    9e86b6b9c86e0d3b50efbe26d81fc79b415227aa02fc1d59b1290f058d63711e

  • SHA512

    098704f2ca0f28653e8c0bc8cfad06cafc90811fc01775b58ed98c20fc7809254a833279db5f4158bd55900cefc084be5ea0c07e7233755c4cae8e0ca555cf51

  • SSDEEP

    3145728:4FKJ9voALH/20d1sb5AC38ylojtuaGL10KbX+za8:PzvBLfhalRoc710KbOG8

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 13 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FastReporter3_64_Bit\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\FastReporter3_64_Bit\setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3840
    • C:\Users\Admin\AppData\Local\Temp\{09F31861-225D-482B-AE5D-FC38E42DCF07}\setup.exe
      C:\Users\Admin\AppData\Local\Temp\{09F31861-225D-482B-AE5D-FC38E42DCF07}\setup.exe /q"C:\Users\Admin\AppData\Local\Temp\FastReporter3_64_Bit\setup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{09F31861-225D-482B-AE5D-FC38E42DCF07}" /IS_temp
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Windows\system32\MSIEXEC.EXE
        "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\FastReporter3_64_Bit\EXFO FastReporter 3 (64 Bit).msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\FastReporter3_64_Bit" SETUPEXENAME="setup.exe"
        3⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2148
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0DCED71F8C9429E74F2587A2C1662350 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3352
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E1AED955-9640-4244-BA69-29D9780E309C}
        3⤵
        • Executes dropped EXE
        PID:3764
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9FDAFB57-8B15-47BD-9AD3-0BBEDFA1DC77}
        3⤵
        • Executes dropped EXE
        PID:768
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B25253E8-14DC-46F0-B512-058D6A965C32}
        3⤵
        • Executes dropped EXE
        PID:2372
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C116791F-ED47-46FD-B547-D40C660C9077}
        3⤵
        • Executes dropped EXE
        PID:2052
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{17E3B5E7-DD07-40E0-A356-21114BC74C34}
        3⤵
        • Executes dropped EXE
        PID:3200
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CADC09A1-517C-44B6-92AB-D42D4F276985}
        3⤵
        • Executes dropped EXE
        PID:4424
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E92449DE-B78B-4233-B846-A2D6EE557152}
        3⤵
        • Executes dropped EXE
        PID:4304
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EDA9C45B-F7B9-4A3D-8CF1-516F29CBD2DC}
        3⤵
        • Executes dropped EXE
        PID:4880
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1493968F-79D9-4580-8A4D-C1FCBE104035}
        3⤵
        • Executes dropped EXE
        PID:4772
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6B34BD31-2E0A-482F-BDEC-9A1CC5576D2F}
        3⤵
        • Executes dropped EXE
        PID:3480
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EA611C44-A01A-47A8-917A-C625F2588411}
        3⤵
        • Executes dropped EXE
        PID:220
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7BC14FC4-34E7-4B2D-AC45-52FC04F5FC64}
        3⤵
        • Executes dropped EXE
        PID:1888
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7D04F02A-B601-448F-BEE8-D82521ECBCAC}
        3⤵
        • Executes dropped EXE
        PID:1568
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA968AAE-675E-4E44-A4CD-17AC0D4ACD94}
        3⤵
        • Executes dropped EXE
        PID:4720
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C8B27B08-FAF0-4EF5-91F4-BA137106FAC9}
        3⤵
        • Executes dropped EXE
        PID:4936
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2219B7F2-455F-4FB5-86E9-63F486FB2A3F}
        3⤵
        • Executes dropped EXE
        PID:2488
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EC0B28DB-D93A-4B22-ACD5-30B734B8806A}
        3⤵
        • Executes dropped EXE
        PID:2116
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5BBB68E9-4F5D-41AD-B201-AA9238CC99C3}
        3⤵
        • Executes dropped EXE
        PID:1820
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A8702874-7599-4279-949E-43D1A75D5F9E}
        3⤵
        • Executes dropped EXE
        PID:1784
      • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C5061124-C5F6-4321-86A5-A04914472A03}
        3⤵
        • Executes dropped EXE
        PID:4444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MSID060.tmp

    Filesize

    153KB

    MD5

    1a42ff9ff5945cb3a3589a74eb683de1

    SHA1

    a463b74e1919c3c60a9daf5462de9338b426de9e

    SHA256

    cde61e213903f7bfb46efe6db64e5946d01cfb169a6859358df20c3302dcd2ed

    SHA512

    b485a878e43a39934c9715a271f7d5d1612257ef508817feffdf759dfc890bd31ed3c6051a84982f73d3d5915b4739fd3557635b7ce30afdc7b9d29aeb9020bf

  • C:\Users\Admin\AppData\Local\Temp\MSID0ED.tmp

    Filesize

    320KB

    MD5

    2640e1c49399712536e995c4d3144dce

    SHA1

    1bc508458539f4b1947c1cdf6f17e1f7c20aebd7

    SHA256

    14f978cc08214b85557af426efc2ece84b0b77ea502990616f043effbf7342ed

    SHA512

    335af96bd9d85b5224709e65789cd9c9a824e53a5094e54f173e13ad8ef9ec84191623558a93a6f83bff9bc20430ac0e26e2f20593f7838b918a78124bad8451

  • C:\Users\Admin\AppData\Local\Temp\MSID0FE.tmp

    Filesize

    144KB

    MD5

    7bd433f5a3c6d2d13ca44c317a1556ee

    SHA1

    991ba8ed59e0ae44e45251fb583e078ab969c5e4

    SHA256

    765ccdbff230e75109898ab3a44cf0ffb17feca6f6ea8f137251590f64cf222f

    SHA512

    75ae703052916ea59e8ef1215d7316392033bc7fb629138b5289e2ac6eaa9b26effc868e1cc18d4962680e5e0d78556660ed72524be4eb12bec375a1f23d9fb2

  • C:\Users\Admin\AppData\Local\Temp\issB78A.tmp

    Filesize

    2.5MB

    MD5

    18e5c693323bc7b09eba8e0fd01c053e

    SHA1

    fec0fdad9d8759370be13910a370c6ab0a82b669

    SHA256

    3c811c955a228434ca50e404a4204f89e44712738b6f562a983dfb4f35e04582

    SHA512

    9fd38885f0a7fe652aab88b0a3e4eee872e000bd8378c7d9ab6876eb6c0b45572ce51daec15442e36496c2a6e8751ed3273a4a8895042c49ebf2d9e975a65aec

  • C:\Users\Admin\AppData\Local\Temp\{09F31861-225D-482B-AE5D-FC38E42DCF07}\0x0409.ini

    Filesize

    21KB

    MD5

    a108f0030a2cda00405281014f897241

    SHA1

    d112325fa45664272b08ef5e8ff8c85382ebb991

    SHA256

    8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

    SHA512

    d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

  • C:\Users\Admin\AppData\Local\Temp\{09F31861-225D-482B-AE5D-FC38E42DCF07}\Setup.INI

    Filesize

    5KB

    MD5

    8efeb9239e2d0474bbd5b3017a056886

    SHA1

    74e594d14bfde28c9722ac29888f0138682a4a88

    SHA256

    e28e1a2ff079398438083f96eaa4bd30f2fe3169d4d19ba578a4c179e800b1d0

    SHA512

    7a965db7d3c250d7b6578230933c60b6034cdf93ed382c780eebee2cf08f08049cdb2ef7a7640da7a0cdfee6f09766de7e46e81ae4756d19efb0648143e04a09

  • C:\Users\Admin\AppData\Local\Temp\{09F31861-225D-482B-AE5D-FC38E42DCF07}\_ISMSIDEL.INI

    Filesize

    592B

    MD5

    bbe12d7397a6d9323a4418f142f540dc

    SHA1

    77145160c520f15c1c6908bbebf37517bcd42b05

    SHA256

    c8c93cbc6fbb35279c8f60798978ab49d3d9b7764cef8773639db97c1b237583

    SHA512

    b105929d1179f49dec7def5f4bb2ad7976af27f9669bc99e466fbdee8450a4deb80de5f6a408db78763d61633d9b9056d502ca119af4da44869e5dc9d1227b37

  • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISBEW64.exe

    Filesize

    177KB

    MD5

    82e1a9d1e3d0107f7e1253fa92f86b10

    SHA1

    f8cae61e8d474ba1279baba932b76dc3003ccab6

    SHA256

    7d6a80ad2527b9769742749d091f17865c700452a2cd192b7c6ccac6580a9235

    SHA512

    dc569b11c4e22a075a22c6ef0d2f86b8989e76d30dbcb63fc46bfa77f50861b8f8b80e40d49a02f608ffe16fb94681fb0667fdf4bdd3ecfe0e11b40b81bac400

  • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\ISRT.dll

    Filesize

    423KB

    MD5

    25ddb7e609d08fe8bc83d452e38bfee1

    SHA1

    e7f34c41b9ba7ddd18f7821aa93c305075c53bdf

    SHA256

    e6daf03f2814583e163372b873a938829f57782d581ee931214c92350d18e903

    SHA512

    99eabdcb2bd1ec77ee5a0a30194b25ca2889bb810572b26b89460caab4dfad7cf65189d2d08054d00723e286188a1004620cf31aa94d8b632dc3d8b65d292c60

  • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\String1033.txt

    Filesize

    186KB

    MD5

    04a892d731647d00d7e1af40e7ef0524

    SHA1

    7437487968dea86c9d9f5a8d2fc5e4ca7d524a87

    SHA256

    eb087aaeb0737182861c12af07b59e907f398b4371d2690c6976001e456f4528

    SHA512

    eeee0fb3a902ef36cb4c19d0304ea44449ac4bc8a2291e5d308592490bb4498f6301b6fe6f900d39a4e47127d8562b1a3483e66796373152c0c519013ed09b05

  • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\_isres_0x0409.dll

    Filesize

    1.8MB

    MD5

    4f18ab4c0bcc2eda6c5d97bc801402d7

    SHA1

    b5786cdc91e50a7f75ccd2a63f59ed565a86694f

    SHA256

    919937f108f49eb6d7860717a7abc576c68017e394b8373f01defb2a000cc602

    SHA512

    ed5ae3b58b46f9261f264a62b37029ad0362fdaabc6ced9450048e1f748fdff09836c266e706b79c3b2be63d190dfc8d0e94724151471d082df02d7b8a95fcd2

  • C:\Users\Admin\AppData\Local\Temp\{34E9AE17-7B2D-4AE6-840C-19AD0318B093}\setup.inx

    Filesize

    264KB

    MD5

    a8227d4f9c54a395f337bd777e066921

    SHA1

    e54ecad390a87d63a1330c4e28e1978eb24aae37

    SHA256

    bfa73c92a8fed819242abcc088aac5f326d95224645bdde963ef41af2bd6d761

    SHA512

    8841f440399dfd31a97d211a16f9f68d11fe882e236c427b88022820f693cf08d11a3a8d1f3c11e6639b4716ee68e754032d4b52af8e8870c42e7797d0f81fb3

  • C:\Users\Admin\AppData\Local\Temp\{40C96115-98A2-410D-B1F9-7E4FB762B61C}\IsConfig.ini

    Filesize

    211B

    MD5

    267b5fcb549f829cbef8cab902d3bfc5

    SHA1

    11df4d5089d6cf459d9bdb2031bc7d9fd283670f

    SHA256

    6410a2fcabc5e14c4e567b629ae6b8446405b1f47a3dc7930ed241db4269fccb

    SHA512

    716b7185691d943edf514535d52345b06304bc7d2b36ed516d623a0ee28f396e8f7bb6bfb298d348e0a22b533a9f41d8146c58e60c050ed5809052d8f2880619

  • memory/3352-135-0x0000000010000000-0x0000000010112000-memory.dmp

    Filesize

    1.1MB

  • memory/3352-139-0x0000000003720000-0x00000000038E7000-memory.dmp

    Filesize

    1.8MB

  • memory/3352-169-0x0000000010000000-0x0000000010112000-memory.dmp

    Filesize

    1.1MB

  • memory/3352-172-0x0000000003760000-0x0000000003927000-memory.dmp

    Filesize

    1.8MB