Overview

overview

7

Static

static

3

MiniMeters....8.exe

windows7-x64

MiniMeters....8.exe

windows10-2004-x64

Analysis

  • max time kernel
    108s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 10:41

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    MiniMeters-Setup-0.8.8.exe

  • Size

    28.2MB

  • MD5

    11757c809c28ec54cc3d7973e142d4a2

  • SHA1

    138a36b6fe36726a769c5021a5a6e31a14a1024e

  • SHA256

    5280d23c881a12ef908b17cccab1c1d16876d6d930fddc26bffd8535e612028e

  • SHA512

    ce4126e700f81e27c72455ca47e877a41a8a11edcc7b8c655f5eb63c9486da56adaa56ac76c80765d46a1c097c1cfa85231452f8aa593499c92d7b732d75d289

  • SSDEEP

    786432:YsAaQfZPG50jBk/bzL/DMia2MAtKjjhNtUyu6As7BcpLBiO:YsAaQfhGeVk/fLLla2Vt8N6yu6As7Opx

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 50 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\MiniMeters-Setup-0.8.8.exe
    "C:\Users\Admin\AppData\Local\Temp\MiniMeters-Setup-0.8.8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Local\Temp\is-4V147.tmp\MiniMeters-Setup-0.8.8.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4V147.tmp\MiniMeters-Setup-0.8.8.tmp" /SL5="$5029E,28772797,831488,C:\Users\Admin\AppData\Local\Temp\MiniMeters-Setup-0.8.8.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3644
      • C:\Users\Admin\AppData\Local\Temp\is-G3NB9.tmp\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-G3NB9.tmp\vc_redist.x64.exe" /install /passive /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\Windows\Temp\{52D90916-A9B8-45D1-BF84-3EF7497CE2AB}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{52D90916-A9B8-45D1-BF84-3EF7497CE2AB}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-G3NB9.tmp\vc_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=556 /install /passive /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1844
          • C:\Windows\Temp\{EA897398-6CB3-4B81-97AE-9BDD35A6594D}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{EA897398-6CB3-4B81-97AE-9BDD35A6594D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{71DC3ABD-D12E-48D8-801D-732418045DFC} {E3D7496D-371D-4981-820C-62C56B75C4F6} 1844
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4408
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d4cecf3b-b68f-4995-8840-52ea0fab646e} -burn.filehandle.self=1084 -burn.embedded BurnPipe.{0B8E6207-28E4-4A0B-AE52-348454BA51BE} {FDA0D13C-C963-44C3-BFEB-82BF4A0C3AE0} 4408
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3036
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d4cecf3b-b68f-4995-8840-52ea0fab646e} -burn.filehandle.self=1084 -burn.embedded BurnPipe.{0B8E6207-28E4-4A0B-AE52-348454BA51BE} {FDA0D13C-C963-44C3-BFEB-82BF4A0C3AE0} 4408
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:212
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{88FCB5DD-93B8-4712-8F8D-EAE47805CF8D} {B258FDF3-D43C-40B1-BF04-88803C1CA671} 212
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4180
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2736
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:1012
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1052
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3925855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4672

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e590b56.rbs
      Filesize

      19KB

      MD5

      dd6331ac7f77f9c1e52caac44b7e1e70

      SHA1

      424987610a5c839555db598fd2b19e50baec20aa

      SHA256

      3a8c1b584685cb66035c172814f841afa480014dec87c3fcaafbb54ae3aa2981

      SHA512

      795859be17679c04567c5cb09392ed6e8c5717bcb07d564eb314c34079478da1d7855010883eec4e4c7d827c319beb50ad284684012328eb879013b669ede36f

      Download Submit

    • C:\Config.Msi\e590b62.rbs
      Filesize

      19KB

      MD5

      4d3108b89e7e9d8c84356f0875cea967

      SHA1

      0fce47c586e8694665ba6f351988f3bdfca4a8bc

      SHA256

      1f95ade5f5b943da6db5132bc37ac3fec300b1623c8f1f698dbf23a733bb45f8

      SHA512

      d152fece6f9c30fe9201ebb42b247d748c7ff0387f59b5f039eeaf4ac41d8e31f0eaff34463cd333b8a79b9d753e8a4a33027f62dae54754eba0a74a9356ea3b

      Download Submit

    • C:\Config.Msi\e590b69.rbs
      Filesize

      21KB

      MD5

      12403411c369775335dc4e90e1206a9a

      SHA1

      6496584addfab9156c675c6b0af410261f91cb9e

      SHA256

      52b7b142a3f85f38cac7ce8913c57b5e522d262fb7a75375824ae8eccfa9677b

      SHA512

      c71e9a6991cbc78328d1dc1aab44d94709fdfec6078fd31dee206918e54df00947a2dceb78344b0857090b683a3d245c08467db4257094b763db7a12848afd9f

      Download Submit

    • C:\Config.Msi\e590b78.rbs
      Filesize

      21KB

      MD5

      2915f4d2b814550087d7ae29cdfa6130

      SHA1

      6bdc0c19401ee19478110309295f2b24563a2fc4

      SHA256

      7697e304bdb074744a23052d7a7fd27a0aee1c685fe039d37fd0468142b1739e

      SHA512

      11a9c8fdb07b613564bf3ac44f849f5794f9f21a76aa9fa6d16295f97a149cf437696193dc889e4ebfc5bc3eaac34567f23aa779ee2e5b897e6c3b918f3bd874

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240725104305_000_vcRuntimeMinimum_x64.log
      Filesize

      2KB

      MD5

      5ddf47e34f1a316d07277d2376aa22ea

      SHA1

      5564d7106368507ee45447964964b8c48443afa8

      SHA256

      1d60e3765fedf3c14629e19fd94b4049bb01bad77d6c1d6ed2a1853ac1a1a564

      SHA512

      531544f82544d9072f262ac1cff8ff7d7e657e1c98deb72790547329e4891f4e06a75a7f6b4920f0f3fa726c7a0a7e2bd2fdf5e470de5e4a5ebae503df687080

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240725104305_001_vcRuntimeAdditional_x64.log
      Filesize

      2KB

      MD5

      2812109906bc90f2cfe27e3e2a7896d9

      SHA1

      a2fb98891e53a305252dfc2d0ba937f03999cb6f

      SHA256

      92effe245c176e2bb6174cbcfd36a71167ef6ac9641e93c37ceedb990dfd85ae

      SHA512

      0dc5dd9664032cac994bdc88980b4a857ef83269cd849cf05ccbbd1f490c1c63411eaaa462673f1182c99313ccdc667e775db2853af470893be9fa842f64b0b3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\is-4V147.tmp\MiniMeters-Setup-0.8.8.tmp
      Filesize

      3.0MB

      MD5

      796fd22a1f17d71c12028c828be5bef2

      SHA1

      5a6b743443f4137bb57f98abea408c4df6a9498d

      SHA256

      f3d3116bee51a6d81d7ca9034dbd28ba7fac642f370f6191f2369cfb839b9bef

      SHA512

      7cce31394495a2d99aae15eb0c2ca61951117f1b3d9b2c40d9f1e4ee64c0627c20be809258e2d7ab2e0f254f17f56392366cf919483d2a5f72fe654dd1003eb7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\is-G3NB9.tmp\vc_redist.x64.exe
      Filesize

      24.3MB

      MD5

      703bd677778f2a1ba1eb4338bac3b868

      SHA1

      a176f140e942920b777f80de89e16ea57ee32be8

      SHA256

      2257b3fbe3c7559de8b31170155a433faf5b83829e67c589d5674ff086b868b9

      SHA512

      a66ea382d8bdd31491627fd698242d2eda38b1d9df762c402923ef40bbca6aa2f43f22fa811c5fc894b529f9e77fcdd5ced9cd8af4a19f53845fce3780e8c041

      Download Submit

    • C:\Windows\Temp\{52D90916-A9B8-45D1-BF84-3EF7497CE2AB}\.cr\vc_redist.x64.exe
      Filesize

      635KB

      MD5

      848da6b57cb8acc151a8d64d15ba383d

      SHA1

      8f4d4a1afa9fd985c67642213b3e7ccf415591da

      SHA256

      5a61f9775032457db28edd41f98f08c874e759f344ea8475c9ac8abbba68de12

      SHA512

      ff8b87e7746ecf19a150874dedd6ea4c51c76cfc291c5a80d9e5073a9bbbb2bd6ed7d10425b083578dc8d28d0d905e379fa3f919a60979e5b5c44ebc0ac613e6

      Download Submit

    • C:\Windows\Temp\{EA897398-6CB3-4B81-97AE-9BDD35A6594D}\.ba\logo.png
      Filesize

      1KB

      MD5

      d6bd210f227442b3362493d046cea233

      SHA1

      ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

      SHA256

      335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

      SHA512

      464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

      Download Submit

    • C:\Windows\Temp\{EA897398-6CB3-4B81-97AE-9BDD35A6594D}\.ba\wixstdba.dll
      Filesize

      191KB

      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

      Download Submit

    • C:\Windows\Temp\{EA897398-6CB3-4B81-97AE-9BDD35A6594D}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
      Filesize

      5.4MB

      MD5

      62bc0f466e65d9219281cf75c8f91380

      SHA1

      0826a1591b81acf0fe30d58e19b0a87df2a49a3e

      SHA256

      534dd81be6b7a23a745c36eda87e6387c5d146c3a96c84793d0edc7eb85b40f3

      SHA512

      17713f4228c0c2793c622bbb0a90bd5688d98a6576a695cb956fa233238c4c6e5b0cb43510be4f072613ad575d0b44e7c847f48b785a161cc337a9e6fdca3bb5

      Download Submit

    • C:\Windows\Temp\{EA897398-6CB3-4B81-97AE-9BDD35A6594D}\cab5046A8AB272BF37297BB7928664C9503
      Filesize

      914KB

      MD5

      45c9c674c0ba87f57168d6ab852e9641

      SHA1

      73ace24362f14dc58d4099dae6e4e62902e9e950

      SHA256

      d14f231d1ab0d928e309b067622b5389e0dc6c4f0d3671632066f6586c442c76

      SHA512

      5bb06ca9c966c9edd30944523a84efd3c13b8eb9f6a5c6cfd961a0c82a1cb193e7b58baf888dede7b740ed42ce76ab20c3e41a684c4dd9d818ff8b0d9e52e684

      Download Submit

    • C:\Windows\Temp\{EA897398-6CB3-4B81-97AE-9BDD35A6594D}\vcRuntimeAdditional_x64
      Filesize

      180KB

      MD5

      c214a9e931bbdd960bb48ac1a2b91945

      SHA1

      a640c55dd522e01d0be4307a5eee9a40f779a6cc

      SHA256

      1dbd3e4e71c6678e640c289c1c64bbb12c70f65f52b27191680a9e4141d64b11

      SHA512

      d25fef3bdd3cd18035892618602e27621e9fb3a913e7972ec7bb624d593ae4b766e718fd2e2c7342c589e9a97beb03d2fedef22e824c6b539b83f199cb967933

      Download Submit

    • C:\Windows\Temp\{EA897398-6CB3-4B81-97AE-9BDD35A6594D}\vcRuntimeMinimum_x64
      Filesize

      180KB

      MD5

      df77fc41aa2f85ca423919e397084137

      SHA1

      5b87cd2dfb661df49f9557e2fc3b95c7833c9b0b

      SHA256

      51b6a928f7becbf525cbeff180442b05533f8ea8f8494cc97a491e29bdd4b7c2

      SHA512

      a36b093011b9534db0881eb72de4638e39be67a9844b14fcd3e40539aafd9aa9ce7b14d3968aedb092ecf9bca9ac0918a65f65632643782edafefa36fc12c3e2

      Download Submit

    • memory/212-287-0x0000000000010000-0x0000000000087000-memory.dmp

      Filesize

      476KB

      Download

    • memory/1936-8-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

      Download

    • memory/1936-0-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

      Download

    • memory/1936-2-0x0000000000401000-0x00000000004B7000-memory.dmp

      Filesize

      728KB

      Download

    • memory/1936-332-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

      Download

    • memory/3036-288-0x0000000000010000-0x0000000000087000-memory.dmp

      Filesize

      476KB

      Download

    • memory/3644-9-0x0000000000400000-0x000000000071A000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/3644-6-0x0000000000400000-0x000000000071A000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/3644-46-0x0000000000400000-0x000000000071A000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/3644-329-0x0000000000400000-0x000000000071A000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/3644-331-0x0000000000400000-0x000000000071A000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/4180-250-0x0000000000010000-0x0000000000087000-memory.dmp

      Filesize

      476KB

      Download