73ce1277ab8bd148f5c40e121c1fd7710acb1443e074c0f926b871c36f0f35bc

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/windowsdesktop-runtime-7.0.11-win-x86.exe
Size

50.6MB
MD5

7971543116eca5be24d8c68c87e578c6
SHA1

7494d16f34b5f7ed1388038818817732fa7b8204
SHA256

9e3802fa0578282a65d8df72ba0308660fe80a67dd023e02e94dc2d3c11834e5
SHA512

b7583409ea718d60ac81e8d28ab7511850d0b43e9bb9ea8488dd473b1ca904afe99d1ab298b1c5ab5271d8584baed65653196d3caf0ad9737e70f2eccbb9be4c
SSDEEP

1572864:X0O4UtPJkn3tgKnhGV/38V7Hf56BzAjpu/NlIu0TP:XjtmK+4P8V7Hfi+pu/NazL

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

windowsdesktop-runtime-7.0.11-win-x86.exe

pid process

4700 windowsdesktop-runtime-7.0.11-win-x86.exe
Loads dropped DLL 1 IoCs

Processes:

windowsdesktop-runtime-7.0.11-win-x86.exe

pid process

4700 windowsdesktop-runtime-7.0.11-win-x86.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4700	windowsdesktop-runtime-7.0.11-win-x86.exe

pid	process
4700	windowsdesktop-runtime-7.0.11-win-x86.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

windowsdesktop-runtime-7.0.11-win-x86.exewindowsdesktop-runtime-7.0.11-win-x86.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-7.0.11-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-7.0.11-win-x86.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

windowsdesktop-runtime-7.0.11-win-x86.exe

description	pid	process	target process
PID 436 wrote to memory of 4700	436	windowsdesktop-runtime-7.0.11-win-x86.exe	windowsdesktop-runtime-7.0.11-win-x86.exe
PID 436 wrote to memory of 4700	436	windowsdesktop-runtime-7.0.11-win-x86.exe	windowsdesktop-runtime-7.0.11-win-x86.exe
PID 436 wrote to memory of 4700	436	windowsdesktop-runtime-7.0.11-win-x86.exe	windowsdesktop-runtime-7.0.11-win-x86.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\windowsdesktop-runtime-7.0.11-win-x86.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\windowsdesktop-runtime-7.0.11-win-x86.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\Temp\{DE5E267B-A5E5-4D18-9C57-DA9272743EF6}\.cr\windowsdesktop-runtime-7.0.11-win-x86.exe
"C:\Windows\Temp\{DE5E267B-A5E5-4D18-9C57-DA9272743EF6}\.cr\windowsdesktop-runtime-7.0.11-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\windowsdesktop-runtime-7.0.11-win-x86.exe" -burn.filehandle.attached=656 -burn.filehandle.self=652
2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{DE5E267B-A5E5-4D18-9C57-DA9272743EF6}\.cr\windowsdesktop-runtime-7.0.11-win-x86.exe
Filesize
610KB

MD5
cefcea3a4572d5dad278ce5054ff6dd7

SHA1
2730c17fc5127d713c0acd116cb6d9f91d383612

SHA256
4e663d7ab583c818239e1b5d773d110f9a3eba2492d0230b9e7028feda89330a

SHA512
13a163aeaf5aa5aa5b80fd08bee2a2309640d5f804c5e493a490cea6557d36ac15103b9bcbd7cc073c238bdc8a404544eb529d6b7c7f855e66190bfde2ac67ac

Download Submit
C:\Windows\Temp\{E6ED57D8-8341-40E0-9806-0480C323A3AC}\.ba\bg.png
Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{E6ED57D8-8341-40E0-9806-0480C323A3AC}\.ba\wixstdba.dll
Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit