Overview

overview

6

Static

static

1

setup_eng_...al.exe

windows7-x64

6

setup_eng_...al.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/08/2024, 18:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_eng_is_trial.exe

  • Size

    13.8MB

  • MD5

    fdc11b87cc953f02c5955c1e2b28971b

  • SHA1

    4b70de219fa8e6f72baab6a8a5fe2c1c82fee02b

  • SHA256

    c4bb38b9080999e126043844b4461b45c1d770ce3f69c86d0037e3604a78bd05

  • SHA512

    e2d21678e3d47a8849cefb8163d0c478a9795b97d049ba6d31bf1bb6a8be97b86e7c2cfed1601722211b7c30479618e4f4a02a0c7f2cfafd0c226a3fb2822e84

  • SSDEEP

    393216:yX9lzMRum1QuPCN6X9lzMRum1QuPCNOrApfBRcuz:g9lzMRum1QzN49lzMRum1QzNOrA1BR5z

Score
6/10
discovery

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Loads dropped DLL 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_eng_is_trial.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_eng_is_trial.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3380
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding AF87CA979B89CBD361657E46DA1F3758 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\PrepareDlgProgress.gif
    Filesize

    24KB

    MD5

    f550f449baed1315c7965bd826c2510b

    SHA1

    772e6e82765dcfda319a68380981d77b83a3ab1b

    SHA256

    0ee7650c7faf97126ddbc7d21812e093af4f2317f3edcff16d2d6137d3c0544d

    SHA512

    7608140bc2d83f509a2afdaacd394d0aa5a6f7816e96c11f4218e815c3aaabf9fc95dd3b3a44b165334772ebdab7dfa585833850db09442743e56b8e505f6a09

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\backbutton
    Filesize

    404B

    MD5

    50e27244df2b1690728e8252088a253c

    SHA1

    b84ad02fd0ed3cb933ffbd123614a2495810442b

    SHA256

    71836c56ec4765d858dc756541123e44680f98da255faf1ece7b83d79809b1c3

    SHA512

    ba3d3535bfd2f17919e1a99e89fdb1c9a83507ff3c2846c62770e210a50aee1281445d510858d247cc9619861089aaf20f45b0b7c39f15c0ea039ac5498fa03e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\background
    Filesize

    134B

    MD5

    a0efb0e7b9cee25b09e09a1a64e96ba6

    SHA1

    0c1e18f6f5e6e5e6953e9fb99ca60fdec35d6e39

    SHA256

    f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787

    SHA512

    7e53f9f564aaa529b3b15035671957c2923ec98ddee93758ea7a4c8645ee9058962078771b853e3490290fde1f57030dff5092d40d69418776ffee89f79c8a7c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\browsebutton
    Filesize

    253B

    MD5

    9554be0be090a59013222261971430ad

    SHA1

    9e307b13b4480d0e18cfb1c667f7cfe6c62cc97c

    SHA256

    f4302ee2090bc7d7a27c4bc970af6eb61c050f14f0876541a8d2f32bc41b9bab

    SHA512

    ac316f784994da4fed7deb43fe785258223aba5f43cc5532f3e7b874adc0bc6dbcd8e95e631703606dfaa2c40be2e2bb6fa5bc0a6217efe657e74531654ea71c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\checkbox
    Filesize

    1KB

    MD5

    0b044ccde7aa9d86e02a94030d744ac2

    SHA1

    0594ebb3737536703907ba5672ccd351c6afb98a

    SHA256

    bce5b6de3a1c7af7ec14b6643da25f7c9e15bd5f1c4a38abfcddc70a5e93bdd3

    SHA512

    dbfba793722589f1a76dbc75c9a2f3646733e4a079a6b70003716a7f7b8fa1a6a2b234ec9132f5737e91d20d460db1e29826b2d7ac740f73136975f19e336cd8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\frame_bottom_left.bmp
    Filesize

    66B

    MD5

    1fb3755fe9676fca35b8d3c6a8e80b45

    SHA1

    7c60375472c2757650afbe045c1c97059ca66884

    SHA256

    384ebd5800becadf3bd9014686e6cc09344f75ce426e966d788eb5473b28aa21

    SHA512

    dee9db50320a27de65581c20d9e6cf429921ebee9d4e1190c044cc6063d217ca89f5667dc0d93faf7dcc2d931fe4e85c025c6f71c1651cbd2d12a43f915932c3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\frame_bottom_mid.bmp
    Filesize

    66B

    MD5

    71fa2730c42ae45c8b373053cc504731

    SHA1

    ef523fc56f6566fbc41c7d51d29943e6be976d5e

    SHA256

    205209facdebf400319dbcb1020f0545d7564b9415c47497528593e344795afd

    SHA512

    ea4415619720cc1d9fb1bb89a14903bfd1471b89f9c4847df4839084aae573d49b4969d3799ad30ff25b71f6e31f8d9f30701e1240d3cd6a063819c04873f21f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\frame_caption.bmp
    Filesize

    206B

    MD5

    8641f45594b8d413bf1da25ce59f1207

    SHA1

    afebb23f5a55d304d028ca9942526b3649cddb52

    SHA256

    0403ed31d75dcc182dd98f2b603da4c36b6325e9d159cac4371e1448244bb707

    SHA512

    86a5f959f8462f866466dc706d3ae627b1fb019b8a33ee7fe48e3b69f92bf33dc0f1417c0d5116552b25b488bcb5d9050a33773e6883ebe08410267d95b2353a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\frame_left.bmp
    Filesize

    66B

    MD5

    30384472ae83ff8a7336b987292d8349

    SHA1

    85d3e6cffe47f5a0a4e1a87ac9da729537783cd0

    SHA256

    f545ec56bc9b690a6b952471669a8316e18274d64e2ebc9e365fcf44363a125a

    SHA512

    7611f930a0a1089cc5004203ec128c916f0c2aedae3a6fcc2eaffa8cd004dcbf154714e401947921a06896ca77c77daec7f9bda82369aacd3bb666f8a0331963

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\frame_left_inactive.bmp
    Filesize

    66B

    MD5

    4b84f29fbce81aab5af97a311d0e51e2

    SHA1

    60723cf4b91c139661db5ecb0964deca1fc196ea

    SHA256

    c93be5a7c979c534274fc1a965d26c126efa5d58c14066b14937e5aba3b9eb55

    SHA512

    775eadccc44fddbd1e0d4231bc90d222f0a9749199e1963449ad20285ea92941a5685cdc12c0cd8c0ef0a21e10bdacaf139e5c69cd5e402cc110679323c23df1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\frame_top_left.bmp
    Filesize

    154B

    MD5

    1966f4308086a013b8837dddf88f67ad

    SHA1

    1b66c1b1ad519cad2a273e2e5b2cfd77b8e3a190

    SHA256

    17b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741

    SHA512

    ec50f92b77bca5117a9a262ba1951e37d6139b838099e1546ab2716c7bafb0fc542ce7f1993a19591c832384df01b722d87bb5a6a010091fc880de6e5cfa6c17

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\frame_top_mid.bmp
    Filesize

    66B

    MD5

    4e0ac65606b6aacd85e11c470ceb4e54

    SHA1

    3f321e3bbde641b7733b806b9ef262243fb8af3b

    SHA256

    1d59fe11b3f1951c104f279c1338fc307940268971d016ebe929a9998a5038ee

    SHA512

    7b28bcb4e76af3b863a7c3390b6cd3316c4631434e1d1e2df8d6e0eb9987a61a4f1a24de59567394e346d45e332403a0817ed0b0b64d7a624dbe48e30db9bb64

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\icon.ico
    Filesize

    14KB

    MD5

    b9b820ed2e52f7bed93aa3f66c1f12d1

    SHA1

    a35e96aee18103189773563b3cb7eb0f461213e7

    SHA256

    d3248fe6608b58a59356a33269b05a72908214de65189e376e88c2af1f40383a

    SHA512

    d045c5a30636bb43ba1ba0a4f1bcfc27ea2a2ce8a0b5060f285f4cf03f87cd7aa9c0aa6b75802b517bcedb79d62cd78307e72ae402a27f7a869475d1f5b20463

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\metroinstallbutton
    Filesize

    520B

    MD5

    70db38d656afa3778dcf6173d390e61b

    SHA1

    8b8674d6d70d67943d313d2b74222daa4bd1691d

    SHA256

    3a0a5b69f9da7cae9fc631326ed8aa97abbaaecf2bf15d0a73169a29f3381e83

    SHA512

    8888ab493c7342f69b33279eaec4f99c41a906929d65503c48c7059d199fbab267ba9ad6ef6e57a7a56d2a321c01e46008f770afe67fa99ec7b7676ec2376c05

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\nextcancelbuttons
    Filesize

    404B

    MD5

    583580e2c651f5c230fb3235b7ca0e3b

    SHA1

    a9bd6aeef43a6f4c0c00d1ecd98a585d7eb0aaa3

    SHA256

    65172283ee04f2fa18d0e57b21471be2e68017d1f61816aaaa6be070b446346f

    SHA512

    6c61e6c06c883113a7a0efbd352120354c070f5c17d770b6b821c42cb9d9ca895992842b29b51bd3e569b0c95e93709dd7c1c2a26bcff0ad425079f5302670ce

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\sys_close_hot.png
    Filesize

    276B

    MD5

    17242d201d004bb34449aab0428d2df1

    SHA1

    77a332c6a6c4bfc47a2120203cfeabb8a2268a6b

    SHA256

    15405855866fa2b7c60afbc8ba720aae8f2ba7fb60bfa641dc9d10361e56f033

    SHA512

    605a97e2614c664417d53263be21c67b1504a46ee61b92b0a84ac18a7baab05eb56b72d4cf27372ae6c157928080ba16e24081e95458eb122ba18f3722c2d21f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\sys_close_normal.png
    Filesize

    225B

    MD5

    8ba33e929eb0c016036968b6f137c5fa

    SHA1

    b563d786bddd6f1c30924da25b71891696346e15

    SHA256

    bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5

    SHA512

    ba3a70757bd0db308e689a56e2f359c4356c5a7dd9e2831f4162ea04381d4bbdbef6335d97a2c55f588c7172e1c2ebf7a3bd481d30871f05e61eea17246a958e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3380\sys_min_hot.png
    Filesize

    180B

    MD5

    1a883668b735248518bfc4eefd248113

    SHA1

    1112803a0558a1ad049d1cac6b8a9d626b582606

    SHA256

    bcbb601daa5a139419f3cd0f6084615574c41b837426ebff561b7846dfec038e

    SHA512

    d321878ed517544c815fd0236bdff6fcb6da5c5c3658338afba646f1d8f2e246c6c880d4f592ff574a18f9efdf160e5772bbf876fb207c8fd25c1f9dd9ddfd04

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MSI96F1.tmp
    Filesize

    819KB

    MD5

    f9db432474c482167d7a628100b08df0

    SHA1

    842e7a315d1d434d0965f0ec634ef815bb32464e

    SHA256

    83ce52495cc0c59a7ac869a7379719a1e64bcd18837109a8778c4b262792924b

    SHA512

    fada58e215333c1e658fea806f5738dcb5e413f0604939449d56cb74edd6f64eae90eeb47943634b0d6107cec389c9d139609975d6f52d0027eb836ece1730fc

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Minds Insider Ltd\Waredot Internet Security 2.0.0\install\Waredot Internet Security.msi
    Filesize

    3.6MB

    MD5

    8a71c35fcb355d5ec1e89b46cb041df0

    SHA1

    7abb25b19f2d5784c2d96e6381acefd9b83bb00f

    SHA256

    a3dd1176dedea86ea243a0bf83a3a9562c2d46dd544a87ade13af9a7485ed923

    SHA512

    468edf9e9ab007147110e5beb23cd89f12a664931da5a2f0b5962290b6094c2cd92da6b72ba5e02ce5b6c0ed9e079fa875d810b6bc964c7c14d94f3bd1a6c896

    Download Submit