Analysis
-
max time kernel
291s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-08-2024 16:20
General
-
Target
setup.exe
-
Size
2.6MB
-
MD5
b3d10c2ff044dbca8f0d15f03925b105
-
SHA1
2259255c190241f5a8e6e18c74bf2bb4724f7aa9
-
SHA256
3adecd3e1dc942ffefe7a429cceb774030b89b40a9c1556fdd20d54e7e9996d3
-
SHA512
7aff9b263f7b73e831ce3a6771f7cdd69cab96ea9b8304a0ee8362e1c2b737bdc0acc07b202bb84449d0160bbab9f628b7e1e24097babd09bfb52f4789323049
-
SSDEEP
49152:w73UUTfHju2BuppUDms0fOjKODCrWurHXqVbhu8gJ+7WmA7R:o3tazUFrKODCrWur6lI1mK
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 10 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FS25U.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-FS25U.tmp\setup.tmp" /SL5="$802CA,2164130,699392,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HATML.tmp\lzma2.exelzma2 x -txz -mmt=6 -an -y -si -so3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
626KB
MD5254321c6fdf0b1de79aff77fa6ad825e
SHA11b48f9688e4703dba7b127c2bf4f40cabf341247
SHA2562587aa207e251d7e35937e11e2cf3426ba933a0a36c4cc8b7289933678bd26df
SHA5127625fc3b6a47d31abcb3142bbb7d03d21d5d52fbc71db337f5f29c137b3a5d20dd708c66b89ff930edf03bd290680c3b7ffe99e0496498236bfe0747ecdcdc90
-
Filesize
1KB
MD50d831c1264b5b32a39fa347de368fe48
SHA1187dff516f9448e63ea5078190b3347922c4b3eb
SHA2568a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741
SHA5124b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af
-
Filesize
59KB
MD5f7be9f1841ff92f9d4040aed832e0c79
SHA1b3e4b508aab3cf201c06892713b43ddb0c43b7ae
SHA256751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
SHA512380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
-
Filesize
2.0MB
MD5f3859c35c8f976a387f8e93888e84bb8
SHA1f9e499077b1e0850137723029a916e3b7d9f3bea
SHA256b11dc9cedb88693a8fe5d5cb9893f4826f2a9a7d908c7be53dd71d829cdec3fe
SHA512dc64d004592240ae2c4ec399498ea212241f5a5e35646f60bcfaa5e515559933fa7d70acbb4f898d05a831a2abf9c639976c0a146e1f52cab650d2501fa5c1cd
-
Filesize
1.1MB
MD52b9774bab8d55d15b5ec3ca8144eb0ef
SHA1eba7a2b35cbcf4fae45374c579ad6a7e1786c1d7
SHA256aeaaf45f0233ecd10a32b8f4d9326f87dff13b57cccc4a3e461b56c15a322c59
SHA512e1ead8caae090f9411cf6119a1c6572ac9e89200ba78d305f25cf105dc935710d52bb91a77b8a1157f9f023ad4056bd68792592eccf3d7ac1d9f0bd9d5034ded
-
Filesize
90KB
MD5e68c32297a0b144d13c0b5870ca8c8d8
SHA1c58efb877ee8691900702faaf1e90e35d7b90cbb
SHA2566954112104ba041d18760de5eb7e6825cc14cec98ff49939a587cc6b27908bd2
SHA5122f7c36451ffd6ae7af29c003c6e03e954e478c44fa2ca13b6080b9ffbd44bb45a7e17149f9f72e2f18488d9cfeedff3c501bab24a336d6a62f43938b54dbc035
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
75KB
MD5a2eee508e6a51c6335650532e05ac550
SHA18703fb138bb8443f17c0c24da7edd69b1f2660b1
SHA25675fb2984e1b06f4278fb7b3c77e9fec84e02a3b4bf82d35120f8cbe7bdbc76bf
SHA51214e1abea3109c17f1fbe6ec455593bf91ba1b811ea302806a83a97a96bf582f1c46e8fe635e1d8739c5c007298eabd41311e07e50961ec2084cf97bde0595370
-
Filesize
22KB
MD5ab35386487b343e3e82dbd2671ff9dab
SHA103591d07aea3309b631a7d3a6e20a92653e199b8
SHA256c3729545522fcff70db61046c0efd962df047d40e3b5ccd2272866540fc872b2
SHA512b67d7384c769b2b1fdd3363fc3b47d300c2ea4d37334acfd774cf29169c0a504ba813dc3ecbda5b71a3f924110a77a363906b16a87b4b1432748557567d1cf09
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
296KB
MD55d520f61acf01ad5224a9d376ebef66d
SHA1b3a956cee1421717d890c74fc44fafe7802b4268
SHA256df773d36e15fffe4aacedddd765a716ddf477e2f6989f413e1a629ceba1a8666
SHA5127f78ee8ca0f5019d6e5057271872490eb44f25839cdf76de46bd23d74576c79a1c66e7b3344c6862ade808b37195997c000b1133b46d24808fede93a50e94f31
-
Filesize
317KB
MD5c8600ee0bad1cb2a899b792cb6c1869b
SHA12aab7be28ae6535eb9b0982ee44467751cc42cf3
SHA256b670f7e828aeff88bbe6351bf3b0775af39adc1bfac3b84af4061a4c78ed174a
SHA512ebc03d7ffec0ea3751e4e5a31dce1fd212f1ba31134712b022f15bba7d610f77fab02e7590a28528ff6219c0e3753b80ad6e985605b37fb70b56a7de243c4d11
-
Filesize
2.0MB
-
Filesize
476KB
-
Filesize
60KB
-
Filesize
68KB
-
Filesize
2.0MB
-
Filesize
584KB
-
Filesize
476KB
-
Filesize
2.0MB
-
Filesize
68KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
60KB
-
Filesize
2.0MB
-
Filesize
60KB
-
Filesize
476KB
-
Filesize
584KB
-
Filesize
476KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
88KB
-
Filesize
724KB
-
Filesize
724KB