Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07/09/2024, 19:23
General
-
Target
SRB2-v2213-Installer.exe
-
Size
150.4MB
-
MD5
a954a01803702a882732c48bf08bae9f
-
SHA1
7cb3b8b428640b9f0bf6e030a9b3968c781604dc
-
SHA256
74da34ca3ba1962015714afa8535051b3ca8414ace28b0bdc13a176f6218d703
-
SHA512
cca3e8defe224fefec35cc15a2ca0488d553b42edd161a3037a329f40f24e728d994c7150f2e1c277f41f4bf8612003a312b9b9745a8bec78272faf8bde8b759
-
SSDEEP
3145728:EzQNeBJM4IoxIaJk555rHKSDFwp69ucnOoNAWQSGZ38xSmJ1gP:6HP3Io2Rhrq+FwwIcjCR+omwP
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 13 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SRB2-v2213-Installer.exe"C:\Users\Admin\AppData\Local\Temp\SRB2-v2213-Installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HQU6F.tmp\SRB2-v2213-Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-HQU6F.tmp\SRB2-v2213-Installer.tmp" /SL5="$30144,156750034,839680,C:\Users\Admin\AppData\Local\Temp\SRB2-v2213-Installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SRB2 v2.2\srb2win.exe"C:\Users\Admin\SRB2 v2.2\srb2win.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD53775b120a1fb9a13a05e649cd28b1cb1
SHA18b672b4e919aa0d6ab9968b07c57896c503bcbc4
SHA256f2cbee4654d722c39f01e6d31a2b988e6cf0aa23dc69537104cdffcbe128ef1e
SHA512bc67a4e5a9e419256c929036cc89e505bf3cda1a9a7c11dae7917166594fac4f365bb2d4b4dfddfa22ddadd304ee4aa06f8acd4a3e658f5ec28cad53c5e7066f
-
Filesize
911KB
MD50b50198931481b7a7b91a488a1c3cd19
SHA128738321a84e5f4031cc7abc44cce8fda8341938
SHA256c64ce8fc03e1af67506cd6ccce29c6855dd891b89733c1c9a622b67d32528d02
SHA5121b54ed63fff2f1bd19065662ba5c9a482dec876dddadf43cffe28be86406d807e0dfe59373bca4341403ba8a76811ca006d4d71f21344ea6a570004768b083f7
-
Filesize
1KB
MD59faf43aed2f287bc152e705e85ca9a39
SHA14b730b7d4729e87979d531f6290c6cca90559ad0
SHA2560cc50e1777f0a8752f32d67d48c8a7e3ead45e7ef68d5957123bb83c2452ceff
SHA51208217bbf414ce239da03c341d333f126f6e78b7ead7fc641ade7888a70ce305932bae703bea9c849fe2a44f36634270cd88b6e884ce170799cde18898f014296
-
Filesize
6KB
MD5da36bbb0c797b02cb72e19828bbe7346
SHA18673487b0bb3a71e26daaf0c0e345540eac55e7f
SHA256a0eb34afd889c53b3957d275f6394fd7cce4fcb26210376baa7023901f41c797
SHA51269d95a4c4d7005557ce2715314fd572260df681f2ee56ba096fcc9a9e1d65849b1fbeb1d743140a3ffa0442d4b8c5294ad95a4b64fbba20ab5981f584bcd5b7f
-
Filesize
7KB
MD54ef65cd6d33a86f35d7e17e97b5d70e2
SHA1475e80c2a0752054762c40f3d60d5956db089ff1
SHA256c97d5196f2bdb680fd1be7c1e81781b66d999906dda3f587c207207edee7adbb
SHA512bb1af6bb1207febf55e114e951ff9da98e69fce1fd95b65aa3df8972d23354369fc95d3353944f0baecee56ae88da10767e59055b022eede6ee8119c51a10a8a
-
Filesize
594B
MD558d930b1bc7f6d35b1778ef635ad07cb
SHA1689006171a2a2694ed37151d3b90e8cf8dc1de9e
SHA2568af6c976698754f5d4c72a8a60c2f8c5a56a6a7ea3fef4b6a3b947318e6dfc57
SHA5125dccfe2bd40139ba671a4c05f9c2c92e98ec388bcc57fc0073b59b8aa7d5d6c7558a52faee2bd5dcb6801342dd1b0ad5f991e092a94bff974ac963d7b838cc1d
-
Filesize
2KB
MD5a1392a5362e1c38c63a62fabc2952120
SHA102c925e72514179cd9ce461ed7e9e2eccfbbf15e
SHA256723bc686a40de2a3440bcc4e4545356df8fbfee1b2d91865beffc8a784855ff3
SHA5128151b0969630acdaf03822ef3d9a8f6815837aaf566bba05fdf5a14c45bbe4e41d1110d739ce0782d3db701fc1af4f048802189f7105fb28a0c7fb4c81fc31f8
-
Filesize
8KB
MD5f611eedb94606143ac1b27687d098aaf
SHA1a841c1f0b997ae92767cadfca7f84b6df47745fa
SHA25604da7f54c13d27dbf17e3ce31579630aad67fe7dac3dbd1d24db1b8552821074
SHA5127015075e5a32b76631a5f5401a2d4c4a08c2fe4ab4cedfb75fe4535ea3d58c7b0a863d9b79fe601c417d85f5e03267241194fd7f734115232f12f5d29bfeb6e2
-
Filesize
1KB
MD5971e69f6346eab9b1d53f4e47fd8db78
SHA18a107fced11e74c3affe4eb4d9b5e65f39081561
SHA256d822f60ab86d30bcaaaa17d625066b8f5eff6e70ef8f28ac94095cf9c798b7b8
SHA51272d7ef606969379f1e88d7ab5cdb7b3b301b91ea1e0eebf9b8ce9f4b2384faad27beeb4eb72f0c8edac603676a537952d3628500f97b52c9de0fb58357f88c0c
-
Filesize
20KB
MD5c2166b48fd3c6eb60da90712f1d77808
SHA10c014f9fc2302daf854b702ff9331189f18c0416
SHA25692683941dbb5a8946fcf4c3c34201b38f232e84e4d66cd72cef0a6162570fabd
SHA5120dc42ce08459ff203659bc0fb7d99b931defb3084c7be7bc816bb4d7ec54f881831d503f6878de621ea87f694954aab3c87f9819e84cc5dc243495a2630764bc
-
Filesize
20KB
MD53c7b73f34af7e9a7bceb2d5260f76172
SHA14b480ec8c64a23369a16e5726a363d9b6e0300fe
SHA25603b14028509f59671d0c38740b19e72e60ebdc8728a0c2c0237cef67d217a4c5
SHA512aad874ad2ae0d8eca7295e30a9090c148d82ffa0fe0012fd1b17f20897c09f265c901a9aa16e0bf1d6f1687bb211cf3606c98147606ce84a27d84e53a6494569
-
Filesize
3.4MB
MD52e7aaae8a6b1b77d90ffe7606ceadb6c
SHA1eb1a10909f40513b7760a1b2c79becc0925706ac
SHA2561fe37fff77651b9afa81a3b97dab477d8f66f7e712b6472f1ea2bb63903173a0
SHA512462bf6309b4c2354b74c2cf57f601fe11df13608b905d515cae6b3a43c699d72d05fc49d45b362d7afd8a24f6d3cd1ec4eae821d13f936a47fda7fc9e61799d2
-
Filesize
44.8MB
MD5ad911f29a28a18968ee5b2d11c2acb39
SHA1780495174f45820a28c9be0eee11abf20c755570
SHA25619af6ac428a6a455a724ce80cabb4fe14e1de73a5426e52faeb7b131929856e5
SHA51277ed548e6d439a370047bc079640201c330e864f411d6e0f9fa201cb1793d8d934f8a7a5b7ac043eaca2ce53400f638fcb7063668b13c51feade870d8fe2c880
-
Filesize
13.1MB
MD51c8adf8d079ecb87d00081f158acf3c7
SHA18b5b9726950750b757cf49835bdba793741eeffc
SHA256da37cad87fbb2d718916033d74b0ab320aed9d64666265948833d27e8ebc68e3
SHA5121ddfd692e6d6ab83bd2ffb153040c8bb52b66be4c76d0a4896bac2c93befd8e5469d10ac4c2df4839ecf9a0c8954471f2546e59152cb84e7479dcebe890ee10a
-
Filesize
3.0MB
MD505b4bddc1f8032d91e723ff0a898abe9
SHA17e44bd92bd48d3a797da3b209b7bdfb4e169ad51
SHA25670b02e5b88b92e50e40cc1dd8efbdf4cdcb6cf8ca678d2dec420a289fa8d68cb
SHA512dcb64e1ec702ba16e6ef43559de14845d1942ef26f220f2dae16bdaacdfe19cf1165edda64f1b19d4ad90f0e3315cd50058f45f1a082c565dae604ce1edbc800
-
Filesize
28KB
MD5077cb4461a2767383b317eb0c50f5f13
SHA1584e64f1d162398b7f377ce55a6b5740379c4282
SHA2568287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
SHA512b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
-
Filesize
1.9MB
MD59fd3ec6d8de3cff290e7a78177b17362
SHA1b3cb33d621749c9340718f405a719c9f383b7bcd
SHA2567a7f96e8e8dd97bed0faecdf12f8b22d09ae6181659c86c94f075453cfa6d5f7
SHA5120e376326e26be63198db2f532acf9f8f7b9dbad7a6fb182c4adf2ffc034d9d345f4664ada3f5ae6ce023743dc55bd82250db095fa132df248ab606362d5c2525
-
Filesize
2.7MB
MD54c75d7c20ad4dc92125e08b36463e4e2
SHA1085439bdc67f3a32ed800d9cb1ddbd9e71a76ade
SHA25672925dc46c21cfcd8f6f1d812a7a87adcde4540bac673e388b180db412536a31
SHA5126bc4ef8801c13f0f430ac280b3a96fc1f3a5e13b18205375d19dc3e95d7f18ddbc72cc99d2896e6a3866f87dee9a62ae101e34c97c7b2683457d29488e3a1d6a
-
Filesize
708KB
MD545f19ab39a1d220afd2b1fabe764602f
SHA1d9fe58e05f9c8b080876af1f3fcc50171b89f665
SHA256b01e4b7d26b52a05bdb97743af6596b5ed2440667d4ef2f45f59d81728db96e8
SHA5121a27c4eadd0841f2fd32ae8c8ba0461af990b02b93b9cbf5e7091e306d17c0f5ab3a3996f5474fec1c68f329921c886a264d02ea292af4d4670d74079a84d82e
-
Filesize
640KB
MD566c28fdb6c14b5a260c349ce5f3b1623
SHA16699b509d2b8acc0ff2791b8b542b32ca12f5673
SHA256ac71859e276554c32a878aca4542fd05d53534b2f31cff3e1ef0927b6ff0af8a
SHA512f021c8a0956cedc4cc0bbacf111c8a8593505c0a0bbd8d2d4dcb74a9b63d3d3b5a644c0ec7202d856a54566ceb8bd08a1acac4f32cb65380fbed4ade15b1a0fa
-
Filesize
90KB
MD5b2d042a733642cfd78f417e4067f460c
SHA174d73d347f7f269cd10625c75a39ae91004ff36a
SHA256c48251aab7081487503b222df23544775c6365a0dc52ee84559f32cfc2c982d9
SHA5129cf4bc78200f179235c2c43cd10c5d022e931fe8a326349b234270c8df961518f18ee992af63c80777b9efd3b0ac5e898551a97ae5f49e4f7a6700ee0099d3fd
-
Filesize
5.2MB
MD543281276a959750ffdcf604ac4bb9213
SHA1317fd69557fa32aebed02acb24b3738e7e2221c3
SHA25633b00cf67dcdcba45a2f134479934aa69f9cc1d30b285babbb12c705e8288f7e
SHA512dab7947e241493770b2c31663107e15f9660721c7493725aa8d9ab8a6be37769ee1a86cecb53ee3f7358f8f9de1f9cf8ee225bc89cb23fc08b255b2be975e04c
-
Filesize
887KB
MD5b2af582990408dbf39af424550849318
SHA1e687d64517bf936fb65a0038c69fec0d9ceee563
SHA256390b1646b72856eb1b7664772d55febb3ac3126a81562e6521a9ec1e98c69eee
SHA512a932b62e10364bc79a3b3e2a0e3cf461f58b2c5fdf9cd59a4245bf2394c2b52064ab1145dcae05c9cb7a1e52c92ff13e190a924d8724cb269ad08bdea4af1a30
-
Filesize
831KB
MD5d8b2d6029ed97f46819a2bedd5a8a8e7
SHA126d1f6385c8f600beffbd80c356e24050a2fdb5e
SHA2561ce127a3e94a81efe98e94bca81bbc12c0756deb03cf1dad48fc61800abf13c4
SHA512d7eb273989cedcc5503193ef67b3faa98c5c7647b914f59b8bf8264424e4f11a003fa68067caafcbd0c46c40e2f90299accb277abb47a1567f4c369bcbc1dad9
-
Filesize
5.0MB
MD5e85f3ae049b3884f97300ca70868a3c3
SHA1f2990fe95558a19e4a7f9a57cddc0cdbe7a26cd5
SHA25634948a13d95f2ea04e15b26622b0df36b1f2fb827d03125eaa37544c839b55e5
SHA512c6024122c59285e28ba8e9684ebc5f6c71c4e8ff5da695848e5c8dbb9cd61b71c0386bee27ba2032cd8357ccc4eb59280892f2187c27472478616ad2756d9d77
-
Filesize
740KB
-
Filesize
78.6MB
-
Filesize
2.0MB
-
Filesize
1.0MB
-
Filesize
78.6MB
-
Filesize
78.6MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
78.6MB
-
Filesize
2.0MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
2.3MB
-
Filesize
864KB
-
Filesize
60KB
-
Filesize
908KB
-
Filesize
78.6MB
-
Filesize
116KB
-
Filesize
2.0MB
-
Filesize
3.3MB
-
Filesize
2.3MB
-
Filesize
744KB
-
Filesize
2.0MB
-
Filesize
728KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB