Resubmissions

27-10-2024 16:36

241027-t4cgaazgqn 7

19-10-2024 00:17

241019-ak9swsxfrr 7

30-09-2024 17:27

240930-v1devaxbll 7

30-09-2024 17:00

240930-vh8g9szdqg 7

30-09-2024 16:44

240930-t8tlcsvgjk 7

29-09-2024 17:22

240929-vxj38awgng 7

29-09-2024 16:13

240929-tn9rvavalh 7

29-09-2024 01:09

240929-bhyhhsterq 7

Analysis

  • max time kernel
    91s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-09-2024 16:13

General

  • Target

    TORA Operations Research Software/setup.exe

  • Size

    137KB

  • MD5

    35561a7acb299a7278e8706fd6e01aa0

  • SHA1

    41e1f323eb44cb474bf04567bed95f4767502131

  • SHA256

    978123c86b1cbc981770fbd8bdfc58ef4030f8d9b3adf06b71b928cc0394c073

  • SHA512

    0d7784c6e9c175027f627b522cafedd87d0f85afb16fb86f9c91a7a045894621e0c9b50d785132e5d5d44c1d21cb76b669960d64212b34c07863039c9b6e499b

  • SSDEEP

    3072:RqwmOGqM8OROAO5UTS7vdWcoWxg7YjcZJQgh9/J:Rq0M8OQAO5WSocVxgGcj/

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TORA Operations Research Software\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\TORA Operations Research Software\setup.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Windows\Setup1.exe
      Setup1.exe "C:\Users\Admin\AppData\Local\Temp\TORA Operations Research Software\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\COMCAT.DLL

    Filesize

    21KB

    MD5

    3b180da2b50b954a55fe37afba58d428

    SHA1

    c2a409311853ad4608418e790621f04155e55000

    SHA256

    96d04cdfaf4f4d7b8722b139a15074975d4c244302f78034b7be65df1a92fd03

    SHA512

    cf94ad749d91169078b8829288a2fc8de86ec2fe83d89dc27d54d03c73c0deca66b5d83abbeaa1ff09d0acac4c4352be6502945b5187ecde952cbb08037d07e8

  • C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\VB6STKIT.DLL

    Filesize

    99KB

    MD5

    cff867572b44212b01b711c1fa009537

    SHA1

    3978c9f7a3d77c0bdff4353949e2143757eebc79

    SHA256

    df6e2f111773adec3b33dcb0b31e2a4d21ef7d51740706335f411e2c999c0e6b

    SHA512

    1b77ef24b1efb4939e4625deb1f8ebccc3c2edbb49b412dadb8a3c293a265c77ea84d8eb725d3af5bb84d9c040a91debe5890f57ed8750147e91f30c1a0630c4

  • C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\asycfilt.dll

    Filesize

    63KB

    MD5

    0bc326cd99125724987ceec7405496b6

    SHA1

    cfd440400244c182fd064508e873d62529d285f3

    SHA256

    e701cb227daa19c9b91ecf9975a12351bc4d73454b894695a6c5f74f65b9b77a

    SHA512

    efcad7817908ae1d503e7c1797e190b8b541cda62eb063aba4c96c0e7012803a3f2070cee597122974b84ad6c26c1c5508c57839df07a3fb140b817ef6fa7994

  • C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\msvbvm60.dll

    Filesize

    1.3MB

    MD5

    e949eee7d1be07e32267fe10d9992c38

    SHA1

    a4241fd4850a6e2fa36ef788a34283a23b85fbbb

    SHA256

    fa75a67b0d6a8829993397c3a893c182641a8c4806bb1e46553dbad7f7aaf5d4

    SHA512

    22a789ff7fa41eb739c11a7a9e24f7db86b477650d0c89d937811ebb8a044093019c0728429c9880ee4d76d9bdcaa1d6dbd95ed7b623db619eba0f715586a35c

  • C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\oleaut32.dll

    Filesize

    540KB

    MD5

    b3742dee858b243e77c73d2b8f7c8223

    SHA1

    7a132127eb3efeca8f6bc3f20e49b5011b5ae5df

    SHA256

    4397d0fe3ef2cdb85dd811b8743c7700bd4e6d8d3365dcba5286aa10adb2c24a

    SHA512

    277f8f2750a562d5f8168c608928d232a3755662628bf7bb9ed17819786a0e7234534f5e028f4e1e0a2bec0468be5c12c56770c60713f06ac96422581fe26774

  • C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\olepro32.dll

    Filesize

    81KB

    MD5

    b48d3193dd1474dcbcc32bf4779ac698

    SHA1

    4a39d43aea0766c159a32c311c9eb2e06dbf8c03

    SHA256

    54d7ee1e4b43d2590b3b9b4a412717bfecfcce46f9dda68dba4695f135faa7b5

    SHA512

    fdb0691dfb26d43708f8f12f6b75e2097570ba27a0040e0f8ecac30ef9307dedcf425cbec671a0178916675503542a7fa670fb5515ec231509d5aabd0047debb

  • C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\stdole2.tlb

    Filesize

    17KB

    MD5

    0857394e30de11ca0cd9497e310d6469

    SHA1

    ba35fba3e44040e7b891fa814dceff94d1c1b114

    SHA256

    e2b26b1ad2d439dded0799d195ca918a03ccf22146690577e2704f871c098426

    SHA512

    05309e02b7c427f379f3235d2d7398d53ee35b3f1f9d7f28ad72607c82e0af6163a2def42734666f7e1fd0b67395031632aff9c9af36fb30c0175fad145f1185

  • C:\Windows\SETUP.LST

    Filesize

    3KB

    MD5

    f1b2cdbeb140f60882d961bc43a8df8f

    SHA1

    724774bcfd14fa2644bdd35b7a76fb02f24381a2

    SHA256

    274832c8ee77266af5bbad6552bba13a9d6db8fadadfd0b423555b30030442c6

    SHA512

    6982afaf7ebc14ddf10c4f9e7ccd213b49bafa0ce70f7a491f85e8cf1cadc31fa0e8a3d0e1dfb090d97765d5c23f43b8a0e25c432fd25bb72aa4cfbaa6982b26

  • C:\Windows\ST6UNST.000

    Filesize

    1KB

    MD5

    915627ee81ebb032513ff01f8878ea70

    SHA1

    c38e04b01d490f787386bcf7abc6855cac827a87

    SHA256

    3341253261fdcb73f58aeab92cf0f31ed01e11d7e6f18f1943f10f57400402e7

    SHA512

    4f18227b661618e2209754bc6ff1a818abb069f2487b7e8658541c5c562f357027eb3b1b06490c37f0210ed8f564186f020537ca44a245fc636b8a283c0525ce

  • C:\Windows\ST6UNST.EXE

    Filesize

    71KB

    MD5

    996f83e516552ca3b51445bb994a6d38

    SHA1

    56fc6ba49195dedf735e6ce1b03ab36d72334f66

    SHA256

    7e60c894a8cead6880fd3ed040504d02304a0b961304e40741340e31f5fa973d

    SHA512

    5868100fdb274dbad44ea0996aa4ed0a930cce5c61ce55631869bd19ee09feb8a957bf2a4a87ba563f48bb65807dae5b2363c042d451843e9598b10f6c334d2f

  • C:\Windows\Setup1.exe

    Filesize

    280KB

    MD5

    e40041e0ca436c712332edaa9db7df08

    SHA1

    deb8ead922f4f1acbadebf0db998f6ba2dc53db0

    SHA256

    6a15b76e1526e1fd6ebaecacc59c3e954d0feb0b566c81538ea6dad2edcffe16

    SHA512

    1111be364c3d81dc919d1e7ba7bd141cda6555844d889f00a2b2cb0ee5c19bd0b122ae4b574a3cdfa268668eebec43fa265b44e1b8fa28faaa335824647b8bc2

  • C:\Windows\tora.CAB

    Filesize

    1.9MB

    MD5

    c13240f6e638b4065e72b0d67ce20d75

    SHA1

    f86f39c86c75c700481d031fc3c631102e57aad2

    SHA256

    96ebc498a2c51c05c14660a62adb0e97b73b72aa26608008464bb5d291f7c55c

    SHA512

    92bd0856021de57f38ef557e8e395443aca0cc9a44fc5b60668358c76a15bda95c129fc9bd5b55479b01945dafa7d963bda409775f3afffa710da79624a8989f