0310ad0d2c0dc62100055c5e96add680cc0426b259af77cf4e0dd80664cf48c2

Resubmissions

30/09/2024, 12:01

240930-n68dvaycja 8

30/09/2024, 11:54

240930-n2219stenl 8

30/09/2024, 11:44

240930-nwdfqatcjj 7

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirtualTabletServer_v3.1.3_setup.exe
Size

29.4MB
MD5

a8e73dd218f4e724f1ba4215d0d8e1f7
SHA1

999190ea75801c292d04a16cdc91f119989fa98e
SHA256

0310ad0d2c0dc62100055c5e96add680cc0426b259af77cf4e0dd80664cf48c2
SHA512

fa38fd150ca9341500a316cb7adea24f74c6df30309d1766338374ce08ec6d1bbf80d6c8b1bafbe97e33e3c0395cca2ef97a141af979f56746d6d2bb30ce2a23
SSDEEP

393216:8BkqKoRZ4QZ2RCV+5XPw6VBb26k1Tn/BnrBXRt1euiY6SnadV+mgG1MKcibQSIpU:qZ4Jc0X7x3yBr9RtriYdnKMiY8ubFC

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1812	VirtualTabletServer_v3.1.3_setup.exe

Loads dropped DLL 1 IoCs

pid	Process
1812	VirtualTabletServer_v3.1.3_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1812	1592	VirtualTabletServer_v3.1.3_setup.exe	82
PID 1592 wrote to memory of 1812	1592	VirtualTabletServer_v3.1.3_setup.exe	82

C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v3.1.3_setup.exe
"C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v3.1.3_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\TEMP\{49617D9F-7291-4E42-BC1D-C43DAAC49269}\.cr\VirtualTabletServer_v3.1.3_setup.exe
  "C:\Windows\TEMP\{49617D9F-7291-4E42-BC1D-C43DAAC49269}\.cr\VirtualTabletServer_v3.1.3_setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v3.1.3_setup.exe" -burn.filehandle.attached=572 -burn.filehandle.self=592
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{49617D9F-7291-4E42-BC1D-C43DAAC49269}\.cr\VirtualTabletServer_v3.1.3_setup.exe

Filesize
1.3MB

MD5
69a542c2422f4f539ac40ce9397c9935

SHA1
5d58ec90b036e9945bdff1bf4fbb52a92ede0e00

SHA256
253bf36a09e7f5c4bc7d5dfade9e3f544b9a6e352b917bc3929c49024bdf9dd2

SHA512
2e4023ad4faa30677d231432864d9205ee5fd9634803bedb08dca51bf86e95255d172c5f296072ff908349032f593abe3a659813ffa5543dc5b212b747921131

Download Submit
C:\Windows\Temp\{854C2358-A69C-44C8-91AA-FC37414120FE}\.ba\wixstdba.dll

Filesize
366KB

MD5
ae30aef6b62a24b80c560773264c7f47

SHA1
fc1befa879bc5c1d43440830c7155f51103d7a59

SHA256
64ae3ecfb170f00f83e7ca4dee61a23023d48b22b79d0a28f13c52c133172cca

SHA512
994e3052a30e91f6731a0bae3bd20395dd648cfa9bfcb4283c4c7bb4539161e3c8cb67f355cfef5c2172cb0c7692f8acfbdca1cb185ab20148120c67d89dd53c

Download Submit