Overview

overview

7

Static

static

3

TORA Opera...up.exe

windows7-x64

7

TORA Opera...up.exe

windows10-2004-x64

7

COMCAT.dll

windows7-x64

3

COMCAT.dll

windows10-2004-x64

3

COMDLG32.dll

windows7-x64

3

COMDLG32.dll

windows10-2004-x64

3

DBGRID32.dll

windows7-x64

3

DBGRID32.dll

windows10-2004-x64

3

MSFLXGRD.dll

windows7-x64

3

MSFLXGRD.dll

windows10-2004-x64

3

SETUP1.exe

windows7-x64

3

SETUP1.exe

windows10-2004-x64

3

ST6UNST.exe

windows7-x64

3

ST6UNST.exe

windows10-2004-x64

3

VB6STKIT.dll

windows7-x64

3

VB6STKIT.dll

windows10-2004-x64

3

asycfilt.dll

windows7-x64

3

asycfilt.dll

windows10-2004-x64

msvbvm60.dll

windows7-x64

3

msvbvm60.dll

windows10-2004-x64

3

oleaut32.dll

windows7-x64

3

oleaut32.dll

windows10-2004-x64

3

olepro32.dll

windows7-x64

3

olepro32.dll

windows10-2004-x64

3

stdole2.dll

windows7-x64

1

stdole2.dll

windows10-2004-x64

1

tora.exe

windows7-x64

3

tora.exe

windows10-2004-x64

3

Resubmissions

27/10/2024, 16:36

241027-t4cgaazgqn7

19/10/2024, 00:17

241019-ak9swsxfrr7

30/09/2024, 17:27

240930-v1devaxbll7

30/09/2024, 17:00

240930-vh8g9szdqg7

30/09/2024, 16:44

240930-t8tlcsvgjk7

29/09/2024, 17:22

240929-vxj38awgng7

29/09/2024, 16:13

240929-tn9rvavalh7

29/09/2024, 01:09

240929-bhyhhsterq7

Analysis

  • max time kernel
    929s
  • max time network
    450s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 16:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TORA Operations Research Software/setup.exe
  • Size 137KB
  • Sample240930-t8tlcsvgjk
  • SHA256 978123c86b1cbc981770fbd8bdfc58ef4030f8d9b3adf06b71b928cc0394c073
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discovery

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TORA Operations Research Software\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\TORA Operations Research Software\setup.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\Setup1.exe
      Setup1.exe "C:\Users\Admin\AppData\Local\Temp\TORA Operations Research Software\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4244
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3188
    • C:\Program Files (x86)\vbTora98\tora.exe
      "C:\Program Files (x86)\vbTora98\tora.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3516
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5c70ab85h859fh4222hab08h86860ab467fa
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8eb6f46f8,0x7ff8eb6f4708,0x7ff8eb6f4718
        2⤵
          PID:3292
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,12179657096977314626,18191255293748797824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
          2⤵
            PID:1268
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,12179657096977314626,18191255293748797824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1592
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,12179657096977314626,18191255293748797824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
            2⤵
              PID:872
          • C:\Windows\System32\CompPkgSrv.exe
            C:\Windows\System32\CompPkgSrv.exe -Embedding
            1⤵
              PID:4932
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:4184
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
                1⤵
                  PID:2808
                • C:\Windows\system32\taskmgr.exe
                  "C:\Windows\system32\taskmgr.exe" /4
                  1⤵
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4732

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      • Size 152B
                      • SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
                      • MD5 SHA1 SHA512
                      Submit Download

                      Preferences
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                      • Size 5KB
                      • SHA256 25e63f4daf47f264af7069058683aee9267d4a68fdf7bfe96d2a486badb35291
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                      • Size 8KB
                      • SHA256 df8cab3fc4b198d7d89be755ea050d3a98a9b293593f4597d6d62c3cb3b79565
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      COMCAT.DLL
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\COMCAT.DLL
                      • Size 21KB
                      • SHA256 96d04cdfaf4f4d7b8722b139a15074975d4c244302f78034b7be65df1a92fd03
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      COMDLG32.OCX
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\COMDLG32.OCX
                      • Size 137KB
                      • SHA256 46f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      DBGRID32.OCX
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\DBGRID32.OCX
                      • Size 513KB
                      • SHA256 6cc3e18193118e5d5e0d9a3c765ff2e649a99641b55a79abf1463ed5d46928db
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      MSFLXGRD.OCX
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\MSFLXGRD.OCX
                      • Size 238KB
                      • SHA256 4e592240b745546c15e95e26b2547cec86352a49ee1ef79b3e3d28df8b5a0e70
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      VB6STKIT.DLL
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\VB6STKIT.DLL
                      • Size 99KB
                      • SHA256 df6e2f111773adec3b33dcb0b31e2a4d21ef7d51740706335f411e2c999c0e6b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      asycfilt.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\asycfilt.dll
                      • Size 63KB
                      • SHA256 e701cb227daa19c9b91ecf9975a12351bc4d73454b894695a6c5f74f65b9b77a
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      msvbvm60.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\msvbvm60.dll
                      • Size 1.3MB
                      • SHA256 fa75a67b0d6a8829993397c3a893c182641a8c4806bb1e46553dbad7f7aaf5d4
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      oleaut32.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\oleaut32.dll
                      • Size 540KB
                      • SHA256 4397d0fe3ef2cdb85dd811b8743c7700bd4e6d8d3365dcba5286aa10adb2c24a
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      olepro32.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\olepro32.dll
                      • Size 81KB
                      • SHA256 54d7ee1e4b43d2590b3b9b4a412717bfecfcce46f9dda68dba4695f135faa7b5
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      st6unst.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\st6unst.exe
                      • Size 71KB
                      • SHA256 7e60c894a8cead6880fd3ed040504d02304a0b961304e40741340e31f5fa973d
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      stdole2.tlb
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\stdole2.tlb
                      • Size 17KB
                      • SHA256 e2b26b1ad2d439dded0799d195ca918a03ccf22146690577e2704f871c098426
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      tora.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\tora.exe
                      • Size 1.1MB
                      • SHA256 9a6e4f75fb820d8bf63d770a9c79f4717d1fc48ffba76940fc4dafa2320881fe
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      ST6UNST.000
                      • Path C:\WINDOWS\ST6UNST.000
                      • Size 1KB
                      • SHA256 3341253261fdcb73f58aeab92cf0f31ed01e11d7e6f18f1943f10f57400402e7
                      • MD5 SHA1 SHA512
                      Submit Download

                      SETUP.LST
                      • Path C:\Windows\SETUP.LST
                      • Size 3KB
                      • SHA256 274832c8ee77266af5bbad6552bba13a9d6db8fadadfd0b423555b30030442c6
                      • MD5 SHA1 SHA512
                      Submit Download

                      ST6UNST.000
                      • Path C:\Windows\ST6UNST.000
                      • Size 2KB
                      • SHA256 0041f2f237670299096a9f5b934cfa1f01978b7e0a2c41fcfbd87c4694e36154
                      • MD5 SHA1 SHA512
                      Submit Download

                      Setup1.exe
                      • Path C:\Windows\Setup1.exe
                      • Size 280KB
                      • SHA256 6a15b76e1526e1fd6ebaecacc59c3e954d0feb0b566c81538ea6dad2edcffe16
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      tora.CAB
                      • Path C:\Windows\tora.CAB
                      • Size 1.9MB
                      • SHA256 96ebc498a2c51c05c14660a62adb0e97b73b72aa26608008464bb5d291f7c55c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      memory/4732-364-0x000002B373550000-0x000002B373551000-memory.dmp
                      Download

                      memory/4732-365-0x000002B373550000-0x000002B373551000-memory.dmp
                      Download

                      memory/4732-366-0x000002B373550000-0x000002B373551000-memory.dmp
                      Download

                      memory/4732-370-0x000002B373550000-0x000002B373551000-memory.dmp
                      Download

                      memory/4732-376-0x000002B373550000-0x000002B373551000-memory.dmp
                      Download

                      memory/4732-375-0x000002B373550000-0x000002B373551000-memory.dmp
                      Download

                      memory/4732-374-0x000002B373550000-0x000002B373551000-memory.dmp
                      Download

                      memory/4732-373-0x000002B373550000-0x000002B373551000-memory.dmp
                      Download

                      memory/4732-372-0x000002B373550000-0x000002B373551000-memory.dmp
                      Download

                      memory/4732-371-0x000002B373550000-0x000002B373551000-memory.dmp
                      Download