b3be21ee725c02741b2c666a8064db8cffb8bdc9a6d5821f5daaf9d636ae4713

Resubmissions

27/10/2024, 16:36

241027-t4cgaazgqn 7

19/10/2024, 00:17

30/09/2024, 17:27

30/09/2024, 17:00

30/09/2024, 16:44

29/09/2024, 17:22

29/09/2024, 16:13

29/09/2024, 01:09

Analysis

max time kernel
929s
max time network
450s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TORA Operations Research Software/setup.exe
Size

137KB
MD5

35561a7acb299a7278e8706fd6e01aa0
SHA1

41e1f323eb44cb474bf04567bed95f4767502131
SHA256

978123c86b1cbc981770fbd8bdfc58ef4030f8d9b3adf06b71b928cc0394c073
SHA512

0d7784c6e9c175027f627b522cafedd87d0f85afb16fb86f9c91a7a045894621e0c9b50d785132e5d5d44c1d21cb76b669960d64212b34c07863039c9b6e499b
SSDEEP

3072:RqwmOGqM8OROAO5UTS7vdWcoWxg7YjcZJQgh9/J:Rq0M8OQAO5WSocVxgGcj/

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ST6UNST Uninstaller.LNK	setup.exe

Executes dropped EXE 2 IoCs

pid	Process
4244	Setup1.exe
3516	tora.exe

Loads dropped DLL 7 IoCs

pid	Process
3028	setup.exe
4244	Setup1.exe
4244	Setup1.exe
4244	Setup1.exe
4244	Setup1.exe
3516	tora.exe
3516	tora.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\COMDLG32.OCX	Setup1.exe
File created	C:\Windows\SysWOW64\temp.000	Setup1.exe
File opened for modification	C:\Windows\SysWOW64\DBGRID32.OCX	Setup1.exe
File created	C:\Windows\SysWOW64\DBGRID32.OCX	Setup1.exe
File opened for modification	C:\Windows\SysWOW64\MSFLXGRD.OCX	Setup1.exe
File created	C:\Windows\SysWOW64\MSFLXGRD.OCX	Setup1.exe
File created	C:\Windows\SysWOW64\temp.000	setup.exe
File opened for modification	C:\Windows\SysWOW64\COMDLG32.OCX	Setup1.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\vbTora98\tora.exe	Setup1.exe
File created	C:\Program Files (x86)\vbTora98\tora.exe	Setup1.exe
File created	C:\Program Files (x86)\vbTora98\temp.000	Setup1.exe
File created	C:\Program Files (x86)\vbTora98\ST6UNST.LOG	Setup1.exe
File opened for modification	C:\Program Files (x86)\vbTora98\ST6UNST.LOG	Setup1.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\WINDOWS\tora.CAB	setup.exe
File opened for modification	C:\WINDOWS\tora.CAB	setup.exe
File opened for modification	C:\WINDOWS\st6unst.exe	setup.exe
File created	C:\WINDOWS\Setup1.exe	setup.exe
File opened for modification	C:\WINDOWS\Setup1.exe	setup.exe
File opened for modification	C:\WINDOWS\ST6UNST.000	Setup1.exe
File created	C:\WINDOWS\SETUP.LST	setup.exe
File opened for modification	C:\WINDOWS\ST6UNST.000	setup.exe
File created	C:\WINDOWS\temp.000	setup.exe
File created	C:\WINDOWS\ST6UNST.000	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tora.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	tora.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}\ = "DMSFlexGridEvents"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7629CFA2-3FE5-101B-A3C9-08002B2F49FB}	Setup1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Documents"	tora.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\ = "EventParameters"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ = "DBGrid Control"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\TypeLib\Version = "6.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComDlg.CommonDialog\CLSID\ = "{F9043C85-F6F2-101A-A3C9-08002B2F49FB}"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Control	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}\TypeLib	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ProxyStubClsid32	Setup1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	tora.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ = "AsyncProperty"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBGrid.DBGrid\CLSID\ = "{00028C00-0000-0000-0000-000000000046}"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\TypeLib\Version = "6.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\TypeLib\Version = "1.0"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00020412-0000-0000-C000-000000000046}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7629CFA2-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMDLG32.OCX"	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\TypeLib\Version = "6.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0E-0000-0000-0000-000000000046}	Setup1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\TypeLib	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C03-0000-0000-0000-000000000046}	Setup1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	tora.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	tora.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\TypeLib\Version = "6.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{5E9E78A0-531B-11CF-91F6-C2863C385E30}"	Setup1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "6"	tora.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ = "Licenses"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\TypeLib\ = "{5E9E78A0-531B-11CF-91F6-C2863C385E30}"	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}\TypeLib\Version = "1.0"	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C08-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\WINDOWS\\SysWow64\\DBGRID32.OCX"	Setup1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	Setup1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	taskmgr.exe
Token: SeSystemProfilePrivilege	4732	taskmgr.exe
Token: SeCreateGlobalPrivilege	4732	taskmgr.exe
Token: 33	4732	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4732	taskmgr.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3516	tora.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4244	Setup1.exe
3516	tora.exe
3516	tora.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 4244	3028	setup.exe	82
PID 3028 wrote to memory of 4244	3028	setup.exe	82
PID 3028 wrote to memory of 4244	3028	setup.exe	82
PID 2364 wrote to memory of 3292	2364	msedge.exe	109
PID 2364 wrote to memory of 3292	2364	msedge.exe	109
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1268	2364	msedge.exe	110
PID 2364 wrote to memory of 1592	2364	msedge.exe	111
PID 2364 wrote to memory of 1592	2364	msedge.exe	111
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113
PID 2364 wrote to memory of 872	2364	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\TORA Operations Research Software\setup.exe
"C:\Users\Admin\AppData\Local\Temp\TORA Operations Research Software\setup.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\Setup1.exe
  Setup1.exe "C:\Users\Admin\AppData\Local\Temp\TORA Operations Research Software\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3188

C:\Program Files (x86)\vbTora98\tora.exe
"C:\Program Files (x86)\vbTora98\tora.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5c70ab85h859fh4222hab08h86860ab467fa
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8eb6f46f8,0x7ff8eb6f4708,0x7ff8eb6f4718
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,12179657096977314626,18191255293748797824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,12179657096977314626,18191255293748797824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,12179657096977314626,18191255293748797824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:2808

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e07d822fce5abc3026dde2990af6115

SHA1
e517b732aec31511e5497830b8912a0ed8989cef

SHA256
25e63f4daf47f264af7069058683aee9267d4a68fdf7bfe96d2a486badb35291

SHA512
c78e33ba281f04736c1447ef772ec4abfe832c1e7bb2cd2d2b331514f09095927215728cb78dc90fc518c29f92b76f0bf26e3a1a9be2fa636eb2e23d49d15aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
87ed4eae92c9c84a6fa4aa7f7e6a3b78

SHA1
fda89580f8c39ee64209e4447db5f524da2e7875

SHA256
df8cab3fc4b198d7d89be755ea050d3a98a9b293593f4597d6d62c3cb3b79565

SHA512
41bbf01349b079d4c8522e2d5a52232f86522d955f9e1d8e19bb108529419a04be173b1bd55b29fe2b6c36b3766e5a2654b5a5a294214dc4fea7712bf00ee7b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\COMCAT.DLL

Filesize
21KB

MD5
3b180da2b50b954a55fe37afba58d428

SHA1
c2a409311853ad4608418e790621f04155e55000

SHA256
96d04cdfaf4f4d7b8722b139a15074975d4c244302f78034b7be65df1a92fd03

SHA512
cf94ad749d91169078b8829288a2fc8de86ec2fe83d89dc27d54d03c73c0deca66b5d83abbeaa1ff09d0acac4c4352be6502945b5187ecde952cbb08037d07e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\COMDLG32.OCX

Filesize
137KB

MD5
d76f0eab36f83a31d411aeaf70da7396

SHA1
9bc145b54500fb6fbea9be61fbdd90f65fd1bc14

SHA256
46f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c

SHA512
9c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\DBGRID32.OCX

Filesize
513KB

MD5
ec2f4fce368dade257d89a1bde1de380

SHA1
7026e068eaaa6c46a29d1cbf50b057a1744d67ce

SHA256
6cc3e18193118e5d5e0d9a3c765ff2e649a99641b55a79abf1463ed5d46928db

SHA512
cdf1d5e4d7270a7a582edaf16dfda3253d31df48b3af6e333c716b1459fce3b62c14f8b002e77daa07c5a075b05efd3ba3b7073c45b830d0a86d20f7d22f1f52

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\MSFLXGRD.OCX

Filesize
238KB

MD5
07bae8106a135df779abc46ec603ea09

SHA1
be98c98a35da6ced57b7fc3c2fc933efa84b4273

SHA256
4e592240b745546c15e95e26b2547cec86352a49ee1ef79b3e3d28df8b5a0e70

SHA512
6ab494ea9e1c633969d5fe6c14411ec20f7073e464e2738c545deefbdc5fb84fb26ff3e9641236cf1afb4d90633437cd312ff5c665c0c8f462c101a957fffbeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\VB6STKIT.DLL

Filesize
99KB

MD5
cff867572b44212b01b711c1fa009537

SHA1
3978c9f7a3d77c0bdff4353949e2143757eebc79

SHA256
df6e2f111773adec3b33dcb0b31e2a4d21ef7d51740706335f411e2c999c0e6b

SHA512
1b77ef24b1efb4939e4625deb1f8ebccc3c2edbb49b412dadb8a3c293a265c77ea84d8eb725d3af5bb84d9c040a91debe5890f57ed8750147e91f30c1a0630c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\asycfilt.dll

Filesize
63KB

MD5
0bc326cd99125724987ceec7405496b6

SHA1
cfd440400244c182fd064508e873d62529d285f3

SHA256
e701cb227daa19c9b91ecf9975a12351bc4d73454b894695a6c5f74f65b9b77a

SHA512
efcad7817908ae1d503e7c1797e190b8b541cda62eb063aba4c96c0e7012803a3f2070cee597122974b84ad6c26c1c5508c57839df07a3fb140b817ef6fa7994

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\msvbvm60.dll

Filesize
1.3MB

MD5
e949eee7d1be07e32267fe10d9992c38

SHA1
a4241fd4850a6e2fa36ef788a34283a23b85fbbb

SHA256
fa75a67b0d6a8829993397c3a893c182641a8c4806bb1e46553dbad7f7aaf5d4

SHA512
22a789ff7fa41eb739c11a7a9e24f7db86b477650d0c89d937811ebb8a044093019c0728429c9880ee4d76d9bdcaa1d6dbd95ed7b623db619eba0f715586a35c

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\oleaut32.dll

Filesize
540KB

MD5
b3742dee858b243e77c73d2b8f7c8223

SHA1
7a132127eb3efeca8f6bc3f20e49b5011b5ae5df

SHA256
4397d0fe3ef2cdb85dd811b8743c7700bd4e6d8d3365dcba5286aa10adb2c24a

SHA512
277f8f2750a562d5f8168c608928d232a3755662628bf7bb9ed17819786a0e7234534f5e028f4e1e0a2bec0468be5c12c56770c60713f06ac96422581fe26774

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\olepro32.dll

Filesize
81KB

MD5
b48d3193dd1474dcbcc32bf4779ac698

SHA1
4a39d43aea0766c159a32c311c9eb2e06dbf8c03

SHA256
54d7ee1e4b43d2590b3b9b4a412717bfecfcce46f9dda68dba4695f135faa7b5

SHA512
fdb0691dfb26d43708f8f12f6b75e2097570ba27a0040e0f8ecac30ef9307dedcf425cbec671a0178916675503542a7fa670fb5515ec231509d5aabd0047debb

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\st6unst.exe

Filesize
71KB

MD5
996f83e516552ca3b51445bb994a6d38

SHA1
56fc6ba49195dedf735e6ce1b03ab36d72334f66

SHA256
7e60c894a8cead6880fd3ed040504d02304a0b961304e40741340e31f5fa973d

SHA512
5868100fdb274dbad44ea0996aa4ed0a930cce5c61ce55631869bd19ee09feb8a957bf2a4a87ba563f48bb65807dae5b2363c042d451843e9598b10f6c334d2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\stdole2.tlb

Filesize
17KB

MD5
0857394e30de11ca0cd9497e310d6469

SHA1
ba35fba3e44040e7b891fa814dceff94d1c1b114

SHA256
e2b26b1ad2d439dded0799d195ca918a03ccf22146690577e2704f871c098426

SHA512
05309e02b7c427f379f3235d2d7398d53ee35b3f1f9d7f28ad72607c82e0af6163a2def42734666f7e1fd0b67395031632aff9c9af36fb30c0175fad145f1185

Download Submit
C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\tora.exe

Filesize
1.1MB

MD5
2346349fc8e8e6db23c35fb0f87f6bf5

SHA1
3622e640ea66838282ef9b56596452fbb3e3e20e

SHA256
9a6e4f75fb820d8bf63d770a9c79f4717d1fc48ffba76940fc4dafa2320881fe

SHA512
1cf5739e153d13c0a916adafad4e1fe282094eb4688bd194c0453c13a04c0a3e6c8b044650c3d0695a98fb077209ea9c391cedeecc2be43ab542485cc1684078

Download Submit
C:\WINDOWS\ST6UNST.000

Filesize
1KB

MD5
915627ee81ebb032513ff01f8878ea70

SHA1
c38e04b01d490f787386bcf7abc6855cac827a87

SHA256
3341253261fdcb73f58aeab92cf0f31ed01e11d7e6f18f1943f10f57400402e7

SHA512
4f18227b661618e2209754bc6ff1a818abb069f2487b7e8658541c5c562f357027eb3b1b06490c37f0210ed8f564186f020537ca44a245fc636b8a283c0525ce

Download Submit
C:\Windows\SETUP.LST

Filesize
3KB

MD5
f1b2cdbeb140f60882d961bc43a8df8f

SHA1
724774bcfd14fa2644bdd35b7a76fb02f24381a2

SHA256
274832c8ee77266af5bbad6552bba13a9d6db8fadadfd0b423555b30030442c6

SHA512
6982afaf7ebc14ddf10c4f9e7ccd213b49bafa0ce70f7a491f85e8cf1cadc31fa0e8a3d0e1dfb090d97765d5c23f43b8a0e25c432fd25bb72aa4cfbaa6982b26

Download Submit
C:\Windows\ST6UNST.000

Filesize
2KB

MD5
a5863992cf9c0675c13b824c8fde155f

SHA1
9cdb824bac743e6f63f8ea9f1c8e943f299a465a

SHA256
0041f2f237670299096a9f5b934cfa1f01978b7e0a2c41fcfbd87c4694e36154

SHA512
b8839c8c1d6b124e3db51a9db893daba58f5a67f7125ffb857952184a07c1db0eeff6096119475d64513ca921638a1f260f16ffc752e56aae2c4482646388d69

Download Submit
C:\Windows\Setup1.exe

Filesize
280KB

MD5
e40041e0ca436c712332edaa9db7df08

SHA1
deb8ead922f4f1acbadebf0db998f6ba2dc53db0

SHA256
6a15b76e1526e1fd6ebaecacc59c3e954d0feb0b566c81538ea6dad2edcffe16

SHA512
1111be364c3d81dc919d1e7ba7bd141cda6555844d889f00a2b2cb0ee5c19bd0b122ae4b574a3cdfa268668eebec43fa265b44e1b8fa28faaa335824647b8bc2

Download Submit
C:\Windows\tora.CAB

Filesize
1.9MB

MD5
c13240f6e638b4065e72b0d67ce20d75

SHA1
f86f39c86c75c700481d031fc3c631102e57aad2

SHA256
96ebc498a2c51c05c14660a62adb0e97b73b72aa26608008464bb5d291f7c55c

SHA512
92bd0856021de57f38ef557e8e395443aca0cc9a44fc5b60668358c76a15bda95c129fc9bd5b55479b01945dafa7d963bda409775f3afffa710da79624a8989f

Download Submit
memory/4732-364-0x000002B373550000-0x000002B373551000-memory.dmp

Filesize
4KB

Download
memory/4732-365-0x000002B373550000-0x000002B373551000-memory.dmp

Filesize
4KB

Download
memory/4732-366-0x000002B373550000-0x000002B373551000-memory.dmp

Filesize
4KB

Download
memory/4732-370-0x000002B373550000-0x000002B373551000-memory.dmp

Filesize
4KB

Download
memory/4732-376-0x000002B373550000-0x000002B373551000-memory.dmp

Filesize
4KB

Download
memory/4732-375-0x000002B373550000-0x000002B373551000-memory.dmp

Filesize
4KB

Download
memory/4732-374-0x000002B373550000-0x000002B373551000-memory.dmp

Filesize
4KB

Download
memory/4732-373-0x000002B373550000-0x000002B373551000-memory.dmp

Filesize
4KB

Download
memory/4732-372-0x000002B373550000-0x000002B373551000-memory.dmp

Filesize
4KB

Download
memory/4732-371-0x000002B373550000-0x000002B373551000-memory.dmp

Filesize
4KB

Download