Analysis
-
max time kernel
119s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
FP_VMware Workstation Pro 17.6.0 Build 24238078.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
FP_VMware Workstation Pro 17.6.0 Build 24238078.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
FP_VMware Workstation Pro 17.6.0 Build 24238078.exe
-
Size
243.5MB
-
MD5
bca564d7d4ac97b3ddd168b3c9073f54
-
SHA1
c7881a0c8254396257e4fe90931ecb33d057f534
-
SHA256
0746c1d27fb7d1577c15b93984aa456c456e5c07e0a978b5c3ceae9992b0c2ab
-
SHA512
fdda2ac073a0c0227e1c4272aba90de8a523f5efe4fadce1a60061a679d1278de5a9d931c976b424ae900d24701e690b3a1cf8e1e4feeda0f9a3e14fa2541d8b
-
SSDEEP
6291456:vjCXOa48cFcKtyoe6ccWY3vpwNg3QNfo6MNe4i/RQx:vjC+aepNe63WY3vpT3QNgNNg/R0
Malware Config
Signatures
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1988 Kur.exe -
Loads dropped DLL 4 IoCs
pid Process 1708 FP_VMware Workstation Pro 17.6.0 Build 24238078.exe 2092 MsiExec.exe 872 MsiExec.exe 2092 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000400000001da14-899.dat autoit_exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Installer\f77168d.msi msiexec.exe File opened for modification C:\Windows\Installer\f77168d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI16FA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1823.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI191E.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FP_VMware Workstation Pro 17.6.0 Build 24238078.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Kur.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage Kur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1896 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeShutdownPrivilege 3004 msiexec.exe Token: SeIncreaseQuotaPrivilege 3004 msiexec.exe Token: SeRestorePrivilege 1336 msiexec.exe Token: SeTakeOwnershipPrivilege 1336 msiexec.exe Token: SeSecurityPrivilege 1336 msiexec.exe Token: SeCreateTokenPrivilege 3004 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3004 msiexec.exe Token: SeLockMemoryPrivilege 3004 msiexec.exe Token: SeIncreaseQuotaPrivilege 3004 msiexec.exe Token: SeMachineAccountPrivilege 3004 msiexec.exe Token: SeTcbPrivilege 3004 msiexec.exe Token: SeSecurityPrivilege 3004 msiexec.exe Token: SeTakeOwnershipPrivilege 3004 msiexec.exe Token: SeLoadDriverPrivilege 3004 msiexec.exe Token: SeSystemProfilePrivilege 3004 msiexec.exe Token: SeSystemtimePrivilege 3004 msiexec.exe Token: SeProfSingleProcessPrivilege 3004 msiexec.exe Token: SeIncBasePriorityPrivilege 3004 msiexec.exe Token: SeCreatePagefilePrivilege 3004 msiexec.exe Token: SeCreatePermanentPrivilege 3004 msiexec.exe Token: SeBackupPrivilege 3004 msiexec.exe Token: SeRestorePrivilege 3004 msiexec.exe Token: SeShutdownPrivilege 3004 msiexec.exe Token: SeDebugPrivilege 3004 msiexec.exe Token: SeAuditPrivilege 3004 msiexec.exe Token: SeSystemEnvironmentPrivilege 3004 msiexec.exe Token: SeChangeNotifyPrivilege 3004 msiexec.exe Token: SeRemoteShutdownPrivilege 3004 msiexec.exe Token: SeUndockPrivilege 3004 msiexec.exe Token: SeSyncAgentPrivilege 3004 msiexec.exe Token: SeEnableDelegationPrivilege 3004 msiexec.exe Token: SeManageVolumePrivilege 3004 msiexec.exe Token: SeImpersonatePrivilege 3004 msiexec.exe Token: SeCreateGlobalPrivilege 3004 msiexec.exe Token: SeRestorePrivilege 1336 msiexec.exe Token: SeTakeOwnershipPrivilege 1336 msiexec.exe Token: SeRestorePrivilege 1336 msiexec.exe Token: SeTakeOwnershipPrivilege 1336 msiexec.exe Token: SeRestorePrivilege 1336 msiexec.exe Token: SeTakeOwnershipPrivilege 1336 msiexec.exe Token: SeRestorePrivilege 1336 msiexec.exe Token: SeTakeOwnershipPrivilege 1336 msiexec.exe Token: 33 2544 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2544 AUDIODG.EXE Token: 33 2544 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2544 AUDIODG.EXE Token: SeDebugPrivilege 1896 taskmgr.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 1708 FP_VMware Workstation Pro 17.6.0 Build 24238078.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe -
Suspicious use of SendNotifyMessage 56 IoCs
pid Process 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1988 Kur.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe 1896 taskmgr.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1988 1708 FP_VMware Workstation Pro 17.6.0 Build 24238078.exe 31 PID 1708 wrote to memory of 1988 1708 FP_VMware Workstation Pro 17.6.0 Build 24238078.exe 31 PID 1708 wrote to memory of 1988 1708 FP_VMware Workstation Pro 17.6.0 Build 24238078.exe 31 PID 1708 wrote to memory of 1988 1708 FP_VMware Workstation Pro 17.6.0 Build 24238078.exe 31 PID 1708 wrote to memory of 1988 1708 FP_VMware Workstation Pro 17.6.0 Build 24238078.exe 31 PID 1708 wrote to memory of 1988 1708 FP_VMware Workstation Pro 17.6.0 Build 24238078.exe 31 PID 1708 wrote to memory of 1988 1708 FP_VMware Workstation Pro 17.6.0 Build 24238078.exe 31 PID 1988 wrote to memory of 3004 1988 Kur.exe 32 PID 1988 wrote to memory of 3004 1988 Kur.exe 32 PID 1988 wrote to memory of 3004 1988 Kur.exe 32 PID 1988 wrote to memory of 3004 1988 Kur.exe 32 PID 1988 wrote to memory of 3004 1988 Kur.exe 32 PID 1988 wrote to memory of 3004 1988 Kur.exe 32 PID 1988 wrote to memory of 3004 1988 Kur.exe 32 PID 1336 wrote to memory of 2092 1336 msiexec.exe 34 PID 1336 wrote to memory of 2092 1336 msiexec.exe 34 PID 1336 wrote to memory of 2092 1336 msiexec.exe 34 PID 1336 wrote to memory of 2092 1336 msiexec.exe 34 PID 1336 wrote to memory of 2092 1336 msiexec.exe 34 PID 1336 wrote to memory of 2092 1336 msiexec.exe 34 PID 1336 wrote to memory of 2092 1336 msiexec.exe 34 PID 1336 wrote to memory of 872 1336 msiexec.exe 35 PID 1336 wrote to memory of 872 1336 msiexec.exe 35 PID 1336 wrote to memory of 872 1336 msiexec.exe 35 PID 1336 wrote to memory of 872 1336 msiexec.exe 35 PID 1336 wrote to memory of 872 1336 msiexec.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\FP_VMware Workstation Pro 17.6.0 Build 24238078.exe"C:\Users\Admin\AppData\Local\Temp\FP_VMware Workstation Pro 17.6.0 Build 24238078.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Kinghaze\Kur.exe"C:\Kinghaze\Kur.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Kinghaze\setup.msi" EULAS_AGREED=1 LicenseAccepted=1 AUTOSOFTWAREUPDATE=0 SERIALNUMBER=MF29K-22JDN-4J0X8-182QK-9KANA /quiet /norestart3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Looks for VMWare Tools registry key
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C1A76C4E18A89F34493803CE1715BA542⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2092
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding F374330E71F5F4743127527D71AF12852⤵
- Loads dropped DLL
PID:872
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2500
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5781⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5caee2e84c0b232df0c403bf5ecd65f38
SHA1e6edc433c5783d165a6cda819df4c787ae37d94c
SHA25622e116393a14cf732a0dc02a939d85f19d7800a649b279d2a633bb385998cec8
SHA5123ff2cbc1c1d2e1559ed1c50f869d32b3613377d73c8d3820c967ae6abbcc7f3e3a7c83fd2f696147c5ddee83738ffc1923181fff03bf840de6a76547ebab2bc0
-
Filesize
1.0MB
MD5f61a72d4fc9b672c85ab6583719a1599
SHA1066d3556fd6e020c7b9e05cc4267840dd3bba4c9
SHA256f474aa13a89eab8d029145d089d81caae35c07f85bc6ddce134748e1247758f2
SHA5124b1a37989a729ec26a5fe30cb3961dcf94acf4bcc030ca0edf20b9fe23ab2593b2b6790a50ef4ec018ecf762902fafe7a8e1fe24f2ea1e05c875b30c55c4938b
-
Filesize
1.3MB
MD589260f52be05827e1536e6cab3c4c671
SHA175eac2a7f6fd738fb8962902b2ef7e2407e4153b
SHA256b90c9260d40ae8abfc5c501f7a35e3dd8a48fbecb39866ba3e624cd298a9efb4
SHA5123f45d75d652081c229f43fe03fe34bf538273a59a04f48642dd5aed8518d1666adf705f891ef2bf8dfb3468bebca3696b920014f3d0e1c81e0f7d86f57e95650
-
Filesize
1.7MB
MD5978dc9e5eabe57a8f377a8572f3cff50
SHA1c4957bf7a5fe23727ebe5c1dddfefda3a330cfa1
SHA2565034b302419ad50bfcfc5a1f754fdce6db310ed39fc7601cc415358b965c719a
SHA512a7c0244309c0ed8e64d7efc5f30d2934d3adf9e8167934459d73890c166b10041648d56f03baf12742c9c30c010829d899b4ebefcf3660041510bf5f0d07635f
-
Filesize
24.2MB
MD57c1fa616629705abdba87330528e138d
SHA1b4ec2ae7d817f5e77cd063c4a7f19784245d4d3d
SHA2568c7131d0e045af812c9abe805a6ffac6bb7bda70e99d3085cd414b6608acd8ef
SHA51277350ecb9271d2cd4d41d18402cbeff66595b8115cd17229d004663b2ce1137bbe57d661a5bceb1c56b93476dfd6ae592e8a5888f91e70b201f9abee4fae657c
-
Filesize
461B
MD5c7ad5fb6b0dbfdb99d653c37d7654e5e
SHA1f369a56acdb363b23dadcf9222a23424c48951dc
SHA25630d13327e94aabd255e9bc6cf58f4c53851378f1d8819c25e3f177b91321a49e
SHA512b80caa663db0215602a6275990d80dc68c15f51cc0bce981e91e67524dc8a87435070c1b8bbedac94161fcf00638b229a4fbcfb9af9f1c37393af8ea7416cdd2
-
Filesize
2.6MB
MD528cbf606607e8a0b2d96a9865d767d55
SHA185a8eaf40098c1a010d71844f0f1e769655c0c56
SHA256938ff160f962a6d51d0b08cf42382bd739e524be7c46e531fdf09a1260864500
SHA51251b7d3eebde82d1972fdc3f8ebd294e5a8b47848dde100156a69422f6c8506784f12a0406a0f66b3a6260cd618540c1cbedd6af9cca2caf0c017b8f6427b50f8
-
Filesize
2.9MB
MD5554abfd1bec28f123beb2a754bc1ee1a
SHA1be7b05ad9e586e42bca3a698790927708e0b1e5b
SHA256597f799ae419ecef7b9241bdce6c7b3ef6cbfa1e398512d341f780326dbdf156
SHA5129386b7ba0bc664488b928f90df1376b8a117cb3285fb679a8b4674759e2f234e0853c457f278cce53e2da5600c66fdc2a0ae12dd6e1bc4d06338209693ef0b2d
-
Filesize
202KB
MD5d773d9bd091e712df7560f576da53de8
SHA1165cfbdce1811883360112441f7237b287cf0691
SHA256e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
SHA51215a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
-
Filesize
1.0MB
MD50bf00fa2ec03c61a403fdb338066906b
SHA11b9f5fc75f7191b2abfc39545056caf44401e4ca
SHA2560286bcbe3ce744a275729ff09b271e75cf1ece67a50ef66fe21b9f8231689664
SHA512f65667545e5438d37fd8075116a00050e838fbc6b755e8b424ecffb9382fbf91a17c0f9fab02383b4d72b487f6e2a023cf861826d145f0e6b533cc7a158d4738