Overview
overview
7Static
static
3bf388f9182...7N.exe
windows7-x64
7bf388f9182...7N.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7ast.dll
windows7-x64
3ast.dll
windows10-2004-x64
3home.url
windows7-x64
6home.url
windows10-2004-x64
3popr.chm
windows7-x64
1popr.chm
windows10-2004-x64
1popr.exe
windows7-x64
6popr.exe
windows10-2004-x64
3Analysis
-
max time kernel
111s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 00:25
Static task
static1
Behavioral task
behavioral1
Sample
bf388f9182f816e19fb683e7f719fac66f294028c24e2b536273d7d355e51277N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bf388f9182f816e19fb683e7f719fac66f294028c24e2b536273d7d355e51277N.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
ast.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ast.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
home.url
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
home.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
popr.chm
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
popr.chm
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
popr.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
popr.exe
Resource
win10v2004-20241007-en
General
-
Target
popr.exe
-
Size
710KB
-
MD5
97a31177f4a5e152e33871ec91ae35c1
-
SHA1
be8af16657b19efe99c8440e8cf670ae9c1dc481
-
SHA256
44a2cebee9b83f1bb385f7b6f18bc4c8c05262ad33f804a2de16f5d60c432f7f
-
SHA512
bca7e50e2f54487e2bf95d393445b7fc8f2c3ab372d4038dc3c731391565288963ef3f8a4810558eaeccfc381df52565f96385fb50d361910d857aabe808019d
-
SSDEEP
12288:1xbGshVF+x0qVp0X3LYNGzJyhvQ54rvPRu6b7MP+Dd2nph0viDr9zeM6lD:1Zfh2xVp0XWeJyq5wPh7MP+h2npKv4GD
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
popr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language popr.exe -
Modifies registry class 3 IoCs
Processes:
popr.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key popr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ popr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" popr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
popr.exepid process 4100 popr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
popr.exepid process 4100 popr.exe 4100 popr.exe