54564a432d996656faa7bc5370425aa0d29f793cd5b822f970afe61a7123fe82

General

Target

Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe
Size

43.1MB
MD5

4c071b9ebb99eb32606262b67a18b33b
SHA1

2ed6fa000a65a5176adc9a1b8c991b49c1b6dd5f
SHA256

6402802fb4368ee62fe883799a55a9453affac439cfeca10025d3f75c205945e
SHA512

8eb0c590622f8b26a0ce2a8a348f7b603ad1de1f156397f9c2dfaf7987755a1a1910298f8246c2a031841ed3349563c22588ae459a419dacaca1ee818a906a68
SSDEEP

786432:FVGnep5vZn2lAKAjA1Rfyxdd2TN4dlf7KC1rFV3mBp+5/p+/V1dt:OneZnIR3fyxddNdrPmBp+xyz

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
692	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 692	4988	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe	86
PID 4988 wrote to memory of 692	4988	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe	86
PID 4988 wrote to memory of 692	4988	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe	86
PID 692 wrote to memory of 4824	692	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe	95
PID 692 wrote to memory of 4824	692	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe	95
PID 692 wrote to memory of 4824	692	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe	95
PID 692 wrote to memory of 2708	692	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe	100
PID 692 wrote to memory of 2708	692	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe	100
PID 692 wrote to memory of 2708	692	Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe	100

C:\Users\Admin\AppData\Local\Temp\Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe
"C:\Users\Admin\AppData\Local\Temp\Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\{0673B81E-F350-4F06-A4DF-AB8B53350F19}\Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe
  C:\Users\Admin\AppData\Local\Temp\{0673B81E-F350-4F06-A4DF-AB8B53350F19}\Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe /q"C:\Users\Admin\AppData\Local\Temp\Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{0673B81E-F350-4F06-A4DF-AB8B53350F19}" /IS_temp
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    "C:\Windows\system32\MSIEXEC.EXE" /p "C:\Users\Admin\AppData\Local\Temp\{0673B81E-F350-4F06-A4DF-AB8B53350F19}\Patch_64bit.msp" REINSTALLMODE=omus REINSTALL=ALL SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4824
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\system32\explorer.exe
    3⤵
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{0673B81E-F350-4F06-A4DF-AB8B53350F19}\0x0409.ini

Filesize
21KB

MD5
a108f0030a2cda00405281014f897241

SHA1
d112325fa45664272b08ef5e8ff8c85382ebb991

SHA256
8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

SHA512
d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0673B81E-F350-4F06-A4DF-AB8B53350F19}\Setup.INI

Filesize
10KB

MD5
bd50068802d301dc21228bf6923cbdda

SHA1
5e73c96006f85ee4cad710d3ece97c1e1bf05aa0

SHA256
affc00cdb82af2679cd1f54764c9ce5ca1c5c434e7111e1dfeca685651569574

SHA512
ec8f17e7c7d1a39fe84fa9f073ca4221a00783f4645bb95384b1ee9966e134e26f81fde7d38e274e934a729beee9b7864ac1bca03e75ef3b04915fcdbfe927a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0673B81E-F350-4F06-A4DF-AB8B53350F19}\Vector_CANoe_VAG_Test_Package_4.0_SP1_update.exe

Filesize
43.1MB

MD5
4c071b9ebb99eb32606262b67a18b33b

SHA1
2ed6fa000a65a5176adc9a1b8c991b49c1b6dd5f

SHA256
6402802fb4368ee62fe883799a55a9453affac439cfeca10025d3f75c205945e

SHA512
8eb0c590622f8b26a0ce2a8a348f7b603ad1de1f156397f9c2dfaf7987755a1a1910298f8246c2a031841ed3349563c22588ae459a419dacaca1ee818a906a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0673B81E-F350-4F06-A4DF-AB8B53350F19}\_ISMSIDEL.INI

Filesize
748B

MD5
4e5402a6dd03615eefd7a95e77645a34

SHA1
a3972a1cf8a69238653b62d5ab1e72a24341277c

SHA256
ef5ebe82041a95b892aa3bfe4d6a46aeb85993eba05432a8c26e593aa17b52b0

SHA512
85dc0547b269200ef09a004cc9f958e86e529a9704e4f137ff6ebdcc0eb6463b936c2b895ef58a2e11a8fce070df6606d538920ab0836bd9ceebc99f988deea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0673B81E-F350-4F06-A4DF-AB8B53350F19}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit

Analysis

Sharing