71916efd98ebad32e60025ebb48cbc3bb8556d60a82260143580fa2b3f90c72c

Analysis

max time kernel
106s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/12/2024, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.exe
Size 57KB
Sample241214-afpbdstmgr
SHA256 0d03931dae04b1d6cae8d3745c3aff6315e0df8c6b0bb2589fe77b50580e88f6
MD5 242b49803d0dc2c25486ab866d8516cb
SHA1 8d4302a242f4e3be1678e21e9bf79cc27f123e7d
SHA512 02ba717114ac8fe22898356403065203d719e97b6bc4ececaf849fb21e02529bf54f367bd3468103045cc63a60c77935d8efa04fec67f6d80b60e43067966577
SSDEEP 768:/Y9BR4QkHgaYpYnqL6n/RwilMARtPvevxHs4gZWk:mzlkHgNxc58ARtP2xHeW
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{2d1ffe61-97ae-4448-aaa4-84a5f773d104}\SETACAB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2d1ffe61-97ae-4448-aaa4-84a5f773d104}\snbus.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2d1ffe61-97ae-4448-aaa4-84a5f773d104}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{aea904e2-6036-f649-90f5-fe5445cf61ab}\SETAD18.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{aea904e2-6036-f649-90f5-fe5445cf61ab}\SETAD18.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{aea904e2-6036-f649-90f5-fe5445cf61ab}\snserial.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{aea904e2-6036-f649-90f5-fe5445cf61ab}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2d1ffe61-97ae-4448-aaa4-84a5f773d104}\SETACAB.tmp	DrvInst.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	install.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeAuditPrivilege	388	svchost.exe
Token: SeSecurityPrivilege	388	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 4732	388	svchost.exe	83
PID 388 wrote to memory of 4732	388	svchost.exe	83
PID 388 wrote to memory of 3964	388	svchost.exe	84
PID 388 wrote to memory of 3964	388	svchost.exe	84

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fd9cf680-f4be-9f45-96dc-4ad74640b1cc}\snbus.inf" "9" "435f382f7" "000000000000014C" "WinSta0\Default" "0000000000000160" "208" "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:4732
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{61de96a8-4bc3-b949-bd4e-a871775d6c3b}\snserial.inf" "9" "479e6210b" "0000000000000160" "WinSta0\Default" "000000000000015C" "208" "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

snserial.inf

Path C:\Users\Admin\AppData\Local\Temp\{61de96a8-4bc3-b949-bd4e-a871775d6c3b}\snserial.inf
Size 1KB
SHA256 392e836b5a9cdbba0f9b4eb8346a6c0281c134c070a40d99a2c71ad0d2362520
MD5 c2aeabdadd719d5ff4097c4fe2995af7
SHA1 39cca12c94d4ba8aa41a6560a00b031de6899606
SHA512 7854dce413a860dde871d143480fc21ddbd2441516d9a913f568883aec726f0d45d5385dc2ac9fdf449babef2c72715378d683b097f869fd4f6ec6fe54281d38
MD5 SHA1 SHA512

Submit Download

snbus.inf

Path C:\Users\Admin\AppData\Local\Temp\{fd9cf680-f4be-9f45-96dc-4ad74640b1cc}\snbus.inf
Size 1KB
SHA256 3804a768e956d3f30666258972b3215b738fdd58383b8ea808d31042f4fda439
MD5 96d0078ea02ed681f67d8c8e6409473c
SHA1 a45fad9dc80b4e74b0ec31af2187b0e4b6cfee3b
SHA512 e53e058248544cdbcf219130ba4ec3dce6e6885745064e8da52174490b348952b72addb7bc45625d73521fea7c290f1698adc1efeada744a8eda08f7008247b3
MD5 SHA1 SHA512