Analysis
-
max time kernel
110s -
max time network
111s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20241007-en
General
-
Target
setup.exe
-
Size
5.7MB
-
MD5
54f0afc185c477ff87127e60ad9f5d1a
-
SHA1
bcb1a16c531227e766a8063c03ac8ce35f5acd53
-
SHA256
f0a221bcb58c14f705bc35c5f86026d3fc50ecf72fb000ad36bab13c5f7d52bf
-
SHA512
b61825ac3296940267b8b336e6b97dd71e2074efcd35011c42cd27522bbc2fd2b2c945466da8058af137b780de4bdd62549b0df4de7dfb6c389211f00e3f0e4c
-
SSDEEP
98304:df7wCQInrje/CAVMJy1WQY2AXD16kEHsSO/QVV45q2MTeyoBN:dfn6/VSlKAR6k2nSvq2MToL
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1688 setup.tmp 1536 FlushFileCache.exe 2100 unins000.exe 2984 _iu14D2N.tmp -
Loads dropped DLL 16 IoCs
pid Process 2852 setup.exe 1688 setup.tmp 1688 setup.tmp 1688 setup.tmp 1688 setup.tmp 1688 setup.tmp 1688 setup.tmp 1688 setup.tmp 1688 setup.tmp 1688 setup.tmp 1688 setup.tmp 1688 setup.tmp 1688 setup.tmp 2100 unins000.exe 2984 _iu14D2N.tmp 2984 _iu14D2N.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: setup.tmp File opened (read-only) \??\O: setup.tmp File opened (read-only) \??\S: setup.tmp File opened (read-only) \??\T: setup.tmp File opened (read-only) \??\W: setup.tmp File opened (read-only) \??\Z: setup.tmp File opened (read-only) \??\D: setup.tmp File opened (read-only) \??\I: setup.tmp File opened (read-only) \??\P: setup.tmp File opened (read-only) \??\E: setup.tmp File opened (read-only) \??\H: setup.tmp File opened (read-only) \??\N: setup.tmp File opened (read-only) \??\R: setup.tmp File opened (read-only) \??\V: setup.tmp File opened (read-only) \??\Y: setup.tmp File opened (read-only) \??\B: setup.tmp File opened (read-only) \??\F: setup.tmp File opened (read-only) \??\J: setup.tmp File opened (read-only) \??\L: setup.tmp File opened (read-only) \??\M: setup.tmp File opened (read-only) \??\Q: setup.tmp File opened (read-only) \??\U: setup.tmp File opened (read-only) \??\X: setup.tmp File opened (read-only) \??\A: setup.tmp File opened (read-only) \??\G: setup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unins000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _iu14D2N.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1688 setup.tmp 1688 setup.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1688 setup.tmp -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1536 FlushFileCache.exe Token: SeProfSingleProcessPrivilege 1536 FlushFileCache.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1688 setup.tmp 1688 setup.tmp 2984 _iu14D2N.tmp -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2852 wrote to memory of 1688 2852 setup.exe 30 PID 2852 wrote to memory of 1688 2852 setup.exe 30 PID 2852 wrote to memory of 1688 2852 setup.exe 30 PID 2852 wrote to memory of 1688 2852 setup.exe 30 PID 2852 wrote to memory of 1688 2852 setup.exe 30 PID 2852 wrote to memory of 1688 2852 setup.exe 30 PID 2852 wrote to memory of 1688 2852 setup.exe 30 PID 1688 wrote to memory of 1536 1688 setup.tmp 34 PID 1688 wrote to memory of 1536 1688 setup.tmp 34 PID 1688 wrote to memory of 1536 1688 setup.tmp 34 PID 1688 wrote to memory of 1536 1688 setup.tmp 34 PID 1688 wrote to memory of 2100 1688 setup.tmp 36 PID 1688 wrote to memory of 2100 1688 setup.tmp 36 PID 1688 wrote to memory of 2100 1688 setup.tmp 36 PID 1688 wrote to memory of 2100 1688 setup.tmp 36 PID 1688 wrote to memory of 2100 1688 setup.tmp 36 PID 1688 wrote to memory of 2100 1688 setup.tmp 36 PID 1688 wrote to memory of 2100 1688 setup.tmp 36 PID 2100 wrote to memory of 2984 2100 unins000.exe 37 PID 2100 wrote to memory of 2984 2100 unins000.exe 37 PID 2100 wrote to memory of 2984 2100 unins000.exe 37 PID 2100 wrote to memory of 2984 2100 unins000.exe 37 PID 2100 wrote to memory of 2984 2100 unins000.exe 37 PID 2100 wrote to memory of 2984 2100 unins000.exe 37 PID 2100 wrote to memory of 2984 2100 unins000.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\is-VF7MD.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-VF7MD.tmp\setup.tmp" /SL5="$4010A,5388498,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\is-QOQNN.tmp\FlushFileCache.exe"C:\Users\Admin\AppData\Local\Temp\is-QOQNN.tmp\FlushFileCache.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Users\Admin\Desktop\Teardown\unins000.exe"C:\Users\Admin\Desktop\Teardown\unins000.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\Desktop\Teardown\unins000.exe" /FIRSTPHASEWND=$4020E /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2984
-
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bf10c6fe273bfc0e1f00a8e55430fb3e
SHA1f58e31a719538311a305c67e2ffb74b99477ba8f
SHA256455a798bf87193a70b4fa8ae7a3bf30557ffcdcb3b22b27f1e0cb4f9c9bf0df1
SHA512750af8758c47fb54ae20bf83cc5496c39756decd5771c2ebd7ab93ab84d59b13329c6fc06669ca15e9745f36b4e562120b53b4c92f557f419c800cc723559590
-
Filesize
1KB
MD5473a683962d3375a00f93dd8ce302158
SHA11c0709631834fd3715995514eef875b2b968a6be
SHA2567f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a
SHA51224ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e
-
Filesize
101KB
MD54b1d5ec11b2b5db046233a28dba73b83
SHA13a4e464d3602957f3527727ea62876902b451511
SHA256a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
SHA512fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
-
Filesize
155B
MD5c5c28798bca6e9ed5d84fa67b656065a
SHA14b6fa3465f1b393e22e9f083b177462028a48e93
SHA25674ca5a42469197eded04f5a0bf34ca251c72f7cc06a3416ac035230cb8e81629
SHA512c06baa4b31e2866fc3f298826930f43fb1d9c2de24e0984594e41f72f022a9090712b478e84d3cb46e0cb0f45d4e81d6c6443b69c7513775340324d9eda92963
-
Filesize
292KB
MD556d52c503adf02184f19eee4767ef60a
SHA1ca133f67a286f4f20282e19837b53b38a27a1caa
SHA256ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494
SHA512246f35664a9af548d402878a3e6ce6d8901a0978477b145db5fd4e5857021efc4016369e9e02e709a27cf5c84f44a32e106008668ba96e2b45d4d06599090d8f
-
Filesize
958KB
MD56afdefdd42b7b96cd04b8ac36598c03d
SHA12f7f549a70b3ff11bca57f67705e8ea2f4e8e3e1
SHA256b045c0c68573fda2aa709a015bec39b5ea8ffe903bcc5043935508e460cb5f37
SHA5127c95e1d7f7fda393e39e6028e77f1442cdf9d403da72ccc8882a585e8bfad5f77a97bdf47548734d9b65820f39df9025189997b1b0b44a933757fc43f53021d6
-
Filesize
92KB
MD5a6c940499f1e16ab41addbbe334ca816
SHA1955439092667d058d4864c456238e74201ac2608
SHA2562530cc01b1b9adf97ffbdd16ca795249d6c0539e48211d7a1fe0243e51671d44
SHA5129699b6239baca3476f23e6ca867c63be1ad0dd04d3b065d8e87099cf33772b4bc8b41266c4b42e272b5ab8227bc58e7725fb5b09d11f6546a35405f7b82539fe
-
Filesize
1KB
MD54a03946798dbd6671654b510ac3c3395
SHA14cd55c4bc29836afaea7301cd98f8daa4a32fad8
SHA2562f7c2f07fd21f0e25769c1b40e046570533636120c1c57840df0141989810bd7
SHA512a343ead4c55be6521e92165c03c32fdeea8c0af25d2267c6d05e984c766d7a8ccc7a46ea6253f56854666a4966a9af153f14f5e02aa197008cf2e77a0a9ae508
-
Filesize
103KB
MD58005750ec63eb5292884ad6183ae2e77
SHA1c83e31655e271cd9ef5bff62b10f8d51eb3ebf29
SHA256df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15
SHA512febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
29KB
MD5df77f2b6126f4f258f2e952b53b22879
SHA1fedda8401ebfe872dd081538deec58965e82f675
SHA256a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8
SHA512623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37
-
Filesize
380KB
MD563dc27b7bc65243efaa59a9797a140ba
SHA122f893aefcebecc9376e2122a3321befa22cdd73
SHA256c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
SHA5123df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
220KB
MD5af555ac9c073f88fe5bf0d677f085025
SHA15fff803cf273057c889538886f6992ea05dd146e
SHA256f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb
SHA512c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
-
Filesize
1.4MB
MD5ae9890548f2fcab56a4e9ae446f55b3f
SHA1e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA25609af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
SHA512154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb
-
Filesize
1.4MB
MD5f68e6d1645d16e4ef9265eead160b460
SHA1f7dab5d6378c621c3998e5949a488750e363bb5e
SHA256d79c145efc7798b7b785af565d3b79c7d7260b3c5ad9202ee91a2d420b01ef41
SHA512d63a430e2eabe8a4307be6c545e7878571d567eef7bd0cbfb4dfeb5e3ba608c63e30c50b6394744da3821cacf2ad14e9bb7aecf76ed82db8fd299cc1313b0b6c