Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-02-2025 09:19
General
-
Target
saleforce_offline_installer.exe
-
Size
8.9MB
-
MD5
aa1ec7571a7e45ee718fd35136abb2cc
-
SHA1
354b52630cd08560aefe7b78efe5e0c0e9cc12a5
-
SHA256
645e557e03904aca48c1e0467a94de924a8359b6e5a98354a6e44aa2abeba84a
-
SHA512
c00bce637b1d2f5e28d34da816b0d0d3f1d81cc9fe59c953514b65c70c0e3f8b79c9677d4b928447b14829f884e8524b7966df5fd9d6d18bb87e580026e909c7
-
SSDEEP
196608:9hjidJFvglcIAtzyRxJugLjygdnyYQ8X+uPOStz73vK:9QdJ1glxAFyRFjycnJnPt73vK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 19 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\saleforce_offline_installer.exe"C:\Users\Admin\AppData\Local\Temp\saleforce_offline_installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FAKNF.tmp\saleforce_offline_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-FAKNF.tmp\saleforce_offline_installer.tmp" /SL5="$30144,1997786,793600,C:\Users\Admin\AppData\Local\Temp\saleforce_offline_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-EMNAG.tmp\Content.ps1"3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
MD5e9b8abe35cac28d8b49782c5c8eceac9
SHA1b01460a1d72b4cf02460a4756431f0c048e44b52
SHA256efd04c82dd0838cf7cb22ac8081bc0dafcf8bc34e778795a7ca608a9ab02148b
SHA5128ed1be382d9e4d624e524640739aa67ae7aa4c14c52f30a87d88b82c30bdf580560f1736e009583318b056a719f8040bc9774d9342e9eebc9798e811c8733b6c
-
Filesize
789KB
MD549ac8d0f65073360c7ba56e9f732f8e7
SHA125d9db2b04652e88227aea3e15f849a1161c97d2
SHA256a2e649a1338792bd100034ff8566391c327167be4377518ba92c757fd2619c62
SHA51299a0fc5ba7b2567f998e470e4e3f358f3f46080bff088745f528bc2f822d9a3f031f560864e0ade5eb826864ad35824653669e6f9608f75ca190932e1843a649
-
Filesize
3.3MB
MD51fe979e33257ace3388bc7e809e24379
SHA1b3971ba1930fa75335d82c72e19939bbbad8a342
SHA2567b7aaf4dd5e9bb0a3e18a1d948e5283953122da43ea6a42244d3550ffffac3a0
SHA5127533a960dfb56977955ac2d0521ef5ba8642ec0e6f1a3e18c0e19c75498a113bbd2f4dc97b56250d98aac53cc27176b912afc8435bf0792e91007e913a993135
-
Filesize
832KB
-
Filesize
672KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB