Overview

overview

8

Static

static

1

1.exe

windows7-x64

8

1.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2025, 19:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1.exe
  • Size 27.6MB
  • Sample250313-yml2ls1xcs
  • SHA256 585ab6c1cdaa65c9d08decf4e1ab1cf9327f00e18d13e85e338268ccc3587aab
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 20 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe" /i "C:\Users\Admin\AppData\Roaming\Surfer\Installer 1.0.0\install\69B1923\Distributor Software.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Installer" SECONDSEQUENCE="1" CLIENTPROCESSID="4024" CHAINERUIPROCESSID="4024Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\1.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741655033 " TARGETDIR="F:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\1.exe" AI_INSTALL="1"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:3580
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 83822CE8D70BB92C61D4A6335D8CC8CF C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4604
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2424
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 69C6466D4EB339088B30871D21C0E3E3
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4988
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2A2B3579DD95EA43A01A2187D283D278 E Global\MSI0000
        2⤵
        • Downloads MZ/PE file
        • Loads dropped DLL
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:1488
      • C:\Program Files (x86)\Main\MainSoftware.exe
        "C:\Program Files (x86)\Main\MainSoftware.exe" Persistent
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:4232
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "FRAVVDAE\Admin" /RL HIGHEST /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4848
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks.exe" /run /tn "MyPersistentApp_Hourly"
          3⤵
            PID:4372
        • C:\Program Files (x86)\Installer\Addons\Install.exe
          "C:\Program Files (x86)\Installer\Addons\Install.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1760
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "InstallTask_3efbdfb2-ef34-4f6f-a070-0027795ebd32" /tr "\"C:\Program Files\Surfclub\Install.exe\" install" /sc once /st 19:56:20 /ru SYSTEM /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1148
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:372
      • C:\Program Files (x86)\Main\MainSoftware.exe
        "C:\Program Files (x86)\Main\MainSoftware.exe" Loop
        1⤵
        • Executes dropped EXE
        PID:4620
      • C:\Program Files\Surfclub\Install.exe
        "C:\Program Files\Surfclub\Install.exe" install
        1⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4684
        • C:\Program Files\Surfclub\Surfclub.exe
          "C:\Program Files\Surfclub\Surfclub.exe" install
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:3512

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e585c93.rbs
            • Path C:\Config.Msi\e585c93.rbs
            • Size 805KB
            • SHA256 eea3681c7565119e565c5305a2de92dcf5a699b2a2cd5eb6e938431a74c2e892
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            guid
            • Path C:\Program Files (x86)\Main\guid
            • Size 36B
            • SHA256 a0b3863812dc4a248881187636cbe27783b0ae8269d8b56f6ad925ed085c19ab
            • MD5 SHA1 SHA512
            Submit Download

            Install.exe
            • Path C:\Program Files\Surfclub\Install.exe
            • Size 13.7MB
            • SHA256 04b41818dab56356df05af7bfbdce7b0becfdac79c30a9e46da46fd69fc68653
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Surfclub.srv
            • Path C:\Program Files\Surfclub\Surfclub.srv
            • Size 28.4MB
            • SHA256 f0088eed29fa7dc483eae794bb8d0a18f07b349a3185bb85b79b0dcc857ca00c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            357F04AD41BCF5FE18FCB69F60C6680F_955BE6B000ACE35544D323364AC3E8EA
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_955BE6B000ACE35544D323364AC3E8EA
            • Size 1KB
            • SHA256 09b31789c09017a7b7f56dbb0431a505e834f3472ee52ea03870384d77b63980
            • MD5 SHA1 SHA512
            Submit Download

            9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
            • Size 1KB
            • SHA256 dfc12ad35d9f6c33e09e0818d7e34eb31aeb040e523c4743d49012c2bf7f0428
            • MD5 SHA1 SHA512
            Submit Download

            357F04AD41BCF5FE18FCB69F60C6680F_955BE6B000ACE35544D323364AC3E8EA
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_955BE6B000ACE35544D323364AC3E8EA
            • Size 540B
            • SHA256 39cdc99c7c26eddd81cd2aa2424c17897da6758df5aab02a1bb0f9e591703042
            • MD5 SHA1 SHA512
            Submit Download

            9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
            • Size 536B
            • SHA256 da07d33d1899c572d7bb46b54ef941efb26bfa7bbf9fd4ae649e0a0a0cbc3b28
            • MD5 SHA1 SHA512
            Submit Download

            banner.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4024\banner.jpg
            • Size 4KB
            • SHA256 be83c8592906fd9651634b0823a2f45abe96aae082674568944c639b5b4a95dc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dialog.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4024\dialog.jpg
            • Size 12KB
            • SHA256 36d9bab35d1e4b50045bf902f5d42b6f865488c75f6e60fc00a6cd6f69034ab0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSIC574.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSIC574.tmp
            • Size 1019KB
            • SHA256 15c35c5abf7bab8d1375f5622e31da14fd027ae1046b8a6ddfd74263fa34eda6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSIC71D.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSIC71D.tmp
            • Size 1.2MB
            • SHA256 6e7cdab18e1f705c0ea56a565577db0389ece2b5a4e0f31d3063e9103f59fbee
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            shi2362.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\shi2362.tmp
            • Size 4.8MB
            • SHA256 047e2df9ccf0ce298508ee7f0db0abcb2ff9cff9916b6e8a1fbd806b7a9d064b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Install.exe
            • Path C:\Users\Admin\AppData\Roaming\Surfer\Installer 1.0.0\install\69B1923\Addons\Install.exe
            • Size 11.7MB
            • SHA256 612bc174e2dba3f0b4f1d3ec5a87f0c2f3d02051c17a82fc39643aa9e1e55f39
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Distributor Software.msi
            • Path C:\Users\Admin\AppData\Roaming\Surfer\Installer 1.0.0\install\69B1923\Distributor Software.msi
            • Size 4.8MB
            • SHA256 de7f4d47c0f2329eb4b67510b5dfa6e0b9cb9edd5a669e987354008b57f88eaf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            How to uninstall.txt
            • Path C:\Users\Admin\AppData\Roaming\Surfer\Installer 1.0.0\install\69B1923\How to uninstall.txt
            • Size 1KB
            • SHA256 e8867a5166177e6ef833d079ce4e9e53a4ca6866ba6f9e4ed5a7a04260d4541c
            • MD5 SHA1 SHA512
            Submit Download

            MSI5FC2.tmp
            • Path C:\Windows\Installer\MSI5FC2.tmp
            • Size 917KB
            • SHA256 0fa9b28d3bb8e455ad61735f5259d5d9b8f65bcefa44f83f69db8a4ca451e5bd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSI6784.tmp
            • Path C:\Windows\Installer\MSI6784.tmp
            • Size 423KB
            • SHA256 eb21efa033f38f24d87c1c259055a2618168268881be6ae06d734450fdf65f82
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSI6802.tmp
            • Path C:\Windows\Installer\MSI6802.tmp
            • Size 802KB
            • SHA256 2376cc8c06232e3346e97f1ff01d208ea65f181ddeb9d616bed193a96a879087
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 24.1MB
            • SHA256 426885b91e6cae1f1def2131c6333a7dcd122b569f84db45a4fe49a1751ef40c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            {38ad6ddc-bc59-465f-92d2-2ff5ffb2256d}_OnDiskSnapshotProp
            • Path \??\Volume{27205db7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{38ad6ddc-bc59-465f-92d2-2ff5ffb2256d}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 109e4529001a992c9c9c3d2ca62fd2b26f55680ec77aa4bef0a4763eb283dc50
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download