Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
28/03/2025, 03:44
General
-
Target
SecuriteInfo.com.Program.Unwanted.5599.6046.25600.exe
-
Size
20.0MB
-
MD5
e5293b3cb9e4f710b5c1bec09ea16d85
-
SHA1
4063cb95a16891b3b6c99354b5473fce31721496
-
SHA256
6fd31ad446a222eb27dd578b3b66cd9e6f667d47a256441c70d7410563cab489
-
SHA512
5f750c7676a41aaf445736ac7661d75e9cce6e2993a2f5ef9567ffe30c39d528b759895c83db6d45f647a50e22ecb4200adb1a8384fa8760e97f9b3cc129d051
-
SSDEEP
393216:jtVjUU7FxD+31pK5cV7MQ4graklxuxpWEn73cYkktZROwRAgUPG4THTjYc+rG+vW:5VjUU7FxD+loCV7f4gWkxu/3cHk7ryGQ
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 7 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 52 IoCs
-
Executes dropped EXE 7 IoCs
-
Loads dropped DLL 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 7 IoCs
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 25 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5599.6046.25600.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5599.6046.25600.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BDCGD.tmp\SecuriteInfo.com.Program.Unwanted.5599.6046.25600.tmp"C:\Users\Admin\AppData\Local\Temp\is-BDCGD.tmp\SecuriteInfo.com.Program.Unwanted.5599.6046.25600.tmp" /SL5="$9015A,20502182,505856,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5599.6046.25600.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Auslogics\Duplicate File Finder\Integrator.exe"C:\Program Files (x86)\Auslogics\Duplicate File Finder\Integrator.exe" /install /setautostart3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Auslogics\Duplicate File Finder\Integrator.exe"C:\Program Files (x86)\Auslogics\Duplicate File Finder\Integrator.exe" /FromInstall3⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Auslogics\Duplicate File Finder\DuplicateFileFinder.exe"C:\Program Files (x86)\Auslogics\Duplicate File Finder\DuplicateFileFinder.exe" /FromInstall4⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Auslogics\Duplicate File Finder\TabReports.exe"C:\Program Files (x86)\Auslogics\Duplicate File Finder\TabReports.exe" /FromInstall4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Auslogics\Duplicate File Finder\TabCareCenter.exe"C:\Program Files (x86)\Auslogics\Duplicate File Finder\TabCareCenter.exe" /FromInstall4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Auslogics\Duplicate File Finder\ActionCenter.exe"C:\Program Files (x86)\Auslogics\Duplicate File Finder\ActionCenter.exe" /FromInstall4⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD502473d9c62ce54acb70a160c9d7139fc
SHA1f43ec77d155a5000fa1849e1b6fb63cc612d7441
SHA256f3d14cb342dfcc890b6337307f22d4bca839f012abb4b08b3d5e4cfa4a80b8f6
SHA51293e64e5a1244b942c3558a75a50997b14d384f548d240e7b34ef804056d6b2fd8f0723a7102ba9a9af4e482d52882ed2ae051a004c33407ff070fc1cf4f33b42
-
Filesize
1KB
MD5ad299ccd0fac4e3b90a274627ae3f039
SHA1001024455e5062afc983d91af944be184522ad9f
SHA2562d086db24208c7ea5320b59b0da56428ff077b5647f6b4761bd6c91939a5e0c3
SHA512d05e2b3212a2fa59dec65fa2ff43eaa051ab3a459a17b64b148389c50328d93b35bb6756633248896dcf45d13d28b26dc7550d6654d5f5c4b4281c1c715c2574
-
Filesize
2.8MB
MD50d6cbb45b46f8cd244a8c42ec4b6945a
SHA1fb809cb219e6428d6f068c285a40b6be938ad52c
SHA256d7bb6e83cd526fee4951e25d2d207c9a3292a694791626c777549a78202a2e01
SHA512247333c421458ab069676afc1655a9ad0a1f2d12afba065fe615db3591ef390ba40d18477f779945ae29b8290af5b8a790bc704ed3012c1109f4ea8f80d9fbcb
-
Filesize
5.0MB
MD538b9366adf103dd2a1934ca78978c358
SHA13aaf3cbc74cf52acd913f61614bed827d704f0c6
SHA25652f45d37307cc850f202dc2c20e5183ae9778e11feff6642f12fa64dad2abb09
SHA5122f93a595d64bd05d7997ed5d0de0f624d06d4f16f76f3473061d5fb20c45a8dfbe7cceda6f2a07e7338bc1ca7381089679d08e7f40122e2b51d1b55f4e1e3648
-
Filesize
682KB
MD5ffc8e5799fb204a15fd006e4c0e8034c
SHA18364a69a9885c82de90a2e06664fc30db610786c
SHA256f06482d18dbf07017217a549be239b7954b05baf832b78437529f7ea1ccac900
SHA512735f0d93f8889c09b098406a0652a95092aa47dcfeb463f471a7a6b22bda06964202ac2d6d0952d08ebdd2d584b41caa84645a7562c8a7e2783d3823500e4e89
-
Filesize
211KB
MD5b356945937958992b9b8ad1b2f888d01
SHA1f4f3de5fcb7f65ade31c6de8aa856c687bfd3937
SHA256f09bcac12cce1d2dc0c8aa80968ae5d5113eb804e8f122b56ab6541b3bada75e
SHA512028a8ebb00d6c4c2695fbf19b945ce2706906efca25adbf980e8a2dde95ac3ce8b692e459594ba1bfc521e2fe8be11f70588da994e6344baa69b09ee13fc8990
-
Filesize
549KB
MD551a1dc35c98d7f6165546282e805a916
SHA159a584a6de366a2e8d52d7943d6554b17ebfcb4c
SHA25697e842db7aef93e7dadbc0016a25e2f6a29eb85ff4fc74964cbdaa97c28312f8
SHA512d3192e18d6c66606e4dc38af6e841c199bbfbd617543aed54bbf6791fcf49cc2e79f5362dde37fd65f0342fcb15c180dfb024ea96dfb40fb181e1e425fae2e23
-
Filesize
2.5MB
MD507d0149eb09496eb54a372ae489f7565
SHA193debd1030161acbc1f999ed4a87176f12e0e0f4
SHA2563587192b3334258f3c41be810e5980b8aa51de3dbf04228dfee67b75681516ef
SHA512b1cc9a8380550988b4e336121f20e04b3f44b49f51075587f677e38199bf4dda95411d4258aaa2962472936fce3ac94e6c8bad5d4533b1f1e8493ffb2464d679
-
Filesize
8.8MB
MD58724e5f0b2e64b0d0d905ad8fb493d52
SHA186e90b22b180ecb3e70e0989a4eeb927e39ea1a1
SHA256dbeb9160511ffeab19082ada9273e20fe4c0b7e2721cb0ae640f26d634862299
SHA5120fcc63a0c9291c9a0b6acf89a7121ed2c0a94785ed7dce5b3eb4251c9bf0b2af0148d40ec07fc64ed837abd51f84db4a1c6a32436fec93b06a62f9e9807ef0c2
-
Filesize
2.1MB
MD57d799f726584d2e7ea2e9c2e366124bd
SHA1d9feb7c91bc46005b5caeca3873da848ea057a0d
SHA256981a6756b2c39a8d096c0e2a64d6962553c522253018597d25d9e3ac38836832
SHA512b705d302a691ad47a4cb9ba6c0c8336b7af3b93bb7d36c35a5a3c68b2537fe62420634785600b1b301717b803d961bb92f8525f5c91fce732db931cf935ecf74
-
Filesize
97KB
MD5948ed0ffac9dbd853cd2b02a33bc5709
SHA13fcfd2d09a5a89ab9a6040b4d4d438ebd2dcc48d
SHA256dc894ea2334c057843cb0e53ade93a52a82f960198fcfd66f88c7fa9a1c60c5c
SHA512a178dea22381d7f0ad9874e195c8675939102f032bf2f5f4bca8e6ea4b339b34b188a1a69b890bf18bded48de386069896442bfe56304d6db1b61497d9717294
-
Filesize
345KB
MD59f8e05d118b228c0414443da40d5cdd5
SHA185a1f6b62fa0671a749cf47efd3f427f0bddc730
SHA2566fee4fd1fd06427bf6016fcfd3a9b64e3e3cf3a3b9db005c1a9e47a7764c40b0
SHA5128f952c066fa76cdbe9bf077b7a461fd019f9134fee779b23de97c570cffdd7a7ce7d7b0c0f919ae5c58afb410fd10a2e9990f83c07b8dfac5c7d6f0255355947
-
Filesize
141KB
MD56ed3eaa975a7831ad3438633a7ae89be
SHA176954e4a66502d2678a85fcabbf6cbe08d0de595
SHA25692abb2e877cfff30a1b7803d2e916da584cc525e77937619a2fb703e3c6d2288
SHA512c89011dff3a3b176246b48513c31a03d36a14249b427be4e8206fc78a9611f24ec585aae0199adeb2ba9e7b5ab290aeda8953a4b358021b907260f2c05099d0f
-
Filesize
192KB
MD53b3fdb2c16a2042f8deb5d4f8ff5644f
SHA189bba06f1141079071656c91d2bcfa74a7991173
SHA256195247a3bb0ec44211831838c166776568fc69a5b0bc7a431c8db885045e1a41
SHA512fa9f8ceddf656ad9f889bfda3c485f125b4965a1376e6145671fa9b6d147dd56cdffc41191f22b8abe5b287729d46c3bf2de41d4803179881fc0583d0dd12960
-
Filesize
2.1MB
MD521e7f07bab223d25d4d13b7ebd910c5c
SHA15452000d0f38a1d0912e2862ed597d27b5a61765
SHA256ddffdd6c8fa8475162f9e0159452edb59d9f0c133e594d011c792282fc079201
SHA5125585104f97c422a5726ce35fb08ab4677822672492662692cbeafceaba4f9a69753ef3c74c5c477d656daad2defd550b9b0ec0dd7b35fcf42d5ad025c6339c8a
-
Filesize
357KB
MD581aa5634a4f4e55207f0a46360236127
SHA153d3f8c4ede5c95851db9a5951392997123b7188
SHA256ced60f075f2c3e311833cf6280e1eda0a46ab8a9916e4f5f8cc015481a77e1d6
SHA512b206467bb27efa339e471866677f8c3f10d2553a2788df4fa444ae115bdf262f510aad8e5d1ccddd36f79ae9df9981e7c8b7d0e622009f82a7ac1be3f70b0839
-
Filesize
10.1MB
MD5942cc74b7ef66b51859d135fa3bc8bb2
SHA1642810b822d9e4ddd40faafb7437b552d2ad7d56
SHA25666f2f6b2e8c24827d63f6415094ae40fddd50f30e097cda395cc0116d57356a6
SHA512941e41ed4031674168d4b4380d52cdea4d3077c1e871a9f61d8c85030befda654b06cb5da666d906130fa2d5b985573b274f9d77ac570b634be295baefa385e5
-
Filesize
844KB
MD5668438618fb6d71890c5746b4e22cca6
SHA10a30260862eefc2379002d01e5be172a12dc64f2
SHA2563e6475422d59c7ebef07b63f71d25591569737938cdad226f5c20893bfe72abb
SHA51232421323510dbbc8df56c39b08e54c5f8bf52d63ac1405c090b37944ec8bb5d065be2dc2d7a3702c94b9e278c7ef7f4c1f865b5da105345eacb6e3fcae5a87ac
-
Filesize
3.9MB
MD5e4f482e3f7eb949256402c38e467122f
SHA12910db3ffc1769d2ae83b6569fa91e79faaa4033
SHA25610b9d8569b8f9e9e46e7a579855492353c43f1e3b5d4a28959015bed5570350c
SHA5128dc4eadc0ebe0cc86e7ac85843c16be5cc563a5dce2985f34b4769786e5d2f7176b62506854ef5e5b75a58aa1cbe45934650e7cab098a639bc62affe9119241b
-
Filesize
355KB
MD557496780b9a5c733144e5663f088f42a
SHA1ccdd74d1a638629f8fdba43ce1180a23d7a463dc
SHA2566be794294ff9c4b27debc6ed50fce865d028cf496d4e39fcce9c4f8e48cbfbfd
SHA51250cf52cc8524551e9fd106c823039f604df2b92d2de859ef2d4b85016d603a6c31dc928e155949554c20ebd63f5b5665b627cc8853576a6149f2213b533f16d0
-
Filesize
1.5MB
MD53af39fa30f4fcd4628e15a0a2ab3af12
SHA130a221318994600b615b7daae9316fbc7e8820c9
SHA256ce704900f617ec71cbef6eb8a4a517c2768937e6c3e862becf7a846bb516f401
SHA5123ed16998cc64307674b19c7332a75094244555a55b88e44a830f950a4e21d93fe44d3d11438ecef71608c5a67b8a1612b505ca8e9adf0322451aea0f9890210e
-
Filesize
356KB
-
Filesize
128KB
-
Filesize
148KB
-
Filesize
128KB
-
Filesize
1.5MB
-
Filesize
128KB
-
Filesize
1.5MB
-
Filesize
200KB
-
Filesize
2.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.2MB
-
Filesize
10.1MB
-
Filesize
148KB
-
Filesize
108KB
-
Filesize
356KB
-
Filesize
200KB
-
Filesize
8.8MB
-
Filesize
3.9MB
-
Filesize
2.2MB
-
Filesize
360KB
-
Filesize
2.5MB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
108KB
-
Filesize
8.8MB
-
Filesize
2.2MB
-
Filesize
1.5MB
-
Filesize
10.1MB
-
Filesize
360KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
68KB