cf14a582b2e4e894ee5491853580a767b4e61b547c36cf9a2849877e40fb8f18

General

Target

dbtrial_setup.exe
Size

28.4MB
MD5

624769a9009f77028f5db742a71db73b
SHA1

2dba675c00006086248f6f7ae97f52ff3426f607
SHA256

cf14a582b2e4e894ee5491853580a767b4e61b547c36cf9a2849877e40fb8f18
SHA512

9cccf0f6b175947f54e8aeea7ed59fb4a7b13ae13e2667bea5e6b85b7b447ffa70145c6e5eddf08e245cdfdd7a6c16dcf6a63ecd801a3b4a1c27bde78caceb22
SSDEEP

786432:UkrUn/DGedNtdUz7sUOeVWBOwRmgHdF3t/30B:rU/DG2VUHs8Mj9V130B

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	dbtrial_setup.tmp

Executes dropped EXE 2 IoCs

pid	Process
720	dbtrial_setup.tmp
4688	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbtrial_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbtrial_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
720	dbtrial_setup.tmp
720	dbtrial_setup.tmp
720	dbtrial_setup.tmp
720	dbtrial_setup.tmp
4688	setup.exe
4688	setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	720	dbtrial_setup.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4688	setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 720	840	dbtrial_setup.exe	90
PID 840 wrote to memory of 720	840	dbtrial_setup.exe	90
PID 840 wrote to memory of 720	840	dbtrial_setup.exe	90
PID 720 wrote to memory of 4688	720	dbtrial_setup.tmp	98
PID 720 wrote to memory of 4688	720	dbtrial_setup.tmp	98
PID 720 wrote to memory of 4688	720	dbtrial_setup.tmp	98

C:\Users\Admin\AppData\Local\Temp\dbtrial_setup.exe
"C:\Users\Admin\AppData\Local\Temp\dbtrial_setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\is-O852B.tmp\dbtrial_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O852B.tmp\dbtrial_setup.tmp" /SL5="$A0054,29025676,139264,C:\Users\Admin\AppData\Local\Temp\dbtrial_setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Users\Admin\AppData\Local\Temp\is-7V6FG.tmp-dbinst\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-7V6FG.tmp-dbinst\setup.exe" "C:\Users\Admin\AppData\Local\Temp\dbtrial_setup.exe" /title="Driver Booster 11" /dbver=11.4.0.79 /eula="C:\Users\Admin\AppData\Local\Temp\is-7V6FG.tmp-dbinst\EULA.rtf" /noemailpage /nochromepmt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1743141172\ENGLISH.lng

Filesize
24KB

MD5
6265a3d8b6ea027b596c0c6e9afd5c38

SHA1
4502ff9bccfcbee6d6fc5d65e5381288f2d9f3a0

SHA256
193facd48ea0e183c7825c5efa2638c594cb73d9b40a1505a5ce14b478c6fb2e

SHA512
54b3492a3f4bfaf9f6b02b6d95710a5f7b0b8ef1078623ea77303f253bd0e1d44dad3e725afe0afa12a433b21b8d0cfea55c0214bf09213de7a3cebbf78fd8ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7V6FG.tmp-dbinst\setup.exe

Filesize
5.8MB

MD5
d47bdf9814e9682443fff06e7950b6ce

SHA1
c1ad32b2a4f7ecf123bb2487ff5370a8a52a4d7a

SHA256
02444937bdf1a642bee51b67231cb8de89b0107ace32fea4a0ccdb103f0d77cd

SHA512
d2118477319d0a8d08b84c6ad4cc7deeb733f80ed06284afaf657e5ff648f819f623cb9f5e2722df3dd3a414e1da04d6640f1c832317585c20e04400dc2f7bae

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7V6FG.tmp\EULA.rtf

Filesize
28KB

MD5
b0381f0ba7ead83ea3bd882c1de4cd48

SHA1
c740f811623061595d76fce2ebb4e69d34316f3b

SHA256
44bc9472169403484a0d384f1ca81989ef7e4b07441758e8a0110078933cbcb5

SHA512
6cfb8bc562d22843d043411720db97d0b4cbac96a20983d83d19e59b8428ec202f2532cc5af254438dc34fca4161abbd3f6bac8d397590e41b6d41e60700e78a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O852B.tmp\dbtrial_setup.tmp

Filesize
1.2MB

MD5
048f89f1be0ce17f10350b121c08b6bd

SHA1
d0746f79ab4c1c6712e787d30e7896cf02439d1a

SHA256
8dfc033ff5a1ebac9282f15f14ab048b73fb058fec927a1f5d188a359315c6eb

SHA512
f21b627324fb58f2a585c99df6309e11ae11f895e6f5b6f0d4f9b02368ec9982728e43a3aba5d346d3ca45419fc593293665305f067d9d9f41753d201a9ea90a

Download Submit
memory/720-6-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/720-46-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/840-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/840-48-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/840-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4688-130-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-135-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-129-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-49-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-131-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-132-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-134-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-128-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-136-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-137-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-138-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-139-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-140-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-141-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download
memory/4688-142-0x0000000000400000-0x0000000000A1D000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing