Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 08:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PL2303_Prolific_DriverInstaller_v1.10.0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
PL2303_Prolific_DriverInstaller_v1.10.0.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target PL2303_Prolific_DriverInstaller_v1.10.0.exe
- Size 3.1MB
- Sample260729-kr7bfsstcs
- SHA256 65a40058b09ec2f62c936406fa9f0bfafd765f3e072edec272cf789959fb216b
- MD5 2c5e5e7f0149c2dc3a708eb7697c8c32
- SHA1 00a8ee573f78ae624b344d1ee6fd85a1dae32fb2
- SHA512 5429f8b1b9652360b9eb61743125af0878fcaef6ffdd2218aa2b3dfe98f8a08889f3737414e3c1c3ebffd8618593cb41b2b0cccb04fcddc024cca03cdceac15c
- SSDEEP 49152:p50jOuiL/5LKqLhtbx/p/noQLhtT6/83Dfs5oWYBiCKhSOoSvbJU5s:pWjOpLhKqLhbpPoKhl6/837cPBKeUy
- TLSH T1B4E5E142BBEA816EF2B74A70E97B07B15BB5BC969E31811F7380B91C1C306A1D531B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 6648 ISBEW64.exe - Loads dropped DLL 12 IoCs
pid Process 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\ser2pl.inf_amd64_0634f445a8611d95.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ser2pl.inf_amd64_0634f445a8611d95\ser2pl.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ser2pl.inf_amd64_0634f445a8611d95\ser2pl64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ser2pl.inf_amd64_0634f445a8611d95\ser2pl.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e1c10c7e-ea29-5642-959e-e04f07c397ed}\SET8860.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{e1c10c7e-ea29-5642-959e-e04f07c397ed}\SET8871.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e1c10c7e-ea29-5642-959e-e04f07c397ed} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e1c10c7e-ea29-5642-959e-e04f07c397ed}\ser2pl64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e1c10c7e-ea29-5642-959e-e04f07c397ed}\SET8871.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e1c10c7e-ea29-5642-959e-e04f07c397ed}\ser2pl.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{e1c10c7e-ea29-5642-959e-e04f07c397ed}\SET8872.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{e1c10c7e-ea29-5642-959e-e04f07c397ed}\SET8860.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e1c10c7e-ea29-5642-959e-e04f07c397ed}\SET8872.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e1c10c7e-ea29-5642-959e-e04f07c397ed}\ser2pl.inf DrvInst.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_Setup.dll PL2303_Prolific_DriverInstaller_v1.10.0.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.inx PL2303_Prolific_DriverInstaller_v1.10.0.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information PL2303_Prolific_DriverInstaller_v1.10.0.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layo8488.rra PL2303_Prolific_DriverInstaller_v1.10.0.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.cab PL2303_Prolific_DriverInstaller_v1.10.0.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\ISSe84e6.rra PL2303_Prolific_DriverInstaller_v1.10.0.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu84f5.rra PL2303_Prolific_DriverInstaller_v1.10.0.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ini PL2303_Prolific_DriverInstaller_v1.10.0.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data8488.rra PL2303_Prolific_DriverInstaller_v1.10.0.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_Set84a7.rra PL2303_Prolific_DriverInstaller_v1.10.0.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\ISSetup.dll PL2303_Prolific_DriverInstaller_v1.10.0.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layout.bin PL2303_Prolific_DriverInstaller_v1.10.0.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.hdr PL2303_Prolific_DriverInstaller_v1.10.0.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu8497.rra PL2303_Prolific_DriverInstaller_v1.10.0.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.exe PL2303_Prolific_DriverInstaller_v1.10.0.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log PL2303_Prolific_DriverInstaller_v1.10.0.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PL2303_Prolific_DriverInstaller_v1.10.0.exe - Checks SCSI registry key(s) 3 TTPs 21 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000392849c4232396370000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801392849c40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101392849c4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3392849c400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6392849c400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ PL2303_Prolific_DriverInstaller_v1.10.0.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeBackupPrivilege 4696 vssvc.exe Token: SeRestorePrivilege 4696 vssvc.exe Token: SeAuditPrivilege 4696 vssvc.exe Token: SeBackupPrivilege 4744 srtasks.exe Token: SeRestorePrivilege 4744 srtasks.exe Token: SeSecurityPrivilege 4744 srtasks.exe Token: SeTakeOwnershipPrivilege 4744 srtasks.exe Token: SeBackupPrivilege 4744 srtasks.exe Token: SeRestorePrivilege 4744 srtasks.exe Token: SeSecurityPrivilege 4744 srtasks.exe Token: SeTakeOwnershipPrivilege 4744 srtasks.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1184 wrote to memory of 6648 1184 PL2303_Prolific_DriverInstaller_v1.10.0.exe 89 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PL2303_Prolific_DriverInstaller_v1.10.0.exe"C:\Users\Admin\AppData\Local\Temp\PL2303_Prolific_DriverInstaller_v1.10.0.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E5768808-A119-4CE9-810F-58AECE3AEEA4}2⤵
- Executes dropped EXE
PID:6648
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:4744
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{32731149-7f7a-2342-b8a9-5b1cc6a13be4}\ser2pl.inf" "9" "492f276df" "000000000000017C" "WinSta0\Default" "0000000000000130" "208" "C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\VISTA"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.cab
- Size 786KB
- SHA256 6d8f048d1a72407c2a1c5960cdfc183d4200de03612b6936284d1bf4206da556
- MD5 9b42eecca65a932f2b590aca846acd24
- SHA1 76c447dae373704c8c54c7bbebf51335435f52b6
- SHA512 5ef5e4676f2fd3f7dc387b1837a63f0f18c18781b0b18f446135d17734642ae42016543c8ea1a3338223dcf61d8bee82f824363735d55f0cb024bcc02838448c
- SSDEEP 24576:ThuiiTuiVuJk/59DBv4pvLY7Lhtbxgf1ip/noQS:VjOuiL/5LKqLhtbx/p/noQS
- TLSH T10B0523ABC06F420FC5155BB2F4C4E120249E7CE75667D83A2EA90B5A2E5C5BEC0BC1DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data8488.rra
- Size 15KB
- SHA256 37630157d710473111450014c44d3bde487cc1fbd781f761d3e876b65d939243
- MD5 b66fba04d5965d0f5f8e57186738213e
- SHA1 fcadcfb7074aa94c9308a54a6d2023a222ad298c
- SHA512 1389738291f67496cac2df4bf37db8fc3355065cb39b0b25cbe7c8bed94dad7dfa45ac0bc0c7f4adb67462d60d762db18609fb56e5554e6ef41bd32b5843ffda
- SSDEEP 192:TLr92mR4WQ2FAh7ZolgfE6Q6wAcKadH2LE+Nr2wPM:Z2m6WSMlpPj2RPPM
- TLSH T1927209259B12ABBFD84B87F21583179723E1D554E2658F4B090DFEA03C03AC1DC5A38D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layout.bin
- Size 473B
- SHA256 f3267c611644d9687c86a80e4b8062458642ec77b1c8b6a3c060f3f31f537420
- MD5 30c93734350d32c803c28103e8d4741a
- SHA1 1f756617949a4f2788c8e703a3b9f4a902f589ac
- SHA512 ba063f555706a9d5e3bb15583a0e16258c4086d45dd57e2ec5da25b821f08d382352ac44be87895b4de471e18606e544afb694c5a80ad153b3d3a0d826e302b3
- TLSH T1D9F0121B39179405C127D9770C7F455E1EF5BCE00423D6977281526F2D2DB08EE481B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu8497.rra
- Size 364KB
- SHA256 b7a82904d92b096cb6ab537365f9c7f24b1ecefaa6ea7974c24e8102b1746f4b
- MD5 6f58a1d8e7b031c6f2a60ba04d1a0b7d
- SHA1 64ced7781de492d15f0d443faffd2d0244b43e56
- SHA512 81371904cbe4dd5062e9ede60c3a0429adcd8c7b62dcb5f45b122280d2e3fb5d1ddd4b0f109d972b919e67cde99636cdd952082cd74b567769211ea389a89912
- SSDEEP 6144:DWWcGK4EDyGaLquWkVAJvRmiaPd+avl+LwedJ:DWvy2gq7TFDwe3
- TLSH T147849D12FF98D0B2D34304B0977E5BB7FAB895A64A20458BA3D49D1C2871993D933F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ini
- Size 584B
- SHA256 acd647a986c6a330dea772db68ce0bcd159019c9fa2257bac93ffa52d1728d71
- MD5 40fa89ba0e66e126582bf65b8f1eea70
- SHA1 6fc59e3f29c3ef97869772c624778f5f9aa35f84
- SHA512 da7b43644541d9c435a9110c5acaadb58e4745781457a527140e9bfd635d927ccb32b04f2da2e00b0ec3051a6f9d7bd15ce876657aa4abe634e310a091ba3a2d
- TLSH T122F020FBA608483E384E0B7A75782500ABE22D151014CAC8C3C40E2F5FAAF05FE2D617
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\ISBEW64.exe
- Size 117KB
- SHA256 e1890e4ef7fe9c2242e1fa65da8162687c893d1a025fef254b827940d03a0d5a
- MD5 8407fc98ee367ccb196894f7cd218792
- SHA1 6f280cf374fba172426b8912170b5cbafe3d88cd
- SHA512 5850b48b374cb243d6eacf011f11e31050ff04118939424804a62e52da335cea6a7ea8dc363d49895ea29929b518c69dccc8320074693e7b50540580d477956c
- SSDEEP 3072:ZgyMOStu/g4jBxwjFeGsny2OZCDgePoWLMZn:ZdMOStu1UFBIcCsTlF
- TLSH T1D1C3399272D444F6D166927989D24782E7B2F8644B7023CF6360A36E1F3B7D96E3D320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\DIFxData.ini
- Size 86B
- SHA256 1b9fd5c1f18357bd459be20bfcbf47ee18fa0c5d5cc42f6aed2705d5868b65f4
- MD5 10baa5b67536f4433f37534b9c8bb828
- SHA1 82e5c34b1279afda223b639b49078d03c52875f5
- SHA512 49c6798ebb3b6137cafb78b88350d02094367523dcf8f9e580de1941e514b8b3df786d1d817090e5dab80ac4d0d015796b2ce28b296db31d111e0d0bbaeebb37
- TLSH T18DA0017783B9E720655448C3FF2C3047BAA5247041204F7262550BC3D87AE53D82F0D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\FontData.ini
- Size 39B
- SHA256 766ee687d90b0217eb41cb85aca04375bdc24db986a33536631f864b7ce1a08a
- MD5 00f313e3e007599349a0c4d81c7807c4
- SHA1 f0171f15aab836a1979d3833e46b5e59e4ea32e0
- SHA512 8bb25a62c0b1640dec36403a493ed54c05f7cde7b7357c8faea785a79c4b76bbe6a3d6fe78db52b558a37abac90c2b2e8b13868a76294554d51670e9fa8764ad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\SetupEx.dll
- Size 72KB
- SHA256 f2d5c657dde8e9843a8f4d76683e2bada5dfe1e80cf42b41f990fa40f25df53c
- MD5 7f1fae154765b445edc9347df7f3fbde
- SHA1 e63af8015309627325f47e32711a006825f213a8
- SHA512 7c4dd1038139a84e329018523e2915db3c5f66710f418de4aebdeccc80e934cf1f05072faf788f8580198130605194960a9fe70404f9e9a10fb8b2d747e5f4e9
- SSDEEP 768:0a5oSoaTq463RM7Fb+wiW67DrRfirjIvr1yyrmi6op2TUo7tO50dQE4:0qoSov4sMUV0ccWqonUto0dQJ
- TLSH T136735C147C43C0B3F0054535928587D25FBE7D133BEAA0AFFF86064989A12DA76BA6F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Vista\ser2pl.inf
- Size 2KB
- SHA256 b096f6832226d21bf65afdbc082c152e12485a22dd9050380ce477dc261e9f76
- MD5 72038c8108d56a278ea4fb77b57bf1b3
- SHA1 ab6d071dd350cda1ee63ac9f5a7ade2743d6b571
- SHA512 935ce6552fe210f5c6e8f3304fef596f4d86cf1ae8529d461944ef6739e080abda136da0a3520d73fc50cad07d55d769adaea4e753317cc427706621f307bea5
- TLSH T11651054B12CE01F0479E72246B9B26D17BCB501610EB19D7B7CC592987E8F0CB727AC8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_ISUser.dll
- Size 16KB
- SHA256 5b84902b90b74343f340237b559fb3f19c1707c1940c0b1e805d0182a2082a6f
- MD5 08c204d48be7753907612b929c38ef30
- SHA1 5f29f1014169758c65834a7e13e325d1f701c874
- SHA512 a419a3259aadccef885ba3979bb09cbb88c18a35c90092ff497d6e19ebe93c224923e705984a8c3703bee1444cedf2d43190d42d884c089e5f34fc378b99ffa8
- SSDEEP 48:KabKnVeDoEZgFjcgNhh3+Wc/wT2M6SpRK0rWaTHzAjqwB0kbBY7U4:5bKVdEZgZNadMJrJTTsqO0kbM
- TLSH T113722F5573E899A8E0BC1B31C8B70BF54C767C258278DB1E62A17B4F5C307A09D25BA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_IsRes.dll
- Size 123KB
- SHA256 ed38584275b7248ce51254bc34fbe247af641c416660342689d19e6559623b13
- MD5 898515a4ae2fb9d74ae2a905cf82b074
- SHA1 ed751342f4bbd131de393975e08019ea56355107
- SHA512 35ab0a7082cbfd90324748b539b521791ea644eeddb6042f3a47e4d98eb22721d133442acb1b33a4c90fd72a560892ab2978c29edebe94e443a13c6116f17ebd
- SSDEEP 3072:s83QrkoRy7Jd1uhBuQJfBtuxX8fT6xOzWv90tJOjp:zQrkoRY1AJfBtuyfT6Sltgjp
- TLSH T1B7C30183C7D81912E5DE8E3702A7DE561E25F898311D6F2B0324DB9EFC64323BD9845A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\isrt.dll
- Size 216KB
- SHA256 d6cd68fa4468878d8bc045ea518235f7c6cbebbd525486ddcec7d1069d83f119
- MD5 77a3125a2059f39a9bef961953a8db8d
- SHA1 2ffb52f60c570d1d73caab095f3784dc8454e5e6
- SHA512 00863cb19420f4764ab0f71ae0d788e22ad340d9f7aa074bda2f8fd8317012567e46335802fdfc800f671c22c1e74618819613c4adb6adeeaa2e74cd66401605
- SSDEEP 6144:K2JzhXV/n+DE5wVRvnEKGuQEO//q68KL2Hk:K2JBYE5mRvZGDB//AM2E
- TLSH T178241277B1E0D15DE0C703F265D9D40215F9A8E1AEB3C0902BAD0BFD0EC99662F259E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5806E6A6-BBE3-42AA-952C-B8D23A201D91}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.inx
- Size 224KB
- SHA256 e27bc4c62155a2c85b89eead20db41b035bb90abb78999fc67bfe8981e68f13f
- MD5 028831fbf25a190aaac8ab417e22bb44
- SHA1 72b46c840604676526a1ba441c7cc05842c94d4d
- SHA512 1846df654e18e33b2f991e84889851da11e16286441eb8cd539e1577ffbe17679ac7073ea6cdb8eea001cd04d81084acf713c2499d484a5912955324e251225a
- SSDEEP 3072:j7wba89b0xvKY5fQQaUs6Tdwxo1ZAdff7iz/X6FpBWejvTN72mlTP04CgMWfY04m:j7qB0CYtdUbNj792+TPUoJKYMyx
- TLSH T19924BFAC49960F8E77388EDAF42708D035C6EC5DE1A44297A3A2C5D1CF794FA41ED18A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5806E~1\{ECC37~1\Vista\ser2pl.cat
- Size 8KB
- SHA256 cd3d3c039077a62edbdbbe02d905afe06e6af6446ba8500220727c1696328581
- MD5 150513439c3bd8fe751f0ab035cc885e
- SHA1 097c5a91975a842e27ec9829f2b93fd630868a2a
- SHA512 265942652bb3a1be634e58d028489d29438ec74b4a7f3bee0ce331067d967afc3f86bcca25126620b958b523c3be167216f371cbc68615099735b8c4dfc190ba
- SSDEEP 192:BwenT25ECw2V20YtfeT/R8X09+3Ef5KYpBjSAXrzC:e1wCYtfeTKXM+3Ef5dpBjhXrm
- TLSH T17E0229A689BC5182F887AC7093D5E947BC39E7C7AC008A3961AEA79859833E0F31451D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5806E~1\{ECC37~1\Vista\ser2pl64.sys
- Size 166KB
- SHA256 4ba0c0370f0c13aadbae9724660f13210554b0b84c405494521502c2f6def27e
- MD5 d666ebec6374b2018cf61ee204c3cf50
- SHA1 e4c95047ebcd5abd599eea2401c4118d82af98f0
- SHA512 a2c8e5546f9c9b1da9839765bd380462d6d506f55b7aee23b2ea5edc5e7e153bf00cbb41abfa282b10d61c0f9e8c88fa04effafe774bfa7ce21d77401a7a7076
- SSDEEP 3072:/rnUOg9vZbWMfuferSAlux9EinpTdqBiteDknUBKJwAYy+5SZDJCASa:/TUOmbWKeeeWu/npw
- TLSH T14DF33A86525A04B9C5BFE1BD865606B3FAF2B85D07269BD30F9849094B017F4F7383CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{C6CB96BE-9B67-47B2-AD4B-D7A5A48D88A2}\Disk1\ISSetup.dll
- Size 523KB
- SHA256 13223e7fbeb3dac968de77e6be974a36f86dc07884cc0e80eabf8b817ccb4a04
- MD5 6c48e05107eb494620ab0dc96d3c5b80
- SHA1 e6ced277de082bd8e2ccbfad7a1d5cd1e9db85ab
- SHA512 983e3d3012114af3da009c5d46ce467c7a9c6023766b54afe58137654bb5a1c1eda2fd1ff4b1902102e8315b80557efa58dbcf01641dde07924285bd015a196a
- SSDEEP 12288:JyF3SrUVaX7zyCyHHjDLLhSuZhqVSNlw8XkMgrNG:JyF3Sr0aiC4vhSOhGSvbxgrA
- TLSH T12EB4D082FB86C9A3C44C4532981B53F64FB0AC96AE13B31737987B6DBD73381BA42154
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{C6CB96BE-9B67-47B2-AD4B-D7A5A48D88A2}\_Setup.dll
- Size 324KB
- SHA256 0f5f4e003f4666ddc29a6cdd640a7d3b59687de1ccc54ad0dd30f1b701d7eb6a
- MD5 200bede8248e5b0b238b8d2c89b92aaf
- SHA1 916a9d3bbf46a808dec38e66b059e21edd9f8fb5
- SHA512 6797d64b2f4601b74b7b52e130fae7a83c0cd85654bf3de6bb41ce3f08425cc9688e6b3075510147a97e100939ee899bf6fbddc7e86f533fdd8f098369be5632
- SSDEEP 3072:Nb9YfMX0E9QsJB9cWe7Ka2coNfCp5CKjGdwizJQpAPbK8nIi0nn4QfnmwfVCD4rT:NKlua8NfCp5C9dwE5X0zCGn
- TLSH T19D642E41A7FE424EF6F7AF30ECB50AA04EA67D96AE34C12D3641751C1834BA0D971B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{C6CB96BE-9B67-47B2-AD4B-D7A5A48D88A2}\setup.ini
- Size 510B
- SHA256 e84f9a13e50ffb019c8735dcc382b161f9e09e405ec801e590bc135c1d2314a9
- MD5 6a7f38f2d73edf41645a3861920288f4
- SHA1 565ca86bb8574dd292a2e956f30883dd97e9da3a
- SHA512 a93e98afbca954b7e8c50784bbdea3dc8fe2ce04e1c79a0a4bccc3b1c254ccab2c1e7616b4b90330b6599d7819205f0c282f670893e4cc107f7e3af53d1366ce
- TLSH T1C4F00EFB5608043E38490B6974381600ABD12D190004C9C4C3C81D1A5EAAB04FE2D116
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\ser2pl.inf_amd64_0634f445a8611d95.ini
- Size 414B
- SHA256 ffe02364e11894335df60e560d66fcd4d4f2d95bbbf1a991d07c64d0e8258676
- MD5 d86325e36a1546f4258a1b92818797fa
- SHA1 a304c8c7719e5031a3dc40b07d54de02eef84cd6
- SHA512 f274e8abe7ca420bd6acfd65700159ea7887c9bc634f1d22797aeaee26e1fb9f01aff4ea9e078870325e9093af3522a0e4ea57fb1e06600d157971a7eef03626
- TLSH T1F4E0AB03A5BE8EA954405722636F248ED016B08F4A0236C3F3A09A905F524234D98EA3
- MD5 SHA1 SHA512 TLSH