Overview
overview
7Static
static
3TH-9800 Eng 2.0.7.exe
windows10-2004-x64
7TH-9800 Eng 2.0.7.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$SYSDIR/Msflxgrd.dll
windows10-2004-x64
3$SYSDIR/Msflxgrd.dll
windows11-ltsc_2024-x64
3PL2303.exe
windows10-2004-x64
7PL2303.exe
windows11-ltsc_2024-x64
7Program.exe
windows10-2004-x64
3Program.exe
windows11-ltsc_2024-x64
3uninst.exe
windows10-2004-x64
7uninst.exe
windows11-ltsc_2024-x64
7Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 12:25
Behavioral task
behavioral1
Sample
TH-9800 Eng 2.0.7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
TH-9800 Eng 2.0.7.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$SYSDIR/Msflxgrd.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$SYSDIR/Msflxgrd.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
PL2303.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral8
Sample
PL2303.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral9
Sample
Program.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
Program.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
uninst.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target PL2303.exe
- Size 3.0MB
- Sample260808-plvgxsde28
- SHA256 eb626a166f99624c12981cc5a18737af79be0441e1a4a196b587749e9e97bea2
- MD5 cc91df1e443c98642a05db93cf4e35b7
- SHA1 7480b372788aff4d2306cfa3e7d3193a5f055268
- SHA512 4bcc8cd54bb5530c6c9bae77fbc23f21fb90ae23c74b9f1a479b9a94b08c8599a09e9b50db2b86afa9d22b65e30743f2fcc040c531e4d68ac8780b375e1e147e
- SSDEEP 49152:c5jjOui0/5LKqLhtbx/p/noQOhtm683DfNbCWYBiCKhSOoSvbJ/50ZS:cZjOp0hKqLhbpPojhM683795BKe/0S
- TLSH T16EE5E002BBEA816EF2B74A70E97B07B15BB5BC969E31811F7384B91C1C306A1D531B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5320 ISBEW64.exe - Loads dropped DLL 10 IoCs
pid Process 4136 PL2303.exe 4136 PL2303.exe 4136 PL2303.exe 4136 PL2303.exe 4136 PL2303.exe 4136 PL2303.exe 4136 PL2303.exe 4136 PL2303.exe 4136 PL2303.exe 4136 PL2303.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 20 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{140c6396-7068-a24f-93e5-1011d631a8b5}\SETD6E0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ser2pl.inf_amd64_5a6c8d63ecc6dc7f\ser2pl64.sys DrvInst.exe File created C:\Windows\SysWOW64\SER9d3c1.rra PL2303.exe File created C:\Windows\System32\DriverStore\Temp\{140c6396-7068-a24f-93e5-1011d631a8b5}\SETD6CE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{140c6396-7068-a24f-93e5-1011d631a8b5}\SETD6E0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{140c6396-7068-a24f-93e5-1011d631a8b5}\ser2pl.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ser2pl.inf_amd64_5a6c8d63ecc6dc7f.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ser2pl.inf_amd64_5a6c8d63ecc6dc7f\ser2pl.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\SER9PL.sys PL2303.exe File opened for modification C:\Windows\SysWOW64\SERSPL.VXD PL2303.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{140c6396-7068-a24f-93e5-1011d631a8b5}\ser2pl64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ser2pl.inf_amd64_5a6c8d63ecc6dc7f\ser2pl.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{140c6396-7068-a24f-93e5-1011d631a8b5}\SETD6DF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{140c6396-7068-a24f-93e5-1011d631a8b5}\SETD6DF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{140c6396-7068-a24f-93e5-1011d631a8b5} DrvInst.exe File created C:\Windows\SysWOW64\SERSd3c1.rra PL2303.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{140c6396-7068-a24f-93e5-1011d631a8b5}\SETD6CE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{140c6396-7068-a24f-93e5-1011d631a8b5}\ser2pl.cat DrvInst.exe - Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layod344.rra PL2303.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information PL2303.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layout.bin PL2303.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\datad373.rra PL2303.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\ISSed3b1.rra PL2303.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\ISSetup.dll PL2303.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setud3b1.rra PL2303.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setud3c1.rra PL2303.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setud383.rra PL2303.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_Setd383.rra PL2303.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_Setup.dll PL2303.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.hdr PL2303.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.cab PL2303.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.exe PL2303.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.inx PL2303.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ini PL2303.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\SERWd3d1.rra PL2303.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\SERSd3c1.rra PL2303.exe File opened for modification C:\Windows\inf\SERSPL.INF PL2303.exe File opened for modification C:\Windows\inf\SERWPL.INF PL2303.exe File opened for modification C:\Windows\INF\setupapi.dev.log PL2303.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PL2303.exe - Checks SCSI registry key(s) 3 TTPs 21 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fab76c52da068360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fab76c50000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fab76c5000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fab76c500000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fab76c500000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ PL2303.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeBackupPrivilege 4144 vssvc.exe Token: SeRestorePrivilege 4144 vssvc.exe Token: SeAuditPrivilege 4144 vssvc.exe Token: SeBackupPrivilege 1396 srtasks.exe Token: SeRestorePrivilege 1396 srtasks.exe Token: SeSecurityPrivilege 1396 srtasks.exe Token: SeTakeOwnershipPrivilege 1396 srtasks.exe Token: SeBackupPrivilege 1396 srtasks.exe Token: SeRestorePrivilege 1396 srtasks.exe Token: SeSecurityPrivilege 1396 srtasks.exe Token: SeTakeOwnershipPrivilege 1396 srtasks.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4136 wrote to memory of 5320 4136 PL2303.exe 89 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PL2303.exe"C:\Users\Admin\AppData\Local\Temp\PL2303.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{457541BC-0067-4F03-8F23-C2CFB487D446}2⤵
- Executes dropped EXE
PID:5320
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1773522b-dba5-7a42-b8cb-b70c138fd2c2}\ser2pl.inf" "9" "4611715d3" "0000000000000198" "WinSta0\Default" "0000000000000114" "208" "C:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\VISTA"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4456
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.cab
- Size 777KB
- SHA256 e8b9d25af536fcd02e3f601f500ee11c643e3c60471c6a2aa64184a8532d8774
- MD5 e8339a38634e571d73d5b4ff1d48fb90
- SHA1 249a33ce02d6fbfa7eba000ad77a068e07cb7672
- SHA512 e40bfc613667a8dfc33eb55d89f28645030bda1f682047858716fef0c4b923da7e4b245f1534fdd9ce7c42eeb08391cacea49978736ec22c2e1fac731023f44a
- SSDEEP 24576:MMuiiTuiVvJk/59DBv4pvLY7Lhtbxgf1ip/noQS:pjOui0/5LKqLhtbx/p/noQS
- TLSH T1C60523AFC0AF820BD8155AB2F484F120109F7CE756A7C82A5EA51B493E5C17BC1BD1DE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\datad373.rra
- Size 15KB
- SHA256 225fc32d4cfe43eff8e2f23b0f68031ff3bc4a18d5ede0d2d38acc89c9dea618
- MD5 788136d9a27ec82f3ac7d5cdafb88f1f
- SHA1 da6348dbd67ff85b26e6a889cdc4ee45f02b9c1b
- SHA512 2fe728ffb5c4875dc4cd310f8927d4a2fbd108a761156ac670f63d3e00c7ed9649e9a254d484e93cc7f3cd9f832ac9ed72c6e926ffd8099100801be57185f4cb
- SSDEEP 192:3h30lThWQ2FAh7ZomHafEJfeffeffeffezD5pgCM0HqcvoLdL2gPG:RaWSMmHhKKKAD5K3Bp2gPG
- TLSH T14D722C259B22AB7FD84B97F621831B9323E1D154E2A58E9B0518FDE03C02BC1DC5A38D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layout.bin
- Size 473B
- SHA256 7401b4607509ef46b6300f2ca6e89415c4946a5f832f727711dce22b8b7162ec
- MD5 53a379987cd103e49f3006f7a47cae9e
- SHA1 55e1fdd3a162d7e4722e66b1f72621698986196f
- SHA512 d6b51648607ab4f0e32baf5542bc43085d18078b77844f40db3283c5c37ffec2a7ed831491193e6d24ec04b9cdac9d98bfaf3e3de78ecc52d49ebbce256427a6
- TLSH T19CF0121B38179405C127D9770C7F555E1EF5BCE00422E6977281627F2C3E708EE481B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setud383.rra
- Size 364KB
- SHA256 b7a82904d92b096cb6ab537365f9c7f24b1ecefaa6ea7974c24e8102b1746f4b
- MD5 6f58a1d8e7b031c6f2a60ba04d1a0b7d
- SHA1 64ced7781de492d15f0d443faffd2d0244b43e56
- SHA512 81371904cbe4dd5062e9ede60c3a0429adcd8c7b62dcb5f45b122280d2e3fb5d1ddd4b0f109d972b919e67cde99636cdd952082cd74b567769211ea389a89912
- SSDEEP 6144:DWWcGK4EDyGaLquWkVAJvRmiaPd+avl+LwedJ:DWvy2gq7TFDwe3
- TLSH T147849D12FF98D0B2D34304B0977E5BB7FAB895A64A20458BA3D49D1C2871993D933F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ini
- Size 602B
- SHA256 6ba02f6eab7c43fb2001b7028030514621e2d62bbd8a1bed03525f11228c6f56
- MD5 56eef69d73122cc3493967e915f84441
- SHA1 4d3b8dca40325b704542ca28a9226ed0d2c003ab
- SHA512 b8f8245b3ab1407cde2902a5346c2d562bd3c197b72cf9baabc5b171c172af2cda6169a1e4c40998c812de6cf32ae34d55c4f184f0901833ee2177e9ba0cedde
- TLSH T160F041FBE708042E380A0B6E313912009BD12D181024CBC8C3C50D1B6F9AF04FD1D617
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{3F76EB0B-4195-4341-AAD5-3BC4B31228F7}\Disk1\ISSetup.dll
- Size 523KB
- SHA256 13223e7fbeb3dac968de77e6be974a36f86dc07884cc0e80eabf8b817ccb4a04
- MD5 6c48e05107eb494620ab0dc96d3c5b80
- SHA1 e6ced277de082bd8e2ccbfad7a1d5cd1e9db85ab
- SHA512 983e3d3012114af3da009c5d46ce467c7a9c6023766b54afe58137654bb5a1c1eda2fd1ff4b1902102e8315b80557efa58dbcf01641dde07924285bd015a196a
- SSDEEP 12288:JyF3SrUVaX7zyCyHHjDLLhSuZhqVSNlw8XkMgrNG:JyF3Sr0aiC4vhSOhGSvbxgrA
- TLSH T12EB4D082FB86C9A3C44C4532981B53F64FB0AC96AE13B31737987B6DBD73381BA42154
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{3F76EB0B-4195-4341-AAD5-3BC4B31228F7}\_Setup.dll
- Size 324KB
- SHA256 0f5f4e003f4666ddc29a6cdd640a7d3b59687de1ccc54ad0dd30f1b701d7eb6a
- MD5 200bede8248e5b0b238b8d2c89b92aaf
- SHA1 916a9d3bbf46a808dec38e66b059e21edd9f8fb5
- SHA512 6797d64b2f4601b74b7b52e130fae7a83c0cd85654bf3de6bb41ce3f08425cc9688e6b3075510147a97e100939ee899bf6fbddc7e86f533fdd8f098369be5632
- SSDEEP 3072:Nb9YfMX0E9QsJB9cWe7Ka2coNfCp5CKjGdwizJQpAPbK8nIi0nn4QfnmwfVCD4rT:NKlua8NfCp5C9dwE5X0zCGn
- TLSH T19D642E41A7FE424EF6F7AF30ECB50AA04EA67D96AE34C12D3641751C1834BA0D971B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{3F76EB0B-4195-4341-AAD5-3BC4B31228F7}\setup.ini
- Size 528B
- SHA256 ecf6410537565b5ae6f6ecbd4d6b2a759a156feab3209da32f5ff221857ff1e0
- MD5 4db2906cf7d2f45dac65517dae5434d2
- SHA1 99b81273fee9d100b8d801474ab81519c6541229
- SHA512 e4157107498c4f39ba8abe4f219bd9f691ac8acb96618873ddfd27c95b7296545bb889105c8b2de0892e8e0d48203751a26d1996921a63af2191faf1b719635d
- TLSH T12BF00EF7E74D142E38490B6971391610ABD13D190018CA94C3C91D1B6FAAF08FD5D527
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\ISBEW64.exe
- Size 117KB
- SHA256 e1890e4ef7fe9c2242e1fa65da8162687c893d1a025fef254b827940d03a0d5a
- MD5 8407fc98ee367ccb196894f7cd218792
- SHA1 6f280cf374fba172426b8912170b5cbafe3d88cd
- SHA512 5850b48b374cb243d6eacf011f11e31050ff04118939424804a62e52da335cea6a7ea8dc363d49895ea29929b518c69dccc8320074693e7b50540580d477956c
- SSDEEP 3072:ZgyMOStu/g4jBxwjFeGsny2OZCDgePoWLMZn:ZdMOStu1UFBIcCsTlF
- TLSH T1D1C3399272D444F6D166927989D24782E7B2F8644B7023CF6360A36E1F3B7D96E3D320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\DIFxData.ini
- Size 86B
- SHA256 1b9fd5c1f18357bd459be20bfcbf47ee18fa0c5d5cc42f6aed2705d5868b65f4
- MD5 10baa5b67536f4433f37534b9c8bb828
- SHA1 82e5c34b1279afda223b639b49078d03c52875f5
- SHA512 49c6798ebb3b6137cafb78b88350d02094367523dcf8f9e580de1941e514b8b3df786d1d817090e5dab80ac4d0d015796b2ce28b296db31d111e0d0bbaeebb37
- TLSH T18DA0017783B9E720655448C3FF2C3047BAA5247041204F7262550BC3D87AE53D82F0D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\FontData.ini
- Size 39B
- SHA256 766ee687d90b0217eb41cb85aca04375bdc24db986a33536631f864b7ce1a08a
- MD5 00f313e3e007599349a0c4d81c7807c4
- SHA1 f0171f15aab836a1979d3833e46b5e59e4ea32e0
- SHA512 8bb25a62c0b1640dec36403a493ed54c05f7cde7b7357c8faea785a79c4b76bbe6a3d6fe78db52b558a37abac90c2b2e8b13868a76294554d51670e9fa8764ad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\SetupEx.dll
- Size 72KB
- SHA256 f198f5f84bf93406c31d7b1765bd7d47ef8e44933f946211311e658d4e2a08b7
- MD5 b193567f9c305c820385781bbb18f999
- SHA1 121fc7d94e36d864e8c4f7165344fd1176b795e5
- SHA512 d61c5cd40df2ddedd932c60f34eeece322b8c48071c207b042f4b959a5f22c65d6c924e347812f13857190266c95b14db430025749d24b1180672fcc2a9a5e92
- SSDEEP 768:0ikhjbGjTi653RMgMb+wiW5HDu00wf9lmV8yrYptiWpozUo7tONAFW9mt:0LhjbGq6bMS+K0JAOWY3TUtEAF3
- TLSH T131736D14BC43C0B3F0150535928587D25FBE7D133BFAA0AFFF86064989A129976BA6F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Vista\ser2pl.inf
- Size 2KB
- SHA256 40531fedc2da61e7aaabee670cec9b88a1609b7c4726ee5d59a0482bf3a67b1c
- MD5 32e29a3a462a4939d464ee55e50d870c
- SHA1 1368c87dcbc1a47db78ad625b2c7e102af9f447f
- SHA512 377ac47edb50ecb5625ed50c64b3ecdc794c4bbe51cc372b7d5d1e8fd6611c2adaddf21794aa410d82e76e47abdd112dc2b6d89ec9c31572ff0720061d6b5184
- TLSH T14C51E24B02CF01F0479E72246B9F26D27B8A501640EB1597B7CD592947E8F0CAB16AC8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_IsRes.dll
- Size 123KB
- SHA256 ed38584275b7248ce51254bc34fbe247af641c416660342689d19e6559623b13
- MD5 898515a4ae2fb9d74ae2a905cf82b074
- SHA1 ed751342f4bbd131de393975e08019ea56355107
- SHA512 35ab0a7082cbfd90324748b539b521791ea644eeddb6042f3a47e4d98eb22721d133442acb1b33a4c90fd72a560892ab2978c29edebe94e443a13c6116f17ebd
- SSDEEP 3072:s83QrkoRy7Jd1uhBuQJfBtuxX8fT6xOzWv90tJOjp:zQrkoRY1AJfBtuyfT6Sltgjp
- TLSH T1B7C30183C7D81912E5DE8E3702A7DE561E25F898311D6F2B0324DB9EFC64323BD9845A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\isrt.dll
- Size 216KB
- SHA256 d6cd68fa4468878d8bc045ea518235f7c6cbebbd525486ddcec7d1069d83f119
- MD5 77a3125a2059f39a9bef961953a8db8d
- SHA1 2ffb52f60c570d1d73caab095f3784dc8454e5e6
- SHA512 00863cb19420f4764ab0f71ae0d788e22ad340d9f7aa074bda2f8fd8317012567e46335802fdfc800f671c22c1e74618819613c4adb6adeeaa2e74cd66401605
- SSDEEP 6144:K2JzhXV/n+DE5wVRvnEKGuQEO//q68KL2Hk:K2JBYE5mRvZGDB//AM2E
- TLSH T178241277B1E0D15DE0C703F265D9D40215F9A8E1AEB3C0902BAD0BFD0EC99662F259E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CB393F6B-C9D9-428A-90C5-4DC4314AC0AB}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.inx
- Size 224KB
- SHA256 db6abae1ab85383a78008560045697085adc7b79ddc6139fd5b6f60bafc3558b
- MD5 693c4b22a332d51acca2fe1ae31a1d24
- SHA1 c8b46dab34431d0d945d49dbc06925ea9509c325
- SHA512 a45edeb79912cfbc0828349e1825fe050aa869e4ea9979011da73bd6f6d4a783cc4d85c5d565e3386143c2487df1c215bb12b8c9403a07b9d4483028f1e60749
- SSDEEP 3072:jHwnoiw6oF27wrk0h0Q0Nn4nT9PgLQwOyieR6us0Bdb05hRtWDGIfwth1rcdGvjA:jHCo1YwpPc6+0LRIQJEB+65
- TLSH T17324BFA84D920FCAB7288ADAF83708D036C6EC4DE1A55697D3F2C5A4CF754FA50DC096
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CB393~1\{ECC37~1\Vista\ser2pl.cat
- Size 7KB
- SHA256 9f9b8540485c2282890e131051c5179441734cc4a413caa838d2726272be84ca
- MD5 ef7fe770b4e33380e48119b265306db5
- SHA1 033e00908a66977ebd49a7edc8d24de05c594de6
- SHA512 f0aaba5f9016e67377d63c30cf23bd5392f2e3f4a8b7ca1351f331f9aab365f9653c172bdcb451d8a1c39cf0744fd3677e422ac303eed4f7e19b6d3073d549c8
- SSDEEP 192:WVe+UKp/+2EECwn3hjXHUz1TrJj3EpLHQQrqz1Ns:WsL46wxjXHUX4yQOz1K
- TLSH T195F1E8A64A6D8083ED1AECF063E8F95BBC35EBC75801993D215BF79408523D1B75882D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CB393~1\{ECC37~1\Vista\ser2pl64.sys
- Size 95KB
- SHA256 7f8559b06a2e8fc35f71a099f320a87bb90fc9783133c19f49046f06ecbc9605
- MD5 9f6490423ac3271e84a90a0dd9d30a3b
- SHA1 97ccfaac06e310faeaf05c6207ece4fd04d6bf6e
- SHA512 1468d689d23a6e634c9c6bdab7f1e331b1d58ebda7a2aac0290bc167b1931ede0f00b4cc832a120643af014c51b66312873bc3365cfac6f9ad22f5022570db97
- SSDEEP 1536:9/JrSqXJUVQnmTfdvTtMPlw2f6alFrdq8IBb/3eDTgU8zBwAYyv5SZDuubTHv2vT:9g56mx4w6dq8geDTgU8zBwAYyv5SZD1a
- TLSH T1BD931B8A025904EDC47BD1BCD6610223FBF0F45A4B7997DB0B68494A1B537E4AF383DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\ser2pl.inf_amd64_5a6c8d63ecc6dc7f.ini
- Size 413B
- SHA256 fbfd79458b7d1f49af8c3e015135bfbeedf5f4aaf79bf3e69be173a33518d1d3
- MD5 c6dff61fbedc738b77aba2f6cc461821
- SHA1 96d56348539c0d18753b8fc63dd0694a6eef0980
- SHA512 5d6547ac62b1fe15f7207c7ed9fa061111a47f091260a1ceeb7a991c8e012b1882f576e57af95a1922d6c58435ad63dbf11973e98d55b2ebdb1b33fb914e307f
- TLSH T174E0AB8BB86A81CD88478446892B9434C02461DF160A3DEBB3C487802F9F897F955E91
- MD5 SHA1 SHA512 TLSH