710006fa07ec3a5f06c5cc4023349eb5064067ddfa60dc6c406eb739023a3ccd

General

Target
Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
Size 87KB
Sample260809-d9qyvsgr3w
SHA256 710006fa07ec3a5f06c5cc4023349eb5064067ddfa60dc6c406eb739023a3ccd
MD5 e9bc6423c7c862600abf57160227e1c4
SHA1 322b2c717b7d73765c67911f1b45e812bc1d988d
SHA512 12f7d5bab8d70c3615e512388fc9179048cb13b59134d93950117bbe3ea866740afd5bc5e5911276d9bdd131be62364f3869effa3da272fabde8fdcd61c248f7
SSDEEP 1536:bferrLkSRoe8C4UZsys0Dh1duH4Romu/TqOW9uL7010n6BBXQ+zoAiV+YPIEFI+k:bfi3k+oWDBDh1duH45PRq70+n6XPoAvT
TLSH
T13793E011F7A0C477D6B61731683B27F75FBAA8250290EB0303607F6D7CA2641A92F7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3088	starter.exe

Loads dropped DLL 4 IoCs

pid	Process
4860	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
4860	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
4860	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
4860	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	starter.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000024589-31.dat	nsis_installer_1
behavioral1/files/0x0008000000024589-31.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{33539F52-D597-409B-8CE2-42D96423DFB0}	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2028	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3088	4860	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe	93

C:\Users\Admin\AppData\Local\Temp\Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
"C:\Users\Admin\AppData\Local\Temp\Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\nso8029.tmp\starter.exe
  "C:\Users\Admin\AppData\Local\Temp\nso8029.tmp\starter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3088

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8029.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
TLSH
T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8029.tmp\NSISdl.dll
Size 15KB
SHA256 aab28914794a1cdda4561e9f2af3e006dbed220d9d6bfe049b56d0cb9b783648
MD5 05f72d6a944e701217ef2eb2cc13e0ee
SHA1 fac99c39150ae484e4b3e0af2f4be86bb1835dde
SHA512 c87e783fc169ef01ac0d3ce29fbfbf349a2e22329df9203a1443cc2caebbe7f8282c0754740289ecca534951cb7e574bafef9ccbaa0da7c287109920ec9573eb
SSDEEP 384:hRy180+1ygVaLfKgcIno1gEBWZwCUKihb:hRy180+HSegEBWyQih
TLSH
T185623C46AA2084F1DBA2167034D33E3A67F18E751A2484C247F35D4FAE16317B37A986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8029.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8029.tmp\nsDialogs.dll
Size 9KB
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

starter.exe

Path C:\Users\Admin\AppData\Local\Temp\nso8029.tmp\starter.exe
Size 10.9MB
SHA256 5765099204e5d6c7c731f293166e78b2f268fc52c3e930ce4e45f323fdd1c3c8
MD5 860614fe1264b88fb4b4602e34d57878
SHA1 ec8545df0113aa58cc1f7d6ff8dfb8c123e72682
SHA512 eb8abae845cc1fb876eaebdfce45ffdfff2fe0b2b57f3824b3c7b988a620c4ff3a374af2bc99b7b302fe1cfb393e6da4a32eb06315e7733e88357453a4143595
SSDEEP 196608:PCIOBrTLhPpUCyjDgJtBeVnnBRF2bGq78yBPx28lxrtVzUZR7HxxteCbRhqB3aD:K7qt0JtBCnn4j5xxtfUZZxxcCbRhkqD
TLSH
T138B633A8C416FF96FE2200B500DE5F49FD77EB8848BD9D327E8054EB09561F9A832257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads