Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
01-07-2024 06:03
General
-
Target
FastAimX64.exe
-
Size
36.9MB
-
MD5
132db3303d3b0cfbc12a578688c581fd
-
SHA1
198d5010e04c9ad0670c7a54a942cf4eba416aee
-
SHA256
7e190e48165cf7c72173ce84e0f0b164fbe794d3e45069408055ba7496da1497
-
SHA512
f2c2568745a46920453ba6b500e02e078bc4fc45264dbb3df8451b38524f2765465a4cdc6a70b61dce554c1d3b41c44b32934d9a1f8a87109a0223ae1af7ae57
-
SSDEEP
786432:FYpCWvC8TK4HxoCoZjzlBeTV+WreWniTuzVVqGlQdEon/x3Ol5IPEWz:FhWvC8wrJBmV1eWniTmVV9lcLx3u5I8M
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 6 IoCs
-
Drops file in Windows directory 30 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 43 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FastAimX64.exe"C:\Users\Admin\AppData\Local\Temp\FastAimX64.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MyApp\install_python.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\curl.execurl -L -o python-installer.exe https://www.python.org/ftp/python/3.10.9/python-3.10.9-amd64.exe3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\MyApp\python-installer.exepython-installer.exe /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=03⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{44BAE41B-50BF-47EE-9CF5-0FC8A8CA1D24}\.cr\python-installer.exe"C:\Windows\Temp\{44BAE41B-50BF-47EE-9CF5-0FC8A8CA1D24}\.cr\python-installer.exe" -burn.clean.room="C:\Program Files (x86)\MyApp\python-installer.exe" -burn.filehandle.attached=552 -burn.filehandle.self=560 /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=04⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{CBD32421-C4E1-480B-8A93-71CDA562A703}\.be\python-3.10.9-amd64.exe"C:\Windows\Temp\{CBD32421-C4E1-480B-8A93-71CDA562A703}\.be\python-3.10.9-amd64.exe" -q -burn.elevated BurnPipe.{26768FDA-BB6C-490F-AA6A-8FE6356765A2} {4832029F-7DA8-43FC-ABB1-3FD37D73F6D6} 13925⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdb9d09758,0x7ffdb9d09768,0x7ffdb9d097782⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e59c211.rbsFilesize
8KB
MD53edd3655aed75db0f393ae681680fd20
SHA19a9f7c51876962986b152d8fb0a947ff68c2c380
SHA256ef1fc15bc7bd68d817c3d60919ff129055a62bab30eae232b70a5bce1e0095cb
SHA512cd0cfb4dcf02d55e7174ce6ada8e1cb5aed3e3903e21041fc639d6e989f348a611a0480865bc3d50f792de9f741412a63de9c94c8a4b67b45a51308018fd1a49
-
C:\Config.Msi\e59c216.rbsFilesize
12KB
MD5c8d547c2b3c0fa6228a3bcbe6aef7e6d
SHA1646bf5131f4cf97f0e744a68e5a5b8b4d578794e
SHA256243515709a39a04c3464a3eb46e767a80797392ac871d53f564679e45e794e6c
SHA51292450a79588988f2a8f07e08a4e09848e59d3d7914397f9d6f33b20dcb782e9c00e9750df4494f6fb65dc0457374011d2bee626acfd191f94611acd8227b8277
-
C:\Config.Msi\e59c21b.rbsFilesize
40KB
MD5a7a03b030b9c462baaeeec83c3e7640a
SHA11c9a6c8588ffbc2e4a94191f5a33369006cf30e3
SHA256aad798bfb7ea082b786c45a3f23d178769132a54cb56b64a11c7f70664dc9198
SHA512d7f5c8cb56a8d13105f3569dbeff6fd409c0a6d02ff2ecab9fccc15a32b719950ab7e622852929064c6ed8088f0806582910bda0849d6f8acd5ee866dd3b5464
-
C:\Config.Msi\e59c220.rbsFilesize
179KB
MD5028147170997c3eab94aeec0403c5cca
SHA1cdc38ae7c27437245a80a55e08707f741db8f623
SHA256a0888673a903c51f0885b9d14786b1111eb8fba8915e4b72944bbd549f599d07
SHA512b81e1b3a71b1d8799b2929fde07adf4e93e3eaeadc1c817e21138f409068a5d68dd7d97587cf2b6f16c8e2c38881406705ac43a24eb797c34d0eb09ff1c60b91
-
C:\Config.Msi\e59c225.rbsFilesize
29KB
MD5bca3ed2f2967a3c83f663cb562a78197
SHA1681d39f16d05113273643f74d5da95ad9f1cd090
SHA256a19439d3589b469d88eb2dacdfa756b781c031a5bda1395ec50aca1849d36682
SHA512045fe9040f1899733f0e059e4ef05c854c881e6313a97d699d6feed757004a207e5e7ac78f13903a477af593e818b17c405022a8e274be2f39a2afa554ce2e26
-
C:\Program Files (x86)\MyApp\install_python.batFilesize
686B
MD5f30718a354e7cc104ea553ce5ae2d486
SHA13876134e6b92da57a49d868013ed35b5d946f8fd
SHA25694008c8135d149fecd29ca62aded487f0fbfa6af893596ffc3e4b621a0fe4966
SHA512601b2256ea709a885741f1dec5c97dda6fb7fd4e485b4afac3503af1aefe73472e5bc5529c144814a3defbc0b51ac4b50e02a50dccc69b41ee5d87a3f4282874
-
C:\Program Files (x86)\MyApp\python-installer.exeFilesize
27.6MB
MD5dce578fe177892488cadb6c34aea58ee
SHA1e562807ddd0bc8366d936ce72684ce2b6630e297
SHA256b8c707fb7a3a80f49af5a51c94f428525a3ad4331c7b9e3b2e321caf5cb56d7d
SHA5128858aa7e82ca8cf559eeb25c14d86d24637a86e64c8db7465c99d05558ce3c67cea18d68abdfbe3df08cdbedfca5f819aa7fd8e57beae2054a7f7a8a64c04b41
-
C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMeFilesize
8.0MB
MD50894766b66bc93a0494a5a7073042a42
SHA1ecda108f9f845c245d3e660fe075737ce7b1fb3c
SHA25682863adf2f36198611da2238991d9c8032c6cf59c3d2dd125658358b6672f3ce
SHA5123d1c9476e075eb2707e48cb957a0c428a467a3e6d84a31872bf6d88b8767006446ac2fa8c65194465301be9b25376343cd84db9ac729ad1b46c7727851dce5b1
-
C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMeFilesize
3.4MB
MD578e6e0e8b315a0d7448bf5cb6de7dc09
SHA16a73d7443c4d220736a2700e71e14b8e0e9a3518
SHA256eaf03e94a9f3421a69b9fd8a1f0723ebc4e59884f6c5b93f330d7fbc98d8940f
SHA5129666c116423a2574d20cab637d6501d283292d87518836d449d1752929ba60296e10b1335f277e4e2108cb06ea564be70022c1828d1f2e207e1b59326b3e6516
-
C:\Users\Admin\AppData\Local\Package Cache\{1F097B66-81E9-46FB-BBAC-315C5F50CF94}v3.10.9150.0\tools.msiFilesize
212KB
MD5b71361f364fb14a1983257ac93a1c9b7
SHA12209de01d5f1f3c3c1fdbbc2d7959631dfd1d2b5
SHA2560c32783b07c04ffb8a923ecd9c097061a693a9e882dfbb7cc9aedad7be486f76
SHA51296b1ce7e72b791aeaa113ec6157364a60862a6a5097c96dbb8a9d3ac717e978dc8e41b36cc1723dcaf2ded54e25c638f83fee7995921d3588d2a5c5b65051843
-
C:\Users\Admin\AppData\Local\Package Cache\{9802C929-A3F0-480D-A4B2-DAD129F2236E}v3.10.9150.0\core.msiFilesize
1.6MB
MD5c531b4b6d0c44f4f718302f94bdc0de5
SHA1f8a6d02012fad3b1f8cfaacca4eb6e068383bcee
SHA256107453ad1bb2d97c4947ba12d91738e7e7aa43470f9a8f954383fa6eb483b707
SHA5124b85223166679385b0bc788caa2a70052ee39e5ce8a775195e7a8803c9ba9f350a3a4f78d340b3f041e330396e587714d88a6d855e14c925bb73f9be0923beae
-
C:\Users\Admin\AppData\Local\Package Cache\{E2BC2EBD-7260-458B-A42C-3322DCB0B82F}v3.10.9150.0\dev.msiFilesize
300KB
MD581ee9f87cc68e3b0a376a51a0c8d5ea0
SHA187e6aa14efad2ca0e175b3d1a4b5b86c91c769cf
SHA256068163c992a1e372c8e23d69f8ad13e2a9e01be2649c9845d450aad5a7a6eff9
SHA512d5aa43bdd4ab2edf39750b8714351a2bca3c59766d7e8c57454062f49d5026f376ca40b531ca07ece23f609a7fa02a99b208a8680d20bc1bdbb92c521c825053
-
C:\Users\Admin\AppData\Local\Package Cache\{F115E5B8-9719-4BDF-8B0D-551809BB677D}v3.10.9150.0\exe.msiFilesize
608KB
MD5742a4d07c915d5883454e8e87ce61566
SHA16425542f956cf785ac0db084afe6d2ddcbbe2dbd
SHA2567a6715deb76123241816c77c6cc5dc4e6a881bb8de846c454f0d5cd833305cb2
SHA5126a5929985dfa1cc3580ca1bd94a94887b092693d976026fc866a9d99558b886b8454398c420d635dccf65f42639f37c3539196da2560482eb04857a4c393602c
-
C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_000_core_JustForMe.logFilesize
1KB
MD515423b56366f1813e74a29993344089d
SHA1fc47441a7fb8d755826c7e8c873bad89d61ee1e0
SHA25653b1dedb6b21bb0345d4f6aff37015f4d2e1e4707c378137ffaba95bf6d20d18
SHA5126439e638d9f88d3c0ea23ef75dd458b3980ac91ade04976ec08d3d6c587bb2ba492c9adec720e32262aba6ea89adaf065d32758a023eb6f6b40807acd162af0e
-
C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_001_exe_JustForMe.logFilesize
1KB
MD5e11fca81467c66b28bd29abfcf50de3f
SHA1ebc95e081a096537c12b1c6f82e8f4f898ba443b
SHA2567b2bc38f5abb49ca00bb9e036eb7a20f83d00a43e497a57dd2ad96aeee4dc036
SHA5127ca2956b3ebefcbda93dffe6f7d0c4abf66a24ef8ceef479fc10a9342fb5e5c9ab36a86a2e36225f15f2494d822632e6410c327044aa6d9f0d242b59b7d5b73c
-
C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_002_dev_JustForMe.logFilesize
1KB
MD521cfaebf1a1bbef59fc7aeb53eeee8f8
SHA109580ce46b191c90e0f95198cf02be03dffb044d
SHA256b0a5a74f5e70e37e876312b46f13dfd4c1374d320ec47c2310af9ae86ada38df
SHA512f66b8594e48f294cec883f338c44e1a0e3bad8599356cf4528b22557f352cd6a2594a527912724293f4f4bac26b26c681452f85f891d5bbc039d41112033130f
-
C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_003_lib_JustForMe.logFilesize
1KB
MD512a4a59f56136b137ebb651a0ffe17f4
SHA1bec0b504e3fda6c3ef9288890fdb74ebff78d7d4
SHA2569975c5bb6748d36a3e6aa7ed4ca35be63e0e32f2e7fab992f8d54a8b235d0288
SHA512b631f0b7781b222108058e766712cad0f69f4c560512081819905b137953108f18ca64e3cbe22ace05b81c3551eeb71253e9cb59149bead2476360ef304c46df
-
C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_004_tools_JustForMe.logFilesize
1KB
MD5fce89320654a468ed8e89a2752e5c339
SHA1923edbd877cf18cfb677e11c1d5dcfd3d2d13bff
SHA2565b862af57f18604c6ffd4d06e3534714e84f96bd3afd0a8d2ca07a9805031ded
SHA5122d204b7a535a10d6af46ee84bf4242ae37232e0db3f7b1eb7d677a68b08c5b3ab5b24dffdda47e68e12f41c2ff7e9d68411c4432f9ca674b2c6e2094148395cf
-
C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20240701060452_005_tcltk_JustForMe.logFilesize
1KB
MD5e7769632de57f3a7ffa9f2c69a552ffa
SHA163dce0b8bb46c9943f8835b6076be071f2b0d112
SHA2566d422f2f5f06028fdf584f1338cdb72882a49ad79c14c86ccf4befe002f901e1
SHA512a0ceaa2dde433bffe06f644b9fb7df6640761b185ea83ffebf797a96225de2651bb9976bb3f372af8e8a1d2333ba37ba66a0681559390bd57343f9e73bc8a207
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k4hblizl.n3z.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\Temp\{44BAE41B-50BF-47EE-9CF5-0FC8A8CA1D24}\.cr\python-installer.exeFilesize
849KB
MD5d988448411dc7548332378f7f61508a4
SHA134989539914256ea9f6d691236039d806be6f7ca
SHA256ae5f3d9aaf871d4cf62b3106a7babb66a5c52fdf5ea9b93467c45bd047319c66
SHA512eb631c340bebb6ce3a6100383fe5e5bd8d2b700ca2c9cd07c1bff4decb8b72a9223596786ef0e8040097135765d7af479f3bfa10957abba32143fc9c9b51ce97
-
C:\Windows\Temp\{CBD32421-C4E1-480B-8A93-71CDA562A703}\.ba\PythonBA.dllFilesize
650KB
MD564d1e3b44bfce17b6a43e9ca200bfaa2
SHA12617a95208a578c63653b76506b27e36a1ee6bba
SHA256c016025b6e3c1335eef8f544cb88a948d7c785fd5247b994c8ec91a4fce5f899
SHA512002fcb10e7aec037eee5acdbdc20719f10147917330f769943e4342d99a9596df5f09c039be5a8daa871062bf4c7263ae4d6582f971ced570c85abcbea87cc77
-
C:\Windows\Temp\{CBD32421-C4E1-480B-8A93-71CDA562A703}\.ba\SideBar.pngFilesize
50KB
MD5888eb713a0095756252058c9727e088a
SHA1c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA25679434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
SHA5127c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
-
C:\Windows\Temp\{CBD32421-C4E1-480B-8A93-71CDA562A703}\launcher_AllUsersFilesize
516KB
MD5a6d0b9692be2bb42031d8dd3293c6fed
SHA13de1ce4eb9df47d40639ec24d740dae74f58ba1d
SHA256d557952fdea4a50bd4901cf6152e17e46168fedb663080aaf438da80926921b7
SHA512df4e7b9a0fcff4f6b29e1184ffc18a8eebd010dd500402f8d5d6e61a8d011ef2ae82bcac86355142b4f292105f878938e6f3673d108925611650561aa08ccfb4
-
memory/4700-26-0x0000000006170000-0x00000000061BC000-memory.dmpFilesize
304KB
-
memory/4700-14-0x0000000005960000-0x00000000059C6000-memory.dmpFilesize
408KB
-
memory/4700-28-0x0000000007610000-0x0000000007C8A000-memory.dmpFilesize
6.5MB
-
memory/4700-27-0x0000000073AB0000-0x0000000074260000-memory.dmpFilesize
7.7MB
-
memory/4700-32-0x0000000073AB0000-0x0000000074260000-memory.dmpFilesize
7.7MB
-
memory/4700-25-0x0000000005940000-0x000000000595E000-memory.dmpFilesize
120KB
-
memory/4700-20-0x00000000059D0000-0x0000000005D24000-memory.dmpFilesize
3.3MB
-
memory/4700-29-0x0000000006420000-0x000000000643A000-memory.dmpFilesize
104KB
-
memory/4700-13-0x00000000058B0000-0x0000000005916000-memory.dmpFilesize
408KB
-
memory/4700-12-0x0000000005810000-0x0000000005832000-memory.dmpFilesize
136KB
-
memory/4700-11-0x00000000050B0000-0x00000000056D8000-memory.dmpFilesize
6.2MB
-
memory/4700-10-0x0000000073AB0000-0x0000000074260000-memory.dmpFilesize
7.7MB
-
memory/4700-9-0x0000000073AB0000-0x0000000074260000-memory.dmpFilesize
7.7MB
-
memory/4700-8-0x0000000002920000-0x0000000002956000-memory.dmpFilesize
216KB
-
memory/4700-7-0x0000000073ABE000-0x0000000073ABF000-memory.dmpFilesize
4KB
