Automated Malware Analysis IOC Report for

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.982918880423008
Filename:	EasyLogUSB+Installer.exe
Filesize:	19500624
MD5:	d3d4273692e34102b88c513ad1c10040
SHA1:	1b75e5c2644fbf075040df437b15d4d2c128c2cf
SHA256:	cc2652dc33020fab609750a6f627e2f8e6597960b25f210981e62f5ad92f7d70
SHA512:	94ea2dedb53887a40b4995536211d94247b3bd9994e0b3888eedffa52a20b4cd500a4da86f110a7a203ba2802b011d29c349774df8d4bea5ea3237f216e1157b
SSDEEP:	393216:BhQWQwqV7x2GH3mm+xaYzY4VGHxfwzXUxnIbG1vrMd:Bjqd9WJaYz7GRfwLUxnIbcYd
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wn.............................M.......M...7...@a......M.......@a..........!...................................Rich...........

Signature Hits	Behavior Group	Mitre Attack
Uses 32bit PE files	Compliance, System Summary
Checks the free space of harddrives	Malware Analysis System Evasion
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Writes ini files	System Summary
PE file contains a debug data directory	System Summary
PE / OLE file has a valid certificate	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

Details

File:	C:\Config.Msi\3a61ae.rbs
Category:	modified
Dump:	3a61ae.rbs.4.dr
ID:	dr_8
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	5.731046015041822
Encrypted:	false
Size:	14060
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\CustomControls.dll
Category:	dropped
Dump:	CustomControls.dll.4.dr
ID:	dr_31
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.294061771215002
Encrypted:	false
Size:	83968
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\EasyLog USB\EL-USB Driver Setup.exe
Category:	dropped
Dump:	EL-USB Driver Setup.exe.4.dr
ID:	dr_18
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.215505980302389
Encrypted:	false
Size:	636816
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Launches processes in debugging mode, may be used to hinder debugging	Anti Debugging	Disable or Modify Tools
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading

Details

File:	C:\Program Files (x86)\EasyLog USB\EL-USB.inf
Category:	dropped
Dump:	EL-USB.inf.4.dr
ID:	dr_21
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	Windows setup INFormation
Entropy:	5.242834253911726
Encrypted:	false
Size:	1774
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\EasyLog USB.chm
Category:	dropped
Dump:	EasyLog USB.chm.4.dr
ID:	dr_28
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows HtmlHelp Data
Entropy:	7.999336140233879
Encrypted:	true
Size:	11118090
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\EasyLog USB.exe
Category:	dropped
Dump:	EasyLog USB.exe.4.dr
ID:	dr_29
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.154456571356211
Encrypted:	false
Size:	2468864
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\EasyLog USB\EasyLogGraph.exe
Category:	dropped
Dump:	EasyLogGraph.exe.4.dr
ID:	dr_30
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.976511471374955
Encrypted:	false
Size:	12519936
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\EasyLog USB\ExportToExcel.dll
Category:	dropped
Dump:	ExportToExcel.dll.4.dr
ID:	dr_27
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.478623936096293
Encrypted:	false
Size:	1656320
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\EasyLog USB\Sample CO.txt
Category:	dropped
Dump:	Sample CO.txt.4.dr
ID:	dr_35
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.757781663348975
Encrypted:	false
Size:	12278
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\Sample Current.txt
Category:	dropped
Dump:	Sample Current.txt.4.dr
ID:	dr_36
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.8494259019457355
Encrypted:	false
Size:	9484
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\Sample Lite.txt
Category:	dropped
Dump:	Sample Lite.txt.4.dr
ID:	dr_37
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	3.633119065723989
Encrypted:	false
Size:	15477
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\Sample RH.txt
Category:	dropped
Dump:	Sample RH.txt.4.dr
ID:	dr_38
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	3.527582608719269
Encrypted:	false
Size:	44219
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\Sample Temp.txt
Category:	dropped
Dump:	Sample Temp.txt.4.dr
ID:	dr_33
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.6068372981211265
Encrypted:	false
Size:	125852
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\Sample Voltage.txt
Category:	dropped
Dump:	Sample Voltage.txt.4.dr
ID:	dr_34
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.717253632972772
Encrypted:	false
Size:	8679
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\WPFToolkit.dll
Category:	dropped
Dump:	WPFToolkit.dll.4.dr
ID:	dr_26
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.047761304423497
Encrypted:	false
Size:	467288
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\EasyLog USB\setup.ini
Category:	dropped
Dump:	setup.ini.4.dr
ID:	dr_19
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	Generic INItialization configuration [Driver Version]
Entropy:	5.319487317274177
Encrypted:	false
Size:	483
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\siusbxp.cat
Category:	dropped
Dump:	siusbxp.cat.4.dr
ID:	dr_20
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	6.928193234859025
Encrypted:	false
Size:	8984
Whitelisted:	false

Details

File:	C:\Program Files (x86)\EasyLog USB\x64\SiLib.sys
Category:	dropped
Dump:	SiLib.sys0.4.dr
ID:	dr_24
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32+ executable (native) x86-64, for MS Windows
Entropy:	5.444427923348303
Encrypted:	false
Size:	24576
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\EasyLog USB\x64\SiUSBXp.sys
Category:	dropped
Dump:	SiUSBXp.sys0.4.dr
ID:	dr_25
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32+ executable (native) x86-64, for MS Windows
Entropy:	5.5838184446755195
Encrypted:	false
Size:	19456
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\EasyLog USB\x86\SiLib.sys
Category:	dropped
Dump:	SiLib.sys.4.dr
ID:	dr_22
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (native) Intel 80386, for MS Windows
Entropy:	6.017219183396955
Encrypted:	false
Size:	17408
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates driver files	System Summary	Windows Service
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\EasyLog USB\x86\SiUSBXp.sys
Category:	dropped
Dump:	SiUSBXp.sys.4.dr
ID:	dr_23
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (native) Intel 80386, for MS Windows
Entropy:	6.033771703962439
Encrypted:	false
Size:	14592
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EasyLog USB\EasyLog USB.lnk
Category:	dropped
Dump:	EasyLog USB.lnk0.4.dr
ID:	dr_42
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Entropy:	2.920806790606985
Encrypted:	false
Size:	2769
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EasyLog USB\EasyLogGraph.lnk
Category:	dropped
Dump:	EasyLogGraph.lnk.4.dr
ID:	dr_5
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Entropy:	2.927642390330706
Encrypted:	false
Size:	2775
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Users\Public\Desktop\EasyLog USB.lnk
Category:	dropped
Dump:	EasyLog USB.lnk.4.dr
ID:	dr_6
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Feb 18 18:11:02 2021, mtime=Thu Aug 29 17:48:03 2024, atime=Thu Feb 18 18:11:02 2021, length=2468864, window=hide
Entropy:	4.689725428246736
Encrypted:	false
Size:	970
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

Details

File:	C:\Users\Public\Desktop\EasyLog USB.lnk~RF3a6a48.TMP (copy)
Category:	dropped
Dump:	EasyLog USB.lnk.4.dr
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Feb 18 18:11:02 2021, mtime=Thu Aug 29 17:48:03 2024, atime=Thu Feb 18 18:11:02 2021, length=2468864, window=hide
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Desktop\~asyLog USB.tmp
Category:	dropped
Dump:	~asyLog USB.tmp.4.dr
ID:	dr_7
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Feb 18 18:11:02 2021, mtime=Thu Aug 29 17:48:03 2024, atime=Thu Feb 18 18:11:02 2021, length=2468864, window=hide
Entropy:	4.716458189532959
Encrypted:	false
Size:	1015
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\DLL_{B4E4EFE5-93D9-435B-BDE9-3525A9689EB9}.ini
Category:	dropped
Dump:	DLL_{B4E4EFE5-93D9-435B-BDE9-3525A9689EB9}.ini.5.dr
ID:	dr_43
Target ID:	5
Process:	C:\Windows\SysWOW64\msiexec.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.239236705496828
Encrypted:	false
Size:	205
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\MSI478F.tmp
Category:	dropped
Dump:	MSI478F.tmp.3.dr
ID:	dr_4
Target ID:	3
Process:	C:\Windows\SysWOW64\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.027572827219195
Encrypted:	false
Size:	156928
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\{0D022C78-2169-466B-A31C-8D092A6A94A4}\0x0409.ini
Category:	dropped
Dump:	0x0409.ini.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Users\user\Desktop\EasyLogUSB+Installer.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Entropy:	3.4851320007899904
Encrypted:	false
Size:	22480
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\{0D022C78-2169-466B-A31C-8D092A6A94A4}\EasyLog USB.msi
Category:	dropped
Dump:	EasyLog USB.msi.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Users\user\Desktop\EasyLogUSB+Installer.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: EasyLog USB, Author: Lascar Electronics Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2016 - Professional Edition 23, Last Saved Time/Date: Mon Aug 8 16:29:11 2022, Create Time/Date: Mon Aug 8 16:29:11 2022, Last Printed: Mon Aug 8 16:29:11 2022, Revision Number: {8C7E2C80-4C6F-4A5C-9FDD-5AA316A9E29A}, Code page: 1252, Template: Intel;1033
Entropy:	7.960074563695781
Encrypted:	false
Size:	19083776
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Suspicious Execution From GUID Like Folder Names	System Summary
Spawns processes	System Summary	Process Injection

Details

File:	C:\Users\user\AppData\Local\Temp\{0D022C78-2169-466B-A31C-8D092A6A94A4}\_ISMSIDEL.INI
Category:	dropped
Dump:	_ISMSIDEL.INI0.1.dr
ID:	dr_44
Target ID:	1
Process:	C:\Users\user\Desktop\EasyLogUSB+Installer.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	2.8954618442383215
Encrypted:	false
Size:	20
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\~305C.tmp
Category:	dropped
Dump:	~305C.tmp.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Users\user\Desktop\EasyLogUSB+Installer.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.733760690252317
Encrypted:	false
Size:	5252
Whitelisted:	false

Details

File:	C:\Windows\Installer\MSI647C.tmp
Category:	dropped
Dump:	MSI647C.tmp.4.dr
ID:	dr_15
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy:	6.417003787731374
Encrypted:	false
Size:	523512
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Deletes files inside the Windows folder	System Summary	File Deletion
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Installer\MSI6539.tmp
Category:	dropped
Dump:	MSI6539.tmp.4.dr
ID:	dr_16
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	5.187015593802942
Encrypted:	false
Size:	207049
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\SourceHash{B4E4EFE5-93D9-435B-BDE9-3525A9689EB9}
Category:	dropped
Dump:	SourceHash{B4E4EFE5-93D9-435B-BDE9-3525A9689EB9}.4.dr
ID:	dr_10
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.1637138209702855
Encrypted:	false
Size:	20480
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\{B4E4EFE5-93D9-435B-BDE9-3525A9689EB9}\ARPPRODUCTICON.exe
Category:	dropped
Dump:	ARPPRODUCTICON.exe.4.dr
ID:	dr_39
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.067944027835008
Encrypted:	false
Size:	72944
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Installer\{B4E4EFE5-93D9-435B-BDE9-3525A9689EB9}\EasyLogGraph.exe_3D39C605F6D0484A88F3AD4B82B13993.exe
Category:	dropped
Dump:	EasyLogGraph.exe_3D39C605F6D0484A88F3AD4B82B13993.exe.4.dr
ID:	dr_41
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.106173623429902
Encrypted:	false
Size:	52464
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Installer\{B4E4EFE5-93D9-435B-BDE9-3525A9689EB9}\EasyLog_USB.exe_63257A9301FB4EABA085D3C69F470EC4.exe
Category:	dropped
Dump:	EasyLog_USB.exe_63257A9301FB4EABA085D3C69F470EC4.exe.4.dr
ID:	dr_40
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.069498628939283
Encrypted:	false
Size:	72944
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Category:	dropped
Dump:	ngen.log.4.dr
ID:	dr_13
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.356173939611067
Encrypted:	false
Size:	454234
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\SiUSBXp.dll
Category:	dropped
Dump:	SiUSBXp.dll.4.dr
ID:	dr_32
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.1088148238453925
Encrypted:	false
Size:	90112
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Temp\~DF0306D147797878C3.TMP
Category:	dropped
Dump:	~DF0306D147797878C3.TMP.4.dr
ID:	dr_17
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.4569539727621832
Encrypted:	false
Size:	32768
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF1123BE70FC077220.TMP
Category:	dropped
Dump:	~DF1123BE70FC077220.TMP.4.dr
ID:	dr_9
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.07156909361014326
Encrypted:	false
Size:	32768
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF5BDAD2C112EEACB7.TMP
Category:	dropped
Dump:	~DF5BDAD2C112EEACB7.TMP.4.dr
ID:	dr_12
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.8452524929988765
Encrypted:	false
Size:	20480
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF62FBD09C3A0B058B.TMP
Category:	dropped
Dump:	~DF62FBD09C3A0B058B.TMP.4.dr
ID:	dr_11
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.24189976504386393
Encrypted:	false
Size:	73728
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DFC23DFF20C5796CFC.TMP
Category:	dropped
Dump:	~DFC23DFF20C5796CFC.TMP.4.dr
ID:	dr_14
Target ID:	4
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Size:	512
Whitelisted:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
EasyLogUSB+Installer.exe

Files

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportEasyLogUSB+Installer.exe

Files

IOC Report
EasyLogUSB+Installer.exe