Automated Malware Analysis IOC Report for

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.964162789533916
Filename:	b2 ControlCenter Setup V3.75.exe
Filesize:	16740243
MD5:	f02023e1e165fb92adaab5bf1ef98ed9
SHA1:	9de491da46b50716d1b8164221c9b84a111fdfc2
SHA256:	2a92ac98ae89f214cd10b1ca5eb26316bb588f73d5e0a2642c1768712ffb0aad
SHA512:	4f0cc68d4065bf3fc0808734221894dacdc7689b27d8d8f316eb06b75064c0b37f9db8d4a3852375d7abf14966adcfb5b13aee7591f5ebc4d9bcf9af0418dcdf
SSDEEP:	393216:sun+n8Laf969mYcbluvONQIvu81npIav8GPCX0g5qRC8:Eu+IoavONg8pj8cCkgIQ8
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.5...[...[...[..H..%.[..H../.[..I..7.[..I....[.....-.[..I..l.[.....9.[...Z...[..H..n.[..H../.[...../.[..H../.[.Rich..[........

Signature Hits	Behavior Group	Mitre Attack
Injects code into the Windows Explorer (explorer.exe)	HIPS / PFW / Operating System Protection Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Uses 32bit PE files	Compliance, System Summary
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Checks the free space of harddrives	Malware Analysis System Evasion
Creates files inside the user directory	System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Launches a second explorer.exe instance	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads ini files	System Summary
Reads software policies	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Writes ini files	System Summary	File and Directory Discovery
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

Details

File:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\b2 ControlCenter Setup V3.75.exe
Category:	dropped
Dump:	b2 ControlCenter Setup V3.75.exe.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\b2 ControlCenter Setup V3.75.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.964162789533916
Encrypted:	false
Size:	16740243
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Injects code into the Windows Explorer (explorer.exe)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Uses 32bit PE files	Compliance, System Summary
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Checks the free space of harddrives	Malware Analysis System Evasion	System Information Discovery
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Launches a second explorer.exe instance	System Summary
PE file has an executable .text section and no other executable section	System Summary
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

Details

File:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\b2 ControlCenter Setup V3.75.exe:Zone.Identifier
Category:	dropped
Dump:	b2 ControlCenter Setup V3.75.exe_Zone.Identifier.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\b2 ControlCenter Setup V3.75.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.95006375643621
Encrypted:	false
Size:	26
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Injects code into the Windows Explorer (explorer.exe)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Uses 32bit PE files	Compliance, System Summary
Checks the free space of harddrives	Malware Analysis System Evasion	System Information Discovery
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Launches a second explorer.exe instance	System Summary
PE file has an executable .text section and no other executable section	System Summary
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

Details

File:	C:\Config.Msi\600482.rbs
Category:	modified
Dump:	600482.rbs.9.dr
ID:	dr_46
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	5.791509537136401
Encrypted:	false
Size:	49339
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Abt.Controls.SciChart.Wpf.dll
Category:	dropped
Dump:	Abt.Controls.SciChart.Wpf.dll.9.dr
ID:	dr_9
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.2729854395546285
Encrypted:	false
Size:	1310720
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Abt.Controls.SciChart.Wpf.xml
Category:	dropped
Dump:	Abt.Controls.SciChart.Wpf.xml.9.dr
ID:	dr_40
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.604107843327761
Encrypted:	false
Size:	927169
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.ControlCenter.Charting.dll
Category:	dropped
Dump:	B2.ControlCenter.Charting.dll.9.dr
ID:	dr_23
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.690625386053806
Encrypted:	false
Size:	62976
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.ControlCenter.Common.dll
Category:	dropped
Dump:	B2.ControlCenter.Common.dll.9.dr
ID:	dr_49
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.489236035899555
Encrypted:	false
Size:	4404224
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.ControlCenter.Common.dll.config
Category:	dropped
Dump:	B2.ControlCenter.Common.dll.config.9.dr
ID:	dr_37
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.800019939763942
Encrypted:	false
Size:	3239
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.ControlCenter.Core.dll
Category:	dropped
Dump:	B2.ControlCenter.Core.dll.9.dr
ID:	dr_47
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	4.93189202892329
Encrypted:	false
Size:	14336
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.ControlCenter.Core.dll.config
Category:	dropped
Dump:	B2.ControlCenter.Core.dll.config.9.dr
ID:	dr_42
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.837635969266507
Encrypted:	false
Size:	1180
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.ControlCenter.HVA2G.Generic.dll
Category:	dropped
Dump:	B2.ControlCenter.HVA2G.Generic.dll.9.dr
ID:	dr_64
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.501271268160047
Encrypted:	false
Size:	989184
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.ControlCenter.RemoteControl.dll
Category:	dropped
Dump:	B2.ControlCenter.RemoteControl.dll.9.dr
ID:	dr_27
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.0521299823542405
Encrypted:	false
Size:	116736
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.ControlCenter.ServiceArea.dll
Category:	dropped
Dump:	B2.ControlCenter.ServiceArea.dll.9.dr
ID:	dr_62
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.240725805389154
Encrypted:	false
Size:	1829888
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.ControlCenter.ServiceArea.dll.config
Category:	dropped
Dump:	B2.ControlCenter.ServiceArea.dll.config.9.dr
ID:	dr_39
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	4.684342590063428
Encrypted:	false
Size:	1791
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.Core.dll
Category:	dropped
Dump:	B2.Core.dll.9.dr
ID:	dr_65
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.731304699874705
Encrypted:	false
Size:	65024
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.Devices.Common.dll
Category:	dropped
Dump:	B2.Devices.Common.dll.9.dr
ID:	dr_55
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.921525893053503
Encrypted:	false
Size:	7828992
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.License.dll
Category:	dropped
Dump:	B2.License.dll.9.dr
ID:	dr_35
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.468345842624653
Encrypted:	false
Size:	20480
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\B2.LouserzationProvider.dll
Category:	dropped
Dump:	B2.LouserzationProvider.dll.9.dr
ID:	dr_21
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.118865749168938
Encrypted:	false
Size:	10752
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\ControlCenter.App.exe
Category:	dropped
Dump:	ControlCenter.App.exe.9.dr
ID:	dr_51
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.645508870104047
Encrypted:	false
Size:	1805312
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
Uses Microsoft Silverlight	System Summary

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\ControlCenter.App.exe.config
Category:	dropped
Dump:	ControlCenter.App.exe.config.9.dr
ID:	dr_41
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.889095952074509
Encrypted:	false
Size:	4323
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
Uses Microsoft Silverlight	System Summary

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\DriverPackage.dll
Category:	dropped
Dump:	DriverPackage.dll.9.dr
ID:	dr_52
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.618221648482328
Encrypted:	false
Size:	50688
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\IPManager.dll
Category:	dropped
Dump:	IPManager.dll.9.dr
ID:	dr_58
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.326288775753147
Encrypted:	false
Size:	48640
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\InTheHand.Net.Personal.dll
Category:	dropped
Dump:	InTheHand.Net.Personal.dll.9.dr
ID:	dr_20
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.945800143268636
Encrypted:	false
Size:	431616
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\InTheHand.Net.Personal.xml
Category:	dropped
Dump:	InTheHand.Net.Personal.xml.9.dr
ID:	dr_43
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (359), with CRLF line terminators
Entropy:	4.583654568650992
Encrypted:	false
Size:	827880
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Ivi.Visa.dll
Category:	dropped
Dump:	Ivi.Visa.dll.9.dr
ID:	dr_33
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.819350851011498
Encrypted:	false
Size:	253336
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Locals\cs-CZ\LC_Messages\cs-CZ.mo
Category:	dropped
Dump:	cs-CZ.mo.9.dr
ID:	dr_10
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 929 messages, Project-Id-Version: b2CC V3.75 'Po\304\215et vodi\304\215\305\257'
Entropy:	5.491193484808316
Encrypted:	false
Size:	72820
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Locals\de-de\LC_Messages\de-de.mo
Category:	dropped
Dump:	de-de.mo.9.dr
ID:	dr_11
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 929 messages, Project-Id-Version: b2CC V3.75 'Anz. Leiter'
Entropy:	5.289250077276902
Encrypted:	false
Size:	73412
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Locals\es-ES\LC_Messages\es-ES.mo
Category:	dropped
Dump:	es-ES.mo.9.dr
ID:	dr_12
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 929 messages, Project-Id-Version: b2CC V3.75 '# de conductores'
Entropy:	5.25328031836322
Encrypted:	false
Size:	75236
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Locals\fr-FR\LC_Messages\fr-FR.mo
Category:	dropped
Dump:	fr-FR.mo.9.dr
ID:	dr_13
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 494 messages, Project-Id-Version: b2CC V3.73 'Nombre de conducteurs'
Entropy:	5.191532882506726
Encrypted:	false
Size:	42991
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Locals\it-IT\LC_Messages\it-IT.mo
Category:	dropped
Dump:	it-IT.mo.9.dr
ID:	dr_14
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 479 messages, Project-Id-Version: b2CC V3.73 'Numero di conduttori'
Entropy:	5.065045652376136
Encrypted:	false
Size:	40056
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Locals\nb-NO\LC_Messages\nb-NO.mo
Category:	dropped
Dump:	nb-NO.mo.9.dr
ID:	dr_15
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 363 messages, Project-Id-Version: b2CC V3.73 '# Av Dirigenter'
Entropy:	5.146676570886068
Encrypted:	false
Size:	28084
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Locals\nl-NL\LC_Messages\nl-NL.mo
Category:	dropped
Dump:	nl-NL.mo.9.dr
ID:	dr_16
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 929 messages, Project-Id-Version: b2CC V3.75 '# Geleiders'
Entropy:	5.219016270843891
Encrypted:	false
Size:	72861
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Locals\pl-PL\LC_Messages\pl-PL.mo
Category:	dropped
Dump:	pl-PL.mo.9.dr
ID:	dr_17
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 929 messages, Project-Id-Version: b2CC V3.75 '# \305\274y\305\202'
Entropy:	5.463615976360198
Encrypted:	false
Size:	72631
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Locals\ru-RU\LC_Messages\ru-RU.mo
Category:	dropped
Dump:	ru-RU.mo.9.dr
ID:	dr_18
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 498 messages, Project-Id-Version: b2CC V3.73 '\320\237\321\200\320\276\320\262\320\276\320\264\320\275\320\270\320\272\320\276\320\262'
Entropy:	5.4138574621393145
Encrypted:	false
Size:	51920
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Locals\zh-TW\LC_Messages\zh-TW.mo
Category:	dropped
Dump:	zh-TW.mo.9.dr
ID:	dr_19
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	GNU message catalog (little endian), revision 0.0, 377 messages, Project-Id-Version: b2CC V3.73 '# \345\260\216\351\253\224\344\270\255'
Entropy:	5.879421543043671
Encrypted:	false
Size:	27975
Whitelisted:	false

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\MigraDoc.DocumentObjectModel-WPF.dll
Category:	dropped
Dump:	MigraDoc.DocumentObjectModel-WPF.dll.9.dr
ID:	dr_59
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.683351885696719
Encrypted:	false
Size:	253952
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\MigraDoc.Rendering-WPF.dll
Category:	dropped
Dump:	MigraDoc.Rendering-WPF.dll.9.dr
ID:	dr_60
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.406435623463496
Encrypted:	false
Size:	139264
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\MigraDoc.RtfRendering-WPF.dll
Category:	dropped
Dump:	MigraDoc.RtfRendering-WPF.dll.9.dr
ID:	dr_66
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.124202862914015
Encrypted:	false
Size:	81920
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\NGettext.dll
Category:	dropped
Dump:	NGettext.dll.9.dr
ID:	dr_28
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.656233759415931
Encrypted:	false
Size:	39936
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\NationalInstruments.Visa.dll
Category:	dropped
Dump:	NationalInstruments.Visa.dll.9.dr
ID:	dr_34
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.1201657093755095
Encrypted:	false
Size:	127368
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\NationalInstruments.VisaNS.dll
Category:	dropped
Dump:	NationalInstruments.VisaNS.dll.9.dr
ID:	dr_53
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.593696105616633
Encrypted:	false
Size:	184320
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\PdfSharp-WPF.dll
Category:	dropped
Dump:	PdfSharp-WPF.dll.9.dr
ID:	dr_22
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.861798348492125
Encrypted:	false
Size:	558080
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\PdfSharp.Charting-WPF.dll
Category:	dropped
Dump:	PdfSharp.Charting-WPF.dll.9.dr
ID:	dr_57
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.111249731100566
Encrypted:	false
Size:	94208
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Teslab.Louserzation.dll
Category:	dropped
Dump:	Teslab.Louserzation.dll.9.dr
ID:	dr_24
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.522843724534118
Encrypted:	false
Size:	53760
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Teslab.StateMachine.dll
Category:	dropped
Dump:	Teslab.StateMachine.dll.9.dr
ID:	dr_29
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.343845897201569
Encrypted:	false
Size:	27136
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Teslab.Wpf.Extensions.dll
Category:	dropped
Dump:	Teslab.Wpf.Extensions.dll.9.dr
ID:	dr_30
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.451991203774728
Encrypted:	false
Size:	26624
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\Xceed.Wpf.Toolkit.dll
Category:	dropped
Dump:	Xceed.Wpf.Toolkit.dll.9.dr
ID:	dr_32
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.2820842710715885
Encrypted:	false
Size:	900608
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Users\user\AppData\Local\Downloaded Installations\{B1B7EEAC-19DF-4A66-92D0-4A9FA0D4FD78}\b2 ControlCenter.msi (copy)
Category:	dropped
Dump:	b2 ControlCenter.msi.2.dr
Target ID:	2
Process:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\b2 ControlCenter Setup V3.75.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: b2 ControlCenter Setup, Comments: b2 ControlCenter, Keywords: Installer,MSI,Database, Subject: b2 ControlCenter, Author: b2 electronic GmbH, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2018 - Express Edition 24, Last Saved Time/Date: Tue Nov 29 15:24:49 2022, Create Time/Date: Tue Nov 29 15:24:49 2022, Last Printed: Tue Nov 29 15:24:49 2022, Revision Number: {B1B7EEAC-19DF-4A66-92D0-4A9FA0D4FD78}, Code page: 1252, Template: Intel;1033
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\MSI180A.tmp
Category:	dropped
Dump:	MSI180A.tmp.8.dr
ID:	dr_8
Target ID:	8
Process:	C:\Windows\SysWOW64\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy:	6.241698308556307
Encrypted:	false
Size:	105688
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\MSIF425.tmp
Category:	dropped
Dump:	MSIF425.tmp.8.dr
ID:	dr_7
Target ID:	8
Process:	C:\Windows\SysWOW64\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.059174301041458
Encrypted:	false
Size:	169168
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\0x0409.ini
Category:	dropped
Dump:	0x0409.ini.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\b2 ControlCenter Setup V3.75.exe
Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Entropy:	3.4851320007899904
Encrypted:	false
Size:	22480
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\Microsoft .NET Framework 4.5 Web .prq
Category:	dropped
Dump:	Microsoft .NET Framework 4.5 Web .prq.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\b2 ControlCenter Setup V3.75.exe
Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.217629515334262
Encrypted:	false
Size:	2412
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\Setup.INI
Category:	dropped
Dump:	Setup.INI.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\b2 ControlCenter Setup V3.75.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.7169014032571415
Encrypted:	false
Size:	5480
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\_ISMSIDEL.INI
Category:	dropped
Dump:	_ISMSIDEL.INI.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\b2 ControlCenter Setup V3.75.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.693027505902493
Encrypted:	false
Size:	1396
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Reads ini files	System Summary	File and Directory Discovery
Writes ini files	System Summary	File and Directory Discovery

Details

File:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\b2 ControlCenter.msi
Category:	dropped
Dump:	b2 ControlCenter.msi.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Users\user\AppData\Local\Temp\{12BEBBFB-A371-46B3-A0D0-50A2008B50C2}\b2 ControlCenter Setup V3.75.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: b2 ControlCenter Setup, Comments: b2 ControlCenter, Keywords: Installer,MSI,Database, Subject: b2 ControlCenter, Author: b2 electronic GmbH, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2018 - Express Edition 24, Last Saved Time/Date: Tue Nov 29 15:24:49 2022, Create Time/Date: Tue Nov 29 15:24:49 2022, Last Printed: Tue Nov 29 15:24:49 2022, Revision Number: {B1B7EEAC-19DF-4A66-92D0-4A9FA0D4FD78}, Code page: 1252, Template: Intel;1033
Entropy:	7.896342327863149
Encrypted:	false
Size:	16909824
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\b2_electronics_GmbH\ControlCenter.App.exe_Url_a5h2i2zqkk4xr4gwua5svejhuk4iuyrk\3.75.10.0\fy4pyklr.newcfg
Category:	dropped
Dump:	fy4pyklr.newcfg.14.dr
ID:	dr_68
Target ID:	14
Process:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\ControlCenter.App.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.581001753851005
Encrypted:	false
Size:	352
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\b2_electronics_GmbH\ControlCenter.App.exe_Url_a5h2i2zqkk4xr4gwua5svejhuk4iuyrk\3.75.10.0\kmgyv4kk.newcfg
Category:	dropped
Dump:	kmgyv4kk.newcfg.14.dr
ID:	dr_67
Target ID:	14
Process:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\ControlCenter.App.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.499216361743422
Encrypted:	false
Size:	596
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\b2_electronics_GmbH\ControlCenter.App.exe_Url_a5h2i2zqkk4xr4gwua5svejhuk4iuyrk\3.75.10.0\user.config (copy)
Category:	dropped
Dump:	fy4pyklr.newcfg.14.dr
Target ID:	14
Process:	C:\Program Files (x86)\b2 electronic GmbH\B2 ControlCenter\ControlCenter.App.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Installer\{D7F46775-46B0-4E89-8069-65CC2FA60046}\ARPPRODUCTICON.exe
Category:	dropped
Dump:	ARPPRODUCTICON.exe.9.dr
ID:	dr_36
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.76507051578974
Encrypted:	false
Size:	409600
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Installer\{D7F46775-46B0-4E89-8069-65CC2FA60046}\NewShortcut1_0E96F1A19A774C13AC5791AB896F9F0F.exe
Category:	dropped
Dump:	NewShortcut1_0E96F1A19A774C13AC5791AB896F9F0F.exe.9.dr
ID:	dr_38
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.76507414779012
Encrypted:	false
Size:	409600
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\b2 electronic GmbH\b2 ControlCenter\ControlCenter.lnk
Category:	dropped
Dump:	ControlCenter.lnk.9.dr
ID:	dr_44
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Icon number=0, Archive, ctime=Tue Nov 29 18:04:24 2022, mtime=Mon Oct 14 06:36:49 2024, atime=Tue Nov 29 18:04:24 2022, length=1805312, window=hide
Entropy:	3.9809373571483406
Encrypted:	false
Size:	2376
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Users\user\Desktop\ControlCenter.lnk
Category:	dropped
Dump:	ControlCenter.lnk0.9.dr
ID:	dr_45
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Icon number=0, Archive, ctime=Tue Nov 29 18:04:24 2022, mtime=Mon Oct 14 06:36:50 2024, atime=Tue Nov 29 18:04:24 2022, length=1805312, window=hide
Entropy:	3.98874902810683
Encrypted:	false
Size:	2334
Whitelisted:	false

Details

File:	C:\Windows\Installer\MSI77F.tmp
Category:	dropped
Dump:	MSI77F.tmp.9.dr
ID:	dr_26
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy:	6.231572329564986
Encrypted:	false
Size:	107720
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Deletes files inside the Windows folder	System Summary	File Deletion
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Installer\MSI7ED.tmp
Category:	dropped
Dump:	MSI7ED.tmp.9.dr
ID:	dr_31
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	5.823989104749377
Encrypted:	false
Size:	1260262
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\SourceHash{D7F46775-46B0-4E89-8069-65CC2FA60046}
Category:	dropped
Dump:	SourceHash{D7F46775-46B0-4E89-8069-65CC2FA60046}.9.dr
ID:	dr_56
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.1665398905321513
Encrypted:	false
Size:	20480
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Category:	dropped
Dump:	ngen.log.9.dr
ID:	dr_25
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.3561691487787195
Encrypted:	false
Size:	454234
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF3301538DC18405AD.TMP
Category:	dropped
Dump:	~DF3301538DC18405AD.TMP.9.dr
ID:	dr_63
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.3479815557270376
Encrypted:	false
Size:	20480
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF433EED9662BCE02A.TMP
Category:	dropped
Dump:	~DF433EED9662BCE02A.TMP.9.dr
ID:	dr_48
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	2.1379415668921378
Encrypted:	false
Size:	49152
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DFB1AE4F5668653A56.TMP
Category:	dropped
Dump:	~DFB1AE4F5668653A56.TMP.9.dr
ID:	dr_61
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.8861844572325469
Encrypted:	false
Size:	86016
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DFBF42E6B4EE0456D6.TMP
Category:	dropped
Dump:	~DFBF42E6B4EE0456D6.TMP.9.dr
ID:	dr_54
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.07374520592730725
Encrypted:	false
Size:	32768
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DFED8FE5AFDAF41894.TMP
Category:	dropped
Dump:	~DFED8FE5AFDAF41894.TMP.9.dr
ID:	dr_50
Target ID:	9
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Size:	512
Whitelisted:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
b2 ControlCenter Setup V3.75.exe

Files

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportb2 ControlCenter Setup V3.75.exe

Files

IOC Report
b2 ControlCenter Setup V3.75.exe