Automated Malware Analysis IOC Report for

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.460412984327442
Filename:	TlsPatcher-1.1.1.exe
Filesize:	806476
MD5:	fdeac4be6f9e9154d54956760c3f0f58
SHA1:	b706a826fbfdf577e5806927d43fb7d9138093e6
SHA256:	7a16eee0bac29b88ad46a147dcad633860e81541538d91cc0e397b5d6b5986fe
SHA512:	de39889967f3d46046422fd49c1f5cd81c47592c21dfe1fcff35470a4e5644fab45345fe71aebd1c0f8602bdb56b4473659c9280e1233951016052875d06541d
SSDEEP:	12288:u79g/k9Ygb25zyaaEqrHqm/AoPd7yksBdD+m1YBQuM+i1pdcfl:agwYgb25FJsqIAkV7svDxuS13Ul
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../a..N...N...N..m....N..m....N..m....N..J....N..J....N..J....N...6...N...6...N...N...O..`/...N..`/...N...N...N..`/...N..Rich.N.

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
PE file contains sections with non-standard names	Data Obfuscation	File Deletion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Uses 32bit PE files	Compliance, System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Config.Msi\6d73a9.rbs
Category:	modified
Dump:	6d73a9.rbs.16.dr
ID:	dr_11
Target ID:	16
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	5.626558358696894
Encrypted:	false
Size:	10880
Whitelisted:	false

Details

File:	C:\ProgramData\Package Cache\{fe0fc20b-fc4f-4233-98e4-e30940c5703c}\LevelUp.Integrations.TlsPatcher.Bootstrapper.exe (copy)
Category:	dropped
Dump:	LevelUp.Integrations.TlsPatcher.Bootstrapper.exe.1.dr
Target ID:	3
Process:	C:\Users\user\AppData\Local\Temp\{F1724056-37B1-4B0D-BC4A-FDF68DC088E5}\.be\LevelUp.Integrations.TlsPatcher.Bootstrapper.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\ProgramData\Package Cache\{fe0fc20b-fc4f-4233-98e4-e30940c5703c}\state.rsm
Category:	dropped
Dump:	state.rsm.3.dr
ID:	dr_7
Target ID:	3
Process:	C:\Users\user\AppData\Local\Temp\{F1724056-37B1-4B0D-BC4A-FDF68DC088E5}\.be\LevelUp.Integrations.TlsPatcher.Bootstrapper.exe
Type:	data
Entropy:	2.2923329657201905
Encrypted:	false
Size:	774
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\TLS_Patcher_v1.1.1_20241030012147.log
Category:	modified
Dump:	TLS_Patcher_v1.1.1_20241030012147.log.1.dr
ID:	dr_15
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\{20881945-CFBC-4931-AB3C-C938DFE5C3F4}\.cr\TlsPatcher-1.1.1.exe
Type:	ASCII text, with very long lines (369), with CRLF line terminators
Entropy:	5.43100653391406
Encrypted:	false
Size:	9299
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\{F1724056-37B1-4B0D-BC4A-FDF68DC088E5}\.ba\BootstrapperApplicationData.xml
Category:	dropped
Dump:	BootstrapperApplicationData.xml.1.dr
ID:	dr_5
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\{20881945-CFBC-4931-AB3C-C938DFE5C3F4}\.cr\TlsPatcher-1.1.1.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (639), with CRLF line terminators
Entropy:	3.724738137701262
Encrypted:	false
Size:	5922
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\{F1724056-37B1-4B0D-BC4A-FDF68DC088E5}\.ba\license.rtf
Category:	dropped
Dump:	license.rtf.1.dr
ID:	dr_4
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\{20881945-CFBC-4931-AB3C-C938DFE5C3F4}\.cr\TlsPatcher-1.1.1.exe
Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Entropy:	4.667736038457987
Encrypted:	false
Size:	9729
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\AppData\Local\Temp\{F1724056-37B1-4B0D-BC4A-FDF68DC088E5}\.ba\logo.png
Category:	dropped
Dump:	logo.png.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\{20881945-CFBC-4931-AB3C-C938DFE5C3F4}\.cr\TlsPatcher-1.1.1.exe
Type:	PC bitmap, Windows 3.x format, 64 x 64 x 24, image size 12290, resolution 2834 x 2834 px/m, cbSize 12344, bits offset 54
Entropy:	3.5351498143481073
Encrypted:	false
Size:	12344
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Users\user\AppData\Local\Temp\{F1724056-37B1-4B0D-BC4A-FDF68DC088E5}\.ba\thm.wxl
Category:	dropped
Dump:	thm.wxl.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\{20881945-CFBC-4931-AB3C-C938DFE5C3F4}\.cr\TlsPatcher-1.1.1.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	5.021251704645758
Encrypted:	false
Size:	4180
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\{F1724056-37B1-4B0D-BC4A-FDF68DC088E5}\.ba\thm.xml
Category:	dropped
Dump:	thm.xml.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\{20881945-CFBC-4931-AB3C-C938DFE5C3F4}\.cr\TlsPatcher-1.1.1.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	5.184632608060528
Encrypted:	false
Size:	8332
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\{F1724056-37B1-4B0D-BC4A-FDF68DC088E5}\.ba\wixstdba.dll
Category:	dropped
Dump:	wixstdba.dll.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\{20881945-CFBC-4931-AB3C-C938DFE5C3F4}\.cr\TlsPatcher-1.1.1.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.530154771613059
Encrypted:	false
Size:	179200
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Temp\{F1724056-37B1-4B0D-BC4A-FDF68DC088E5}\.be\LevelUp.Integrations.TlsPatcher.Bootstrapper.exe
Category:	dropped
Dump:	LevelUp.Integrations.TlsPatcher.Bootstrapper.exe.1.dr
ID:	dr_6
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\{20881945-CFBC-4931-AB3C-C938DFE5C3F4}\.cr\TlsPatcher-1.1.1.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.034550317467372
Encrypted:	false
Size:	568673
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates or modifies windows services	Boot Survival	Windows Service
Drops PE files	Persistence and Installation Behavior
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Checks the free space of harddrives	Malware Analysis System Evasion	System Information Discovery
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Enumerates the file system	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading
Creates a software restore point	Compliance
Creates install or setup log file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Windows\Installer\6d73a7.msi
Category:	dropped
Dump:	6d73a7.msi.16.dr
ID:	dr_13
Target ID:	16
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: LevelUp TLS Patcher v1.1.1, Author: LevelUp, Keywords: Installer, Comments: This installer database contains the logic and data required to install LevelUp TLS Patcher v1.1.1., Template: x64;1033, Revision Number: {64FB791B-0D06-4040-84F4-E3B4AFF5A845}, Create Time/Date: Wed May 13 21:18:44 2020, Last Saved Time/Date: Wed May 13 21:18:44 2020, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
Entropy:	5.633658786054681
Encrypted:	false
Size:	339968
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\MSI74D0.tmp
Category:	dropped
Dump:	MSI74D0.tmp.16.dr
ID:	dr_8
Target ID:	16
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.573348437503042
Encrypted:	false
Size:	207360
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Deletes files inside the Windows folder	System Summary	File Deletion
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Installer\MSI758C.tmp
Category:	dropped
Dump:	MSI758C.tmp.16.dr
ID:	dr_9
Target ID:	16
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	5.648505543910054
Encrypted:	false
Size:	4385
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Category:	dropped
Dump:	ngen.log.16.dr
ID:	dr_14
Target ID:	16
Process:	C:\Windows\System32\msiexec.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.356155832470658
Encrypted:	false
Size:	454234
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF242310B318C3C5B5.TMP
Category:	dropped
Dump:	~DF242310B318C3C5B5.TMP.16.dr
ID:	dr_12
Target ID:	16
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.351756150763117
Encrypted:	false
Size:	32768
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF27F84C821E7418BB.TMP
Category:	dropped
Dump:	~DF27F84C821E7418BB.TMP.16.dr
ID:	dr_10
Target ID:	16
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Size:	512
Whitelisted:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
TlsPatcher-1.1.1.exe

Files

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportTlsPatcher-1.1.1.exe

Files

IOC Report
TlsPatcher-1.1.1.exe