Resubmissions
04/12/2020, 17:06
201204-4hs2zp9xwe 8Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04/12/2020, 17:06
Static task
static1
Behavioral task
behavioral1
Sample
SurfsharkSetup (5).exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SurfsharkSetup (5).exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
SurfsharkSetup (5).exe
-
Size
25.2MB
-
MD5
20ee42699b52682eec596dfe400fbae6
-
SHA1
41353e3a82c4baa226210e9325ee6b6b0ef7bf6b
-
SHA256
35ee2cbb9e2b8c9527f93d1653f3dfc096b9b2bd7aa8170cf0e61df3e8a205a7
-
SHA512
502a9f77396554d5d2c59661e00037c72666bc4df9f318c5e397c798f8ba63325993d7f8f4beaa647101f904d431204fd45ce9a8f2ed9b46efeeb5a3c5d29f48
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 612 SurfsharkSetup (5).exe 612 SurfsharkSetup (5).exe 956 MsiExec.exe 956 MsiExec.exe 956 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: SurfsharkSetup (5).exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: SurfsharkSetup (5).exe File opened (read-only) \??\R: SurfsharkSetup (5).exe File opened (read-only) \??\S: SurfsharkSetup (5).exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: SurfsharkSetup (5).exe File opened (read-only) \??\U: SurfsharkSetup (5).exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: SurfsharkSetup (5).exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: SurfsharkSetup (5).exe File opened (read-only) \??\F: SurfsharkSetup (5).exe File opened (read-only) \??\M: SurfsharkSetup (5).exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: SurfsharkSetup (5).exe File opened (read-only) \??\T: SurfsharkSetup (5).exe File opened (read-only) \??\Y: SurfsharkSetup (5).exe File opened (read-only) \??\Q: SurfsharkSetup (5).exe File opened (read-only) \??\Z: SurfsharkSetup (5).exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: SurfsharkSetup (5).exe File opened (read-only) \??\L: SurfsharkSetup (5).exe File opened (read-only) \??\N: SurfsharkSetup (5).exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: SurfsharkSetup (5).exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: SurfsharkSetup (5).exe File opened (read-only) \??\P: SurfsharkSetup (5).exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: SurfsharkSetup (5).exe File opened (read-only) \??\J: SurfsharkSetup (5).exe File opened (read-only) \??\X: SurfsharkSetup (5).exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log wusa.exe File created C:\Windows\Tasks\C__Users_Admin_AppData_Local_Temp_SurfsharkSetup (5).exe.job SurfsharkSetup (5).exe File opened for modification C:\Windows\Tasks\C__Users_Admin_AppData_Local_Temp_SurfsharkSetup (5).exe.job SurfsharkSetup (5).exe File created C:\Windows\wusa.lock wusa.exe File opened for modification C:\Windows\Logs\DPX\setupact.log wusa.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log wusa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1844 wusa.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 268 msiexec.exe Token: SeTakeOwnershipPrivilege 268 msiexec.exe Token: SeSecurityPrivilege 268 msiexec.exe Token: SeCreateTokenPrivilege 612 SurfsharkSetup (5).exe Token: SeAssignPrimaryTokenPrivilege 612 SurfsharkSetup (5).exe Token: SeLockMemoryPrivilege 612 SurfsharkSetup (5).exe Token: SeIncreaseQuotaPrivilege 612 SurfsharkSetup (5).exe Token: SeMachineAccountPrivilege 612 SurfsharkSetup (5).exe Token: SeTcbPrivilege 612 SurfsharkSetup (5).exe Token: SeSecurityPrivilege 612 SurfsharkSetup (5).exe Token: SeTakeOwnershipPrivilege 612 SurfsharkSetup (5).exe Token: SeLoadDriverPrivilege 612 SurfsharkSetup (5).exe Token: SeSystemProfilePrivilege 612 SurfsharkSetup (5).exe Token: SeSystemtimePrivilege 612 SurfsharkSetup (5).exe Token: SeProfSingleProcessPrivilege 612 SurfsharkSetup (5).exe Token: SeIncBasePriorityPrivilege 612 SurfsharkSetup (5).exe Token: SeCreatePagefilePrivilege 612 SurfsharkSetup (5).exe Token: SeCreatePermanentPrivilege 612 SurfsharkSetup (5).exe Token: SeBackupPrivilege 612 SurfsharkSetup (5).exe Token: SeRestorePrivilege 612 SurfsharkSetup (5).exe Token: SeShutdownPrivilege 612 SurfsharkSetup (5).exe Token: SeDebugPrivilege 612 SurfsharkSetup (5).exe Token: SeAuditPrivilege 612 SurfsharkSetup (5).exe Token: SeSystemEnvironmentPrivilege 612 SurfsharkSetup (5).exe Token: SeChangeNotifyPrivilege 612 SurfsharkSetup (5).exe Token: SeRemoteShutdownPrivilege 612 SurfsharkSetup (5).exe Token: SeUndockPrivilege 612 SurfsharkSetup (5).exe Token: SeSyncAgentPrivilege 612 SurfsharkSetup (5).exe Token: SeEnableDelegationPrivilege 612 SurfsharkSetup (5).exe Token: SeManageVolumePrivilege 612 SurfsharkSetup (5).exe Token: SeImpersonatePrivilege 612 SurfsharkSetup (5).exe Token: SeCreateGlobalPrivilege 612 SurfsharkSetup (5).exe Token: SeCreateTokenPrivilege 612 SurfsharkSetup (5).exe Token: SeAssignPrimaryTokenPrivilege 612 SurfsharkSetup (5).exe Token: SeLockMemoryPrivilege 612 SurfsharkSetup (5).exe Token: SeIncreaseQuotaPrivilege 612 SurfsharkSetup (5).exe Token: SeMachineAccountPrivilege 612 SurfsharkSetup (5).exe Token: SeTcbPrivilege 612 SurfsharkSetup (5).exe Token: SeSecurityPrivilege 612 SurfsharkSetup (5).exe Token: SeTakeOwnershipPrivilege 612 SurfsharkSetup (5).exe Token: SeLoadDriverPrivilege 612 SurfsharkSetup (5).exe Token: SeSystemProfilePrivilege 612 SurfsharkSetup (5).exe Token: SeSystemtimePrivilege 612 SurfsharkSetup (5).exe Token: SeProfSingleProcessPrivilege 612 SurfsharkSetup (5).exe Token: SeIncBasePriorityPrivilege 612 SurfsharkSetup (5).exe Token: SeCreatePagefilePrivilege 612 SurfsharkSetup (5).exe Token: SeCreatePermanentPrivilege 612 SurfsharkSetup (5).exe Token: SeBackupPrivilege 612 SurfsharkSetup (5).exe Token: SeRestorePrivilege 612 SurfsharkSetup (5).exe Token: SeShutdownPrivilege 612 SurfsharkSetup (5).exe Token: SeDebugPrivilege 612 SurfsharkSetup (5).exe Token: SeAuditPrivilege 612 SurfsharkSetup (5).exe Token: SeSystemEnvironmentPrivilege 612 SurfsharkSetup (5).exe Token: SeChangeNotifyPrivilege 612 SurfsharkSetup (5).exe Token: SeRemoteShutdownPrivilege 612 SurfsharkSetup (5).exe Token: SeUndockPrivilege 612 SurfsharkSetup (5).exe Token: SeSyncAgentPrivilege 612 SurfsharkSetup (5).exe Token: SeEnableDelegationPrivilege 612 SurfsharkSetup (5).exe Token: SeManageVolumePrivilege 612 SurfsharkSetup (5).exe Token: SeImpersonatePrivilege 612 SurfsharkSetup (5).exe Token: SeCreateGlobalPrivilege 612 SurfsharkSetup (5).exe Token: SeCreateTokenPrivilege 612 SurfsharkSetup (5).exe Token: SeAssignPrimaryTokenPrivilege 612 SurfsharkSetup (5).exe Token: SeLockMemoryPrivilege 612 SurfsharkSetup (5).exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 612 SurfsharkSetup (5).exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 268 wrote to memory of 956 268 msiexec.exe 30 PID 268 wrote to memory of 956 268 msiexec.exe 30 PID 268 wrote to memory of 956 268 msiexec.exe 30 PID 268 wrote to memory of 956 268 msiexec.exe 30 PID 268 wrote to memory of 956 268 msiexec.exe 30 PID 268 wrote to memory of 956 268 msiexec.exe 30 PID 268 wrote to memory of 956 268 msiexec.exe 30 PID 612 wrote to memory of 1556 612 SurfsharkSetup (5).exe 31 PID 612 wrote to memory of 1556 612 SurfsharkSetup (5).exe 31 PID 612 wrote to memory of 1556 612 SurfsharkSetup (5).exe 31 PID 612 wrote to memory of 1556 612 SurfsharkSetup (5).exe 31 PID 1556 wrote to memory of 1200 1556 cmd.exe 33 PID 1556 wrote to memory of 1200 1556 cmd.exe 33 PID 1556 wrote to memory of 1200 1556 cmd.exe 33 PID 1556 wrote to memory of 1200 1556 cmd.exe 33 PID 1556 wrote to memory of 1652 1556 cmd.exe 34 PID 1556 wrote to memory of 1652 1556 cmd.exe 34 PID 1556 wrote to memory of 1652 1556 cmd.exe 34 PID 1556 wrote to memory of 1652 1556 cmd.exe 34 PID 612 wrote to memory of 1844 612 SurfsharkSetup (5).exe 38 PID 612 wrote to memory of 1844 612 SurfsharkSetup (5).exe 38 PID 612 wrote to memory of 1844 612 SurfsharkSetup (5).exe 38 PID 612 wrote to memory of 1844 612 SurfsharkSetup (5).exe 38 PID 612 wrote to memory of 1844 612 SurfsharkSetup (5).exe 38 PID 612 wrote to memory of 1844 612 SurfsharkSetup (5).exe 38 PID 612 wrote to memory of 1844 612 SurfsharkSetup (5).exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\SurfsharkSetup (5).exe"C:\Users\Admin\AppData\Local\Temp\SurfsharkSetup (5).exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Surfshark\Surfshark 2.7.5000\install\check-KB3033929.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic qfe where "HotFixID = 'KB3033929'"3⤵PID:1200
-
-
C:\Windows\SysWOW64\find.exeFind "KB3033929"3⤵PID:1652
-
-
-
C:\Windows\SysWOW64\wusa.exe"C:\Windows\system32\wusa.exe" "C:\Users\Admin\AppData\Roaming\Surfshark\Surfshark\prerequisites\Windows 7 x64 security update\Windows6.1-KB3033929-x64.msu" /qn2⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:1844
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD89B1A7E19EA717152229C2F1D0A433 C2⤵
- Loads dropped DLL
PID:956
-