Analysis
-
max time kernel
319s -
max time network
1818s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 15:46
Static task
static1
Behavioral task
behavioral1
Sample
OpenSea-App_v2.1-setup.exe
Resource
win7-ja-20211014
Behavioral task
behavioral2
Sample
OpenSea-App_v2.1-setup.exe
Resource
win7-en-20210920
Behavioral task
behavioral3
Sample
OpenSea-App_v2.1-setup.exe
Resource
win7-de-20211014
Behavioral task
behavioral4
Sample
OpenSea-App_v2.1-setup.exe
Resource
win11
Behavioral task
behavioral5
Sample
OpenSea-App_v2.1-setup.exe
Resource
win10-ja-20211014
Behavioral task
behavioral6
Sample
OpenSea-App_v2.1-setup.exe
Resource
win10-en-20210920
Behavioral task
behavioral7
Sample
OpenSea-App_v2.1-setup.exe
Resource
win10-de-20210920
General
-
Target
OpenSea-App_v2.1-setup.exe
-
Size
116.4MB
-
MD5
b188206887e0f25a50c50e1955413442
-
SHA1
3f4fcd1debd12586f712d694218339a7fd40c50b
-
SHA256
de644e637da7cd117517b1bb96ee0f58131515013a322366d680f613afa31bc4
-
SHA512
94391442364c2e6a16a2fd0bd2384d0f21a56cd5a67faa7998511ebb55feb3e5a7915c603c2caaa8da79f8bdfc1490eb2a8f559546193977b239a2d133bf3624
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
OpenSea-App_v2.1-setup.tmpOpenSea-App_v2.1-setup.tmpuniconverter.exepid process 2260 OpenSea-App_v2.1-setup.tmp 3500 OpenSea-App_v2.1-setup.tmp 3868 uniconverter.exe -
Loads dropped DLL 1 IoCs
Processes:
uniconverter.exepid process 3868 uniconverter.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
uniconverter.exepid process 3868 uniconverter.exe 3868 uniconverter.exe 3868 uniconverter.exe 3868 uniconverter.exe 3868 uniconverter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
OpenSea-App_v2.1-setup.tmppid process 3500 OpenSea-App_v2.1-setup.tmp 3500 OpenSea-App_v2.1-setup.tmp -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
uniconverter.exedescription pid process Token: SeShutdownPrivilege 3868 uniconverter.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
OpenSea-App_v2.1-setup.tmppid process 3500 OpenSea-App_v2.1-setup.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
uniconverter.exepid process 3868 uniconverter.exe 3868 uniconverter.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
OpenSea-App_v2.1-setup.exeOpenSea-App_v2.1-setup.tmpOpenSea-App_v2.1-setup.exeOpenSea-App_v2.1-setup.tmpdescription pid process target process PID 2116 wrote to memory of 2260 2116 OpenSea-App_v2.1-setup.exe OpenSea-App_v2.1-setup.tmp PID 2116 wrote to memory of 2260 2116 OpenSea-App_v2.1-setup.exe OpenSea-App_v2.1-setup.tmp PID 2116 wrote to memory of 2260 2116 OpenSea-App_v2.1-setup.exe OpenSea-App_v2.1-setup.tmp PID 2260 wrote to memory of 868 2260 OpenSea-App_v2.1-setup.tmp OpenSea-App_v2.1-setup.exe PID 2260 wrote to memory of 868 2260 OpenSea-App_v2.1-setup.tmp OpenSea-App_v2.1-setup.exe PID 2260 wrote to memory of 868 2260 OpenSea-App_v2.1-setup.tmp OpenSea-App_v2.1-setup.exe PID 868 wrote to memory of 3500 868 OpenSea-App_v2.1-setup.exe OpenSea-App_v2.1-setup.tmp PID 868 wrote to memory of 3500 868 OpenSea-App_v2.1-setup.exe OpenSea-App_v2.1-setup.tmp PID 868 wrote to memory of 3500 868 OpenSea-App_v2.1-setup.exe OpenSea-App_v2.1-setup.tmp PID 3500 wrote to memory of 3868 3500 OpenSea-App_v2.1-setup.tmp uniconverter.exe PID 3500 wrote to memory of 3868 3500 OpenSea-App_v2.1-setup.tmp uniconverter.exe PID 3500 wrote to memory of 3868 3500 OpenSea-App_v2.1-setup.tmp uniconverter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OpenSea-App_v2.1-setup.exe"C:\Users\Admin\AppData\Local\Temp\OpenSea-App_v2.1-setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0QDCC.tmp\OpenSea-App_v2.1-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-0QDCC.tmp\OpenSea-App_v2.1-setup.tmp" /SL5="$3010E,121164526,934400,C:\Users\Admin\AppData\Local\Temp\OpenSea-App_v2.1-setup.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OpenSea-App_v2.1-setup.exe"C:\Users\Admin\AppData\Local\Temp\OpenSea-App_v2.1-setup.exe" /VERYSILENT /NORESTART3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-360D0.tmp\OpenSea-App_v2.1-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-360D0.tmp\OpenSea-App_v2.1-setup.tmp" /SL5="$4010E,121164526,934400,C:\Users\Admin\AppData\Local\Temp\OpenSea-App_v2.1-setup.exe" /VERYSILENT /NORESTART4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Network UniConverter Management 13\uniconverter.exe"C:\Users\Admin\AppData\Roaming\Network UniConverter Management 13\uniconverter.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-0QDCC.tmp\OpenSea-App_v2.1-setup.tmpMD5
1d58a53221a0e00ae086d5727f5e97a8
SHA1425d12467917bb82dd3f67f43e0c7178b0993aa3
SHA2563865953f354379ea7e66e28ae265915deffcda296048430027e0e6931ffa657d
SHA5128afd7f6f114125d32a3724f0a0a51b9b7a7eae12f8844b59d74a61bde886055c7db5f043ed33263521adb0847f8523f1b2b183fd848b098c57d7ad328fe818e8
-
C:\Users\Admin\AppData\Local\Temp\is-360D0.tmp\OpenSea-App_v2.1-setup.tmpMD5
1d58a53221a0e00ae086d5727f5e97a8
SHA1425d12467917bb82dd3f67f43e0c7178b0993aa3
SHA2563865953f354379ea7e66e28ae265915deffcda296048430027e0e6931ffa657d
SHA5128afd7f6f114125d32a3724f0a0a51b9b7a7eae12f8844b59d74a61bde886055c7db5f043ed33263521adb0847f8523f1b2b183fd848b098c57d7ad328fe818e8
-
C:\Users\Admin\AppData\Roaming\Network UniConverter Management 13\JdbcOdbc.dllMD5
791791c0e466eb0a6af462a265074c9d
SHA1db4e66209bd211ddc0378c0f62e644eb466cde0e
SHA256187d0a87805102aaacfdb0e18ea84a90af1540529e92430f84e3f46736383fc7
SHA512badbe604c1e99b848dbb184a1d081560a31749a89573a4c6202abec1c6aa670ca248a0e5cd9330a7c3fc90193f3f95cde6a9d44c881568ca1a9b3b063da68566
-
C:\Users\Admin\AppData\Roaming\Network UniConverter Management 13\menMD5
a6448d8d59e1745612001ce13359bb30
SHA140715399ee65505ae77adf615cc8ea0921e44956
SHA2562739158b312b0c2185c3481586d3e9498cf1f9440ad8144deae3ffad9a491e85
SHA5123eb5cadf18f31c059cb3335c7a7e07eda947760d37b424c60ea296c05c57e285caed879773d9ab901eaab48e3732a58bb9acb627d26d79a7e32836cb1078acc7
-
C:\Users\Admin\AppData\Roaming\Network UniConverter Management 13\uniconverter.exeMD5
7c874ddc2e0689786d7635aa25326b4c
SHA1f7654000b1d39b8f88d4b98159c54e124cbb00d6
SHA256445c90f61dd0d7897475a7675d213b5d2819487f7bf665751fd4d352ba4a8752
SHA512bd4a786a1b4f9fa552991e90ce0bfcb0951a01bbecd5c0b579c0b6804a978e4285695cbad48975979f9b8cdb56e2b28fb5d27a3aa21760aa9bd09c23fa2b64f3
-
C:\Users\Admin\AppData\Roaming\Network UniConverter Management 13\uniconverter.exeMD5
7c874ddc2e0689786d7635aa25326b4c
SHA1f7654000b1d39b8f88d4b98159c54e124cbb00d6
SHA256445c90f61dd0d7897475a7675d213b5d2819487f7bf665751fd4d352ba4a8752
SHA512bd4a786a1b4f9fa552991e90ce0bfcb0951a01bbecd5c0b579c0b6804a978e4285695cbad48975979f9b8cdb56e2b28fb5d27a3aa21760aa9bd09c23fa2b64f3
-
\Users\Admin\AppData\Roaming\Network UniConverter Management 13\JdbcOdbc.dllMD5
791791c0e466eb0a6af462a265074c9d
SHA1db4e66209bd211ddc0378c0f62e644eb466cde0e
SHA256187d0a87805102aaacfdb0e18ea84a90af1540529e92430f84e3f46736383fc7
SHA512badbe604c1e99b848dbb184a1d081560a31749a89573a4c6202abec1c6aa670ca248a0e5cd9330a7c3fc90193f3f95cde6a9d44c881568ca1a9b3b063da68566
-
memory/868-121-0x0000000000000000-mapping.dmp
-
memory/868-126-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/2116-117-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/2260-120-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/2260-118-0x0000000000000000-mapping.dmp
-
memory/3500-127-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/3500-124-0x0000000000000000-mapping.dmp
-
memory/3868-128-0x0000000000000000-mapping.dmp