Analysis
-
max time kernel
51s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
24-10-2021 03:07
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-en-20211014
General
-
Target
setup.exe
-
Size
379KB
-
MD5
3329dc6e93761fd9597063f368ea952c
-
SHA1
bc1e6f6a5d19ae794547f3c7e78f6bc0dadc7d3f
-
SHA256
cc5c6a78feac84ff7936e15863c4d4b02cab421b8c09c4735212bf8dbb07adfb
-
SHA512
9ac13f9f210d87fa29ebc5c9440abc43550a045ea9816d21b1ea8f0532d4dbe262e6842a1dddbcd61eb40cab9b62f7c2f1e8ad361c7cca7a6a84230be3bdfda9
Malware Config
Signatures
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
setup.tmpsetup.tmppostback.exepid process 1268 setup.tmp 420 setup.tmp 2740 postback.exe -
Loads dropped DLL 2 IoCs
Processes:
setup.tmpsetup.tmppid process 1268 setup.tmp 420 setup.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
Processes:
setup.tmpdescription ioc process File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-5JMOJ.tmp setup.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
setup.tmppid process 420 setup.tmp 420 setup.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
setup.tmppid process 420 setup.tmp -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
setup.exesetup.tmpsetup.exesetup.tmpdescription pid process target process PID 4004 wrote to memory of 1268 4004 setup.exe setup.tmp PID 4004 wrote to memory of 1268 4004 setup.exe setup.tmp PID 4004 wrote to memory of 1268 4004 setup.exe setup.tmp PID 1268 wrote to memory of 2936 1268 setup.tmp setup.exe PID 1268 wrote to memory of 2936 1268 setup.tmp setup.exe PID 1268 wrote to memory of 2936 1268 setup.tmp setup.exe PID 2936 wrote to memory of 420 2936 setup.exe setup.tmp PID 2936 wrote to memory of 420 2936 setup.exe setup.tmp PID 2936 wrote to memory of 420 2936 setup.exe setup.tmp PID 420 wrote to memory of 2740 420 setup.tmp postback.exe PID 420 wrote to memory of 2740 420 setup.tmp postback.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-44575.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-44575.tmp\setup.tmp" /SL5="$40048,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H7BJ1.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-H7BJ1.tmp\setup.tmp" /SL5="$5013A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-T2BU1.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-T2BU1.tmp\postback.exe" ss15⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-44575.tmp\setup.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-44575.tmp\setup.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-H7BJ1.tmp\setup.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-H7BJ1.tmp\setup.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-T2BU1.tmp\postback.exeMD5
b3bb91ad96f2d4c041861ce59ba6ac73
SHA1e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3
SHA2560581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426
SHA512e3a8426d202a8aad79aad5d75549753cf70b9c2c0fa4c9468f03d089eca8e529b56cd8fa16b7be3a4cfc019d43ff458b9dc8a1cae44b6ed75e27f21489a2cbdd
-
C:\Users\Admin\AppData\Local\Temp\is-T2BU1.tmp\postback.exeMD5
b3bb91ad96f2d4c041861ce59ba6ac73
SHA1e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3
SHA2560581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426
SHA512e3a8426d202a8aad79aad5d75549753cf70b9c2c0fa4c9468f03d089eca8e529b56cd8fa16b7be3a4cfc019d43ff458b9dc8a1cae44b6ed75e27f21489a2cbdd
-
\Users\Admin\AppData\Local\Temp\is-M9JRV.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
\Users\Admin\AppData\Local\Temp\is-T2BU1.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
memory/420-124-0x0000000000000000-mapping.dmp
-
memory/420-129-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1268-121-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1268-117-0x0000000000000000-mapping.dmp
-
memory/2740-130-0x0000000000000000-mapping.dmp
-
memory/2936-122-0x0000000000000000-mapping.dmp
-
memory/2936-128-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4004-116-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB