asdfghz.zip

General
Target

Setup.exe

Filesize

554KB

Completed

18-11-2021 23:35

Score
10/10
MD5

d9552a15a61f255df3206b63ee0383be

SHA1

7c76e2edcf184b90d40003dac71b08e3a3ed2e8c

SHA256

0cdd906491990c6ba9c24bdd60172057587859a8e649ba7f4b51fece9a0fdac6

Malware Config
Signatures 13

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    Description

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    Tags

  • Downloads MZ/PE file
  • Executes dropped EXE
    y1_kgpUskgezn9eUT2SsE9W5.exe

    Reported IOCs

    pidprocess
    960y1_kgpUskgezn9eUT2SsE9W5.exe
  • Checks computer location settings
    Setup.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\International\Geo\NationSetup.exe
  • Loads dropped DLL
    Setup.exe

    Reported IOCs

    pidprocess
    1644Setup.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    14ipinfo.io
    15ipinfo.io
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    17481644WerFault.exeSetup.exe
  • Suspicious behavior: EnumeratesProcesses
    Setup.exey1_kgpUskgezn9eUT2SsE9W5.exeWerFault.exe

    Reported IOCs

    pidprocess
    1644Setup.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    1748WerFault.exe
    1748WerFault.exe
    1748WerFault.exe
    1748WerFault.exe
    1748WerFault.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
    960y1_kgpUskgezn9eUT2SsE9W5.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1748WerFault.exe
  • Suspicious use of WriteProcessMemory
    Setup.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1644 wrote to memory of 9601644Setup.exey1_kgpUskgezn9eUT2SsE9W5.exe
    PID 1644 wrote to memory of 9601644Setup.exey1_kgpUskgezn9eUT2SsE9W5.exe
    PID 1644 wrote to memory of 9601644Setup.exey1_kgpUskgezn9eUT2SsE9W5.exe
    PID 1644 wrote to memory of 9601644Setup.exey1_kgpUskgezn9eUT2SsE9W5.exe
    PID 1644 wrote to memory of 17481644Setup.exeWerFault.exe
    PID 1644 wrote to memory of 17481644Setup.exeWerFault.exe
    PID 1644 wrote to memory of 17481644Setup.exeWerFault.exe
    PID 1644 wrote to memory of 17481644Setup.exeWerFault.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    Checks computer location settings
    Loads dropped DLL
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Users\Admin\Pictures\Adobe Films\y1_kgpUskgezn9eUT2SsE9W5.exe
      "C:\Users\Admin\Pictures\Adobe Films\y1_kgpUskgezn9eUT2SsE9W5.exe"
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:960
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 1476
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1748
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Users\Admin\Pictures\Adobe Films\y1_kgpUskgezn9eUT2SsE9W5.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • \Users\Admin\Pictures\Adobe Films\y1_kgpUskgezn9eUT2SsE9W5.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • memory/960-58-0x0000000000000000-mapping.dmp

                • memory/1644-55-0x0000000075B71000-0x0000000075B73000-memory.dmp

                • memory/1644-56-0x0000000003CB0000-0x0000000003E74000-memory.dmp

                • memory/1748-60-0x0000000000000000-mapping.dmp

                • memory/1748-61-0x00000000003B0000-0x00000000003B1000-memory.dmp