Analysis
-
max time kernel
151s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
19/11/2021, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-en-20211104
0 signatures
0 seconds
General
-
Target
Setup.exe
-
Size
554KB
-
MD5
d9552a15a61f255df3206b63ee0383be
-
SHA1
7c76e2edcf184b90d40003dac71b08e3a3ed2e8c
-
SHA256
0cdd906491990c6ba9c24bdd60172057587859a8e649ba7f4b51fece9a0fdac6
-
SHA512
0ce1db824d226df28177b6e5394fa1f8483333583d8332680d4cf0cfc8627a53d69c1c857b319dd200e0f38bf88d445a4289d78472fe3167cc39ae6a85f21599
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\International\Geo\Nation Setup.exe -
Loads dropped DLL 1 IoCs
pid Process 1456 Setup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ipinfo.io 14 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1736 1456 WerFault.exe 26 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1456 Setup.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe 1836 z2MNC5GcuS6WvqYMU5aQv5Q_.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1736 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1456 wrote to memory of 1836 1456 Setup.exe 30 PID 1456 wrote to memory of 1836 1456 Setup.exe 30 PID 1456 wrote to memory of 1836 1456 Setup.exe 30 PID 1456 wrote to memory of 1836 1456 Setup.exe 30 PID 1456 wrote to memory of 1736 1456 Setup.exe 31 PID 1456 wrote to memory of 1736 1456 Setup.exe 31 PID 1456 wrote to memory of 1736 1456 Setup.exe 31 PID 1456 wrote to memory of 1736 1456 Setup.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\Pictures\Adobe Films\z2MNC5GcuS6WvqYMU5aQv5Q_.exe"C:\Users\Admin\Pictures\Adobe Films\z2MNC5GcuS6WvqYMU5aQv5Q_.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 14842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736
-