461d83b68c5b7afb97eb2a9f21c4622b7b5250a3cd6bab01bde492349f9ecb46

General

Target

SETUP.exe
Size

68KB
MD5

5ab23721f1bb34445823d8fcfa695864
SHA1

91e49d9d5237f24b927b921eb543b5c27ad9236a
SHA256

bb857288a71fb2b24d75aa364c267185f076e696a19760a2de04d325a2fe6cab
SHA512

e567da73431aefcde59879702d8ec36ee28da7f2d399673b3c6a22c412b659d119f2a120bdd7a387933f3ec6a980b6277444be6cedf0e7dce8a0a9dfc0242275

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

InfDefaultInstall.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup\DriveStar = "RunDll32.exe AdvPack.dll,LaunchINFSection Setup.inf,DefaultInstallRun.ntx86"	InfDefaultInstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Wrapper = "runonce"	InfDefaultInstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	InfDefaultInstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Runonce\Setup	InfDefaultInstall.exe

Drops file in System32 directory 2 IoCs

Processes:

SETUP.exe

description ioc process

File created C:\Windows\SysWOW64\W95inf16.dll SETUP.exe
File created C:\Windows\SysWOW64\W95inf32.dll SETUP.exe

description	ioc	process
File created	C:\Windows\SysWOW64\W95inf16.dll	SETUP.exe
File created	C:\Windows\SysWOW64\W95inf32.dll	SETUP.exe

Drops file in Program Files directory 32 IoCs

Processes:

RunDll32.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\DriveStar\Setup.inf	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\TMP4352$.TMP	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET938.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET94A.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET95C.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET95D.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET926.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\ReadMe.txt	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET939.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET94A.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET95C.tmp	RunDll32.exe
File created	C:\Program Files (x86)\TMP4352$.TMP	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET926.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET937.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET95B.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET936.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\DSDOS.HLP	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET94B.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET95D.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\DSDOS.EXE	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET938.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\Manual.pdf	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\FreeDOS.bin	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET94B.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\DSWin.hlp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET95B.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\DSWin.cnt	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\DSWin.exe	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET936.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET937.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\Order.txt	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET939.tmp	RunDll32.exe

Drops file in Windows directory 2 IoCs

Processes:

RunDll32.exeInfDefaultInstall.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.app.log	RunDll32.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	InfDefaultInstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exerunonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

InfDefaultInstall.exeRunDll32.exe

description	pid	process
Token: SeRestorePrivilege	932	InfDefaultInstall.exe
Token: SeRestorePrivilege	932	InfDefaultInstall.exe
Token: SeRestorePrivilege	932	InfDefaultInstall.exe
Token: SeRestorePrivilege	932	InfDefaultInstall.exe
Token: SeRestorePrivilege	932	InfDefaultInstall.exe
Token: SeRestorePrivilege	932	InfDefaultInstall.exe
Token: SeRestorePrivilege	932	InfDefaultInstall.exe
Token: SeRestorePrivilege	1104	RunDll32.exe
Token: SeRestorePrivilege	1104	RunDll32.exe
Token: SeRestorePrivilege	1104	RunDll32.exe
Token: SeRestorePrivilege	1104	RunDll32.exe
Token: SeRestorePrivilege	1104	RunDll32.exe
Token: SeRestorePrivilege	1104	RunDll32.exe
Token: SeRestorePrivilege	1104	RunDll32.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

SETUP.exeInfDefaultInstall.exerunonce.exerunonce.exe

description	pid	process	target process
PID 1648 wrote to memory of 932	1648	SETUP.exe	InfDefaultInstall.exe
PID 1648 wrote to memory of 932	1648	SETUP.exe	InfDefaultInstall.exe
PID 1648 wrote to memory of 932	1648	SETUP.exe	InfDefaultInstall.exe
PID 1648 wrote to memory of 932	1648	SETUP.exe	InfDefaultInstall.exe
PID 1648 wrote to memory of 932	1648	SETUP.exe	InfDefaultInstall.exe
PID 1648 wrote to memory of 932	1648	SETUP.exe	InfDefaultInstall.exe
PID 1648 wrote to memory of 932	1648	SETUP.exe	InfDefaultInstall.exe
PID 932 wrote to memory of 992	932	InfDefaultInstall.exe	runonce.exe
PID 932 wrote to memory of 992	932	InfDefaultInstall.exe	runonce.exe
PID 932 wrote to memory of 992	932	InfDefaultInstall.exe	runonce.exe
PID 932 wrote to memory of 992	932	InfDefaultInstall.exe	runonce.exe
PID 932 wrote to memory of 992	932	InfDefaultInstall.exe	runonce.exe
PID 932 wrote to memory of 992	932	InfDefaultInstall.exe	runonce.exe
PID 932 wrote to memory of 992	932	InfDefaultInstall.exe	runonce.exe
PID 992 wrote to memory of 1208	992	runonce.exe	runonce.exe
PID 992 wrote to memory of 1208	992	runonce.exe	runonce.exe
PID 992 wrote to memory of 1208	992	runonce.exe	runonce.exe
PID 992 wrote to memory of 1208	992	runonce.exe	runonce.exe
PID 992 wrote to memory of 1208	992	runonce.exe	runonce.exe
PID 992 wrote to memory of 1208	992	runonce.exe	runonce.exe
PID 992 wrote to memory of 1208	992	runonce.exe	runonce.exe
PID 1208 wrote to memory of 1104	1208	runonce.exe	RunDll32.exe
PID 1208 wrote to memory of 1104	1208	runonce.exe	RunDll32.exe
PID 1208 wrote to memory of 1104	1208	runonce.exe	RunDll32.exe
PID 1208 wrote to memory of 1104	1208	runonce.exe	RunDll32.exe
PID 1208 wrote to memory of 1104	1208	runonce.exe	RunDll32.exe
PID 1208 wrote to memory of 1104	1208	runonce.exe	RunDll32.exe
PID 1208 wrote to memory of 1104	1208	runonce.exe	RunDll32.exe

C:\Users\Admin\AppData\Local\Temp\SETUP.exe
"C:\Users\Admin\AppData\Local\Temp\SETUP.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\InfDefaultInstall.exe
"C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\Admin\AppData\Local\Temp\SETUP.INF"
2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\runonce.exe
"C:\Windows\system32\runonce.exe" -r
3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\runonce.exe
"C:\Windows\System32\runonce.exe"
4⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\RunDll32.exe
RunDll32.exe AdvPack.dll,LaunchINFSection Setup.inf,DefaultInstallRun.ntx86
5⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1104

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-55-0x0000000000000000-mapping.dmp

Download
memory/992-57-0x0000000000000000-mapping.dmp

Download
memory/1104-61-0x0000000000000000-mapping.dmp

Download
memory/1208-59-0x0000000000000000-mapping.dmp

Download
memory/1648-54-0x00000000755C1000-0x00000000755C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads