461d83b68c5b7afb97eb2a9f21c4622b7b5250a3cd6bab01bde492349f9ecb46

General

Target

SETUP.exe
Size

68KB
MD5

5ab23721f1bb34445823d8fcfa695864
SHA1

91e49d9d5237f24b927b921eb543b5c27ad9236a
SHA256

bb857288a71fb2b24d75aa364c267185f076e696a19760a2de04d325a2fe6cab
SHA512

e567da73431aefcde59879702d8ec36ee28da7f2d399673b3c6a22c412b659d119f2a120bdd7a387933f3ec6a980b6277444be6cedf0e7dce8a0a9dfc0242275

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

SETUP.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation SETUP.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	SETUP.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

InfDefaultInstall.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Wrapper = "runonce"	InfDefaultInstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	InfDefaultInstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Runonce\Setup	InfDefaultInstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup\DriveStar = "RunDll32.exe AdvPack.dll,LaunchINFSection Setup.inf,DefaultInstallRun.ntx86"	InfDefaultInstall.exe

Drops file in System32 directory 2 IoCs

Processes:

SETUP.exe

description ioc process

File created C:\Windows\SysWOW64\W95inf16.dll SETUP.exe
File created C:\Windows\SysWOW64\W95inf32.dll SETUP.exe

description	ioc	process
File created	C:\Windows\SysWOW64\W95inf16.dll	SETUP.exe
File created	C:\Windows\SysWOW64\W95inf32.dll	SETUP.exe

Drops file in Program Files directory 32 IoCs

Processes:

RunDll32.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\DriveStar\SET3C8C.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET3C8C.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET3CC1.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET3CC3.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET3CC4.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET3C9D.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET3CC3.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET3CC2.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET3C9C.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\DSDOS.HLP	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET3C9D.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET3CB0.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\FreeDOS.bin	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET3CC1.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\DSWin.hlp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET3CC2.tmp	RunDll32.exe
File created	C:\Program Files (x86)\TMP4352$.TMP	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\DSDOS.EXE	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\ReadMe.txt	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET3CAF.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET3CB0.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\Setup.inf	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\Manual.pdf	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\DSWin.exe	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\TMP4352$.TMP	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET3C9E.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET3CC4.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET3C9C.tmp	RunDll32.exe
File created	C:\Program Files (x86)\DriveStar\SET3C9E.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\Order.txt	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\SET3CAF.tmp	RunDll32.exe
File opened for modification	C:\Program Files (x86)\DriveStar\DSWin.cnt	RunDll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exerunonce.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe

Modifies registry class 1 IoCs

Processes:

SETUP.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings SETUP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	SETUP.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SETUP.exeInfDefaultInstall.exerunonce.exerunonce.exe

description	pid	process	target process
PID 1224 wrote to memory of 2228	1224	SETUP.exe	InfDefaultInstall.exe
PID 1224 wrote to memory of 2228	1224	SETUP.exe	InfDefaultInstall.exe
PID 1224 wrote to memory of 2228	1224	SETUP.exe	InfDefaultInstall.exe
PID 2228 wrote to memory of 4036	2228	InfDefaultInstall.exe	runonce.exe
PID 2228 wrote to memory of 4036	2228	InfDefaultInstall.exe	runonce.exe
PID 2228 wrote to memory of 4036	2228	InfDefaultInstall.exe	runonce.exe
PID 4036 wrote to memory of 4764	4036	runonce.exe	runonce.exe
PID 4036 wrote to memory of 4764	4036	runonce.exe	runonce.exe
PID 4036 wrote to memory of 4764	4036	runonce.exe	runonce.exe
PID 4764 wrote to memory of 4164	4764	runonce.exe	RunDll32.exe
PID 4764 wrote to memory of 4164	4764	runonce.exe	RunDll32.exe
PID 4764 wrote to memory of 4164	4764	runonce.exe	RunDll32.exe

C:\Users\Admin\AppData\Local\Temp\SETUP.exe
"C:\Users\Admin\AppData\Local\Temp\SETUP.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\InfDefaultInstall.exe
"C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\Admin\AppData\Local\Temp\SETUP.INF"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\runonce.exe
"C:\Windows\system32\runonce.exe" -r
3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\SysWOW64\runonce.exe
"C:\Windows\System32\runonce.exe"
4⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\SysWOW64\RunDll32.exe
RunDll32.exe AdvPack.dll,LaunchINFSection Setup.inf,DefaultInstallRun.ntx86
5⤵
- Drops file in Program Files directory
PID:4164