Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2022 19:20
Behavioral task
behavioral1
Sample
Setup_3.exe
Resource
win7-20220718-en
General
-
Target
Setup_3.exe
-
Size
386.2MB
-
MD5
a8b08bd8aeed8e21b5980c2a8f68a73a
-
SHA1
284096cc1f85ec1c6bc96afde0b6a200124b2b19
-
SHA256
8646d12ad525262b59762afac1e66d2b145b88575ab6c2c3c82f0dd85fa99a83
-
SHA512
feb882a018d8364be6d26f69024f7279b7a72de80f1e9f76d9a20d67a04731d15aa1247ee43c9e4f4ef02c0af3253de6c00a76e025e8668cc09f88fa32eb4574
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Setup_3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup_3.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setup_3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup_3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup_3.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup_3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation Setup_3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2268-132-0x0000000000E10000-0x0000000001B90000-memory.dmp themida behavioral2/memory/2268-134-0x0000000000E10000-0x0000000001B90000-memory.dmp themida behavioral2/memory/2268-139-0x0000000000E10000-0x0000000001B90000-memory.dmp themida behavioral2/memory/2268-140-0x0000000000E10000-0x0000000001B90000-memory.dmp themida behavioral2/memory/2268-141-0x0000000000E10000-0x0000000001B90000-memory.dmp themida behavioral2/memory/2268-142-0x0000000000E10000-0x0000000001B90000-memory.dmp themida behavioral2/memory/2268-143-0x0000000000E10000-0x0000000001B90000-memory.dmp themida behavioral2/memory/2268-145-0x0000000000E10000-0x0000000001B90000-memory.dmp themida behavioral2/memory/2268-165-0x0000000000E10000-0x0000000001B90000-memory.dmp themida behavioral2/memory/2268-166-0x0000000000E10000-0x0000000001B90000-memory.dmp themida behavioral2/memory/2268-169-0x0000000000E10000-0x0000000001B90000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Setup_3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup_3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Setup_3.exepid process 2268 Setup_3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Setup_3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup_3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup_3.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2068 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3112 taskkill.exe -
Modifies registry class 2 IoCs
Processes:
Setup_3.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000_Classes\Local Settings Setup_3.exe Key created \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Setup_3.exepid process 2268 Setup_3.exe 2268 Setup_3.exe 2268 Setup_3.exe 2268 Setup_3.exe 2268 Setup_3.exe 2268 Setup_3.exe 2268 Setup_3.exe 2268 Setup_3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3112 taskkill.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3692 OpenWith.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Setup_3.execmd.exedescription pid process target process PID 2268 wrote to memory of 1260 2268 Setup_3.exe cmd.exe PID 2268 wrote to memory of 1260 2268 Setup_3.exe cmd.exe PID 2268 wrote to memory of 1260 2268 Setup_3.exe cmd.exe PID 1260 wrote to memory of 3112 1260 cmd.exe taskkill.exe PID 1260 wrote to memory of 3112 1260 cmd.exe taskkill.exe PID 1260 wrote to memory of 3112 1260 cmd.exe taskkill.exe PID 1260 wrote to memory of 2068 1260 cmd.exe timeout.exe PID 1260 wrote to memory of 2068 1260 cmd.exe timeout.exe PID 1260 wrote to memory of 2068 1260 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_3.exe"C:\Users\Admin\AppData\Local\Temp\Setup_3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Setup_3.exe" & del C:\ProgramData\*.dll & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup_3.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1260-168-0x0000000000000000-mapping.dmp
-
memory/2068-172-0x0000000000000000-mapping.dmp
-
memory/2268-145-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-146-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/2268-141-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-142-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-143-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-144-0x0000000077380000-0x0000000077523000-memory.dmpFilesize
1.6MB
-
memory/2268-132-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-140-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-165-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-166-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-167-0x0000000077380000-0x0000000077523000-memory.dmpFilesize
1.6MB
-
memory/2268-139-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-169-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-134-0x0000000000E10000-0x0000000001B90000-memory.dmpFilesize
13.5MB
-
memory/2268-171-0x0000000077380000-0x0000000077523000-memory.dmpFilesize
1.6MB
-
memory/3112-170-0x0000000000000000-mapping.dmp