Analysis
-
max time kernel
126s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2022 19:24
Behavioral task
behavioral1
Sample
Setup_5.exe
Resource
win7-20220718-en
General
-
Target
Setup_5.exe
-
Size
371.5MB
-
MD5
a0e4befbfe2622bdce245bd8eb19601e
-
SHA1
5f8798d2691e2a367a673c568668c3799eed63f6
-
SHA256
da99f78d0bbddb84823b7d7383a89a8a97211fa9eac24c8e9ebd1813a5899522
-
SHA512
d91583b1aff4e90d1b0b3bd9a346cbdd52b2f88b241848f821d6f2d566580e58c79eb7be497424f4d3e6635078de9ee408d85d600f2ab44ba285fe8c75d125bd
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Setup_5.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup_5.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
08073847789316448587.exepid process 396 08073847789316448587.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setup_5.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup_5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup_5.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup_5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation Setup_5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1500-130-0x0000000000700000-0x00000000014D0000-memory.dmp themida behavioral2/memory/1500-131-0x0000000000700000-0x00000000014D0000-memory.dmp themida behavioral2/memory/1500-137-0x0000000000700000-0x00000000014D0000-memory.dmp themida behavioral2/memory/1500-138-0x0000000000700000-0x00000000014D0000-memory.dmp themida behavioral2/memory/1500-139-0x0000000000700000-0x00000000014D0000-memory.dmp themida behavioral2/memory/1500-140-0x0000000000700000-0x00000000014D0000-memory.dmp themida behavioral2/memory/1500-141-0x0000000000700000-0x00000000014D0000-memory.dmp themida behavioral2/memory/1500-142-0x0000000000700000-0x00000000014D0000-memory.dmp themida behavioral2/memory/1500-165-0x0000000000700000-0x00000000014D0000-memory.dmp themida behavioral2/memory/1500-167-0x0000000000700000-0x00000000014D0000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Setup_5.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup_5.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
Setup_5.exe08073847789316448587.exepid process 1500 Setup_5.exe 396 08073847789316448587.exe 396 08073847789316448587.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4888 396 WerFault.exe 08073847789316448587.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Setup_5.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup_5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup_5.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4800 schtasks.exe 1844 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3704 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1032 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Setup_5.exe08073847789316448587.exepid process 1500 Setup_5.exe 1500 Setup_5.exe 1500 Setup_5.exe 1500 Setup_5.exe 1500 Setup_5.exe 1500 Setup_5.exe 396 08073847789316448587.exe 396 08073847789316448587.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1032 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Setup_5.execmd.exe08073847789316448587.exedescription pid process target process PID 1500 wrote to memory of 396 1500 Setup_5.exe 08073847789316448587.exe PID 1500 wrote to memory of 396 1500 Setup_5.exe 08073847789316448587.exe PID 1500 wrote to memory of 396 1500 Setup_5.exe 08073847789316448587.exe PID 1500 wrote to memory of 4172 1500 Setup_5.exe cmd.exe PID 1500 wrote to memory of 4172 1500 Setup_5.exe cmd.exe PID 1500 wrote to memory of 4172 1500 Setup_5.exe cmd.exe PID 4172 wrote to memory of 1032 4172 cmd.exe taskkill.exe PID 4172 wrote to memory of 1032 4172 cmd.exe taskkill.exe PID 4172 wrote to memory of 1032 4172 cmd.exe taskkill.exe PID 396 wrote to memory of 4800 396 08073847789316448587.exe schtasks.exe PID 396 wrote to memory of 4800 396 08073847789316448587.exe schtasks.exe PID 396 wrote to memory of 4800 396 08073847789316448587.exe schtasks.exe PID 4172 wrote to memory of 3704 4172 cmd.exe timeout.exe PID 4172 wrote to memory of 3704 4172 cmd.exe timeout.exe PID 4172 wrote to memory of 3704 4172 cmd.exe timeout.exe PID 396 wrote to memory of 32 396 08073847789316448587.exe schtasks.exe PID 396 wrote to memory of 32 396 08073847789316448587.exe schtasks.exe PID 396 wrote to memory of 32 396 08073847789316448587.exe schtasks.exe PID 396 wrote to memory of 1844 396 08073847789316448587.exe schtasks.exe PID 396 wrote to memory of 1844 396 08073847789316448587.exe schtasks.exe PID 396 wrote to memory of 1844 396 08073847789316448587.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_5.exe"C:\Users\Admin\AppData\Local\Temp\Setup_5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\08073847789316448587.exe"C:\ProgramData\08073847789316448587.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}"3⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /tn "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\1201824912038.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 5923⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup_5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Setup_5.exe" & del C:\ProgramData\*.dll & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup_5.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 396 -ip 3961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\08073847789316448587.exeFilesize
6.6MB
MD5bee28e19c6b505930e4a49af46bbf869
SHA1f626c6cc69a3854418c91540c4a07ed576ce38f7
SHA256baa189bb50907bd224fea02b937ea59bf05ee6a14ac73c2d34b3c7fd3700148b
SHA512daa39e99f86e163130d566a24a8b5efb5914b787f8518731549ab22c82cc85b59ed3e1b83728e0046721d4dab50deb04a54af46c66eec75e12b6c7667175c3ca
-
C:\ProgramData\08073847789316448587.exeFilesize
6.6MB
MD5bee28e19c6b505930e4a49af46bbf869
SHA1f626c6cc69a3854418c91540c4a07ed576ce38f7
SHA256baa189bb50907bd224fea02b937ea59bf05ee6a14ac73c2d34b3c7fd3700148b
SHA512daa39e99f86e163130d566a24a8b5efb5914b787f8518731549ab22c82cc85b59ed3e1b83728e0046721d4dab50deb04a54af46c66eec75e12b6c7667175c3ca
-
C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\1201824912038.xmlFilesize
1KB
MD57ca3c7fea8fe69ed4a67cfefbe83b674
SHA16042245a47fe3974c263bf7de75302d7c340538f
SHA256e52d3851b9a9cadb6cc9365c50accc6d9709443b5d08bfa140df1825d56893f3
SHA512abe87b227895e9559df5a53011f3458760aebac57f702d0db5c855428a8d4b0f78e7a41adbfc2d148e41639ec5eaa440e488671782e51abd4165c525aaad915e
-
memory/32-174-0x0000000000000000-mapping.dmp
-
memory/396-170-0x0000000000E20000-0x0000000001858000-memory.dmpFilesize
10.2MB
-
memory/396-172-0x0000000000E20000-0x0000000001858000-memory.dmpFilesize
10.2MB
-
memory/396-177-0x0000000000E20000-0x0000000001858000-memory.dmpFilesize
10.2MB
-
memory/396-162-0x0000000000000000-mapping.dmp
-
memory/1032-169-0x0000000000000000-mapping.dmp
-
memory/1500-168-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/1500-136-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/1500-143-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/1500-137-0x0000000000700000-0x00000000014D0000-memory.dmpFilesize
13.8MB
-
memory/1500-130-0x0000000000700000-0x00000000014D0000-memory.dmpFilesize
13.8MB
-
memory/1500-140-0x0000000000700000-0x00000000014D0000-memory.dmpFilesize
13.8MB
-
memory/1500-167-0x0000000000700000-0x00000000014D0000-memory.dmpFilesize
13.8MB
-
memory/1500-131-0x0000000000700000-0x00000000014D0000-memory.dmpFilesize
13.8MB
-
memory/1500-138-0x0000000000700000-0x00000000014D0000-memory.dmpFilesize
13.8MB
-
memory/1500-165-0x0000000000700000-0x00000000014D0000-memory.dmpFilesize
13.8MB
-
memory/1500-142-0x0000000000700000-0x00000000014D0000-memory.dmpFilesize
13.8MB
-
memory/1500-139-0x0000000000700000-0x00000000014D0000-memory.dmpFilesize
13.8MB
-
memory/1500-141-0x0000000000700000-0x00000000014D0000-memory.dmpFilesize
13.8MB
-
memory/1844-175-0x0000000000000000-mapping.dmp
-
memory/3704-173-0x0000000000000000-mapping.dmp
-
memory/4172-166-0x0000000000000000-mapping.dmp
-
memory/4800-171-0x0000000000000000-mapping.dmp