Analysis
-
max time kernel
128s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2022 19:15
Behavioral task
behavioral1
Sample
Setup_13.exe
Resource
win7-20220715-en
General
-
Target
Setup_13.exe
-
Size
371.6MB
-
MD5
6dca4c6fbbc71f493212ee52a8de5de7
-
SHA1
9c0bcb01b9c892a36d93a667eb554652d0881a29
-
SHA256
85ba0f7790c50a07ef1cb227c452074fd3bfc7a3e94a6a7479bdb8470399086b
-
SHA512
ea82e353d81b79285c9898234821efe425529ad1d4b9afcb07cceaff63c836b6616ac7b3850627d2be1dcbb93e40b439fcb337eab1809c9a31befaead13b6cd8
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Setup_13.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup_13.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
68981716335091769820.exepid process 1320 68981716335091769820.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setup_13.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup_13.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup_13.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup_13.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation Setup_13.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4060-130-0x0000000000590000-0x00000000013AB000-memory.dmp themida behavioral2/memory/4060-136-0x0000000000590000-0x00000000013AB000-memory.dmp themida behavioral2/memory/4060-137-0x0000000000590000-0x00000000013AB000-memory.dmp themida behavioral2/memory/4060-138-0x0000000000590000-0x00000000013AB000-memory.dmp themida behavioral2/memory/4060-139-0x0000000000590000-0x00000000013AB000-memory.dmp themida behavioral2/memory/4060-140-0x0000000000590000-0x00000000013AB000-memory.dmp themida behavioral2/memory/4060-141-0x0000000000590000-0x00000000013AB000-memory.dmp themida behavioral2/memory/4060-164-0x0000000000590000-0x00000000013AB000-memory.dmp themida behavioral2/memory/4060-166-0x0000000000590000-0x00000000013AB000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Setup_13.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup_13.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
Setup_13.exe68981716335091769820.exepid process 4060 Setup_13.exe 1320 68981716335091769820.exe 1320 68981716335091769820.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3492 1320 WerFault.exe 68981716335091769820.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Setup_13.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup_13.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup_13.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3152 schtasks.exe 2128 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 396 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3368 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Setup_13.exe68981716335091769820.exepid process 4060 Setup_13.exe 4060 Setup_13.exe 4060 Setup_13.exe 4060 Setup_13.exe 4060 Setup_13.exe 4060 Setup_13.exe 1320 68981716335091769820.exe 1320 68981716335091769820.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3368 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Setup_13.execmd.exe68981716335091769820.exedescription pid process target process PID 4060 wrote to memory of 1320 4060 Setup_13.exe 68981716335091769820.exe PID 4060 wrote to memory of 1320 4060 Setup_13.exe 68981716335091769820.exe PID 4060 wrote to memory of 1320 4060 Setup_13.exe 68981716335091769820.exe PID 4060 wrote to memory of 2328 4060 Setup_13.exe cmd.exe PID 4060 wrote to memory of 2328 4060 Setup_13.exe cmd.exe PID 4060 wrote to memory of 2328 4060 Setup_13.exe cmd.exe PID 2328 wrote to memory of 3368 2328 cmd.exe taskkill.exe PID 2328 wrote to memory of 3368 2328 cmd.exe taskkill.exe PID 2328 wrote to memory of 3368 2328 cmd.exe taskkill.exe PID 1320 wrote to memory of 2128 1320 68981716335091769820.exe schtasks.exe PID 1320 wrote to memory of 2128 1320 68981716335091769820.exe schtasks.exe PID 1320 wrote to memory of 2128 1320 68981716335091769820.exe schtasks.exe PID 2328 wrote to memory of 396 2328 cmd.exe timeout.exe PID 2328 wrote to memory of 396 2328 cmd.exe timeout.exe PID 2328 wrote to memory of 396 2328 cmd.exe timeout.exe PID 1320 wrote to memory of 1764 1320 68981716335091769820.exe schtasks.exe PID 1320 wrote to memory of 1764 1320 68981716335091769820.exe schtasks.exe PID 1320 wrote to memory of 1764 1320 68981716335091769820.exe schtasks.exe PID 1320 wrote to memory of 3152 1320 68981716335091769820.exe schtasks.exe PID 1320 wrote to memory of 3152 1320 68981716335091769820.exe schtasks.exe PID 1320 wrote to memory of 3152 1320 68981716335091769820.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_13.exe"C:\Users\Admin\AppData\Local\Temp\Setup_13.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\68981716335091769820.exe"C:\ProgramData\68981716335091769820.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}"3⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /tn "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\1201824912038.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 4963⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup_13.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Setup_13.exe" & del C:\ProgramData\*.dll & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup_13.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1320 -ip 13201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\68981716335091769820.exeFilesize
6.6MB
MD5bee28e19c6b505930e4a49af46bbf869
SHA1f626c6cc69a3854418c91540c4a07ed576ce38f7
SHA256baa189bb50907bd224fea02b937ea59bf05ee6a14ac73c2d34b3c7fd3700148b
SHA512daa39e99f86e163130d566a24a8b5efb5914b787f8518731549ab22c82cc85b59ed3e1b83728e0046721d4dab50deb04a54af46c66eec75e12b6c7667175c3ca
-
C:\ProgramData\68981716335091769820.exeFilesize
6.6MB
MD5bee28e19c6b505930e4a49af46bbf869
SHA1f626c6cc69a3854418c91540c4a07ed576ce38f7
SHA256baa189bb50907bd224fea02b937ea59bf05ee6a14ac73c2d34b3c7fd3700148b
SHA512daa39e99f86e163130d566a24a8b5efb5914b787f8518731549ab22c82cc85b59ed3e1b83728e0046721d4dab50deb04a54af46c66eec75e12b6c7667175c3ca
-
C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\1201824912038.xmlFilesize
1KB
MD58847144a4137de906757be07feaecbc4
SHA127f42df7c5c4a872d5859773addc59c2bb7b05ee
SHA256d5561bd1e5998a84bdca575d481cd667b9e91942cc38539ef04089a8c1b6ac28
SHA51276621995e96ac04d3ffc3ed2d5e8e859cdaa445465385752da796a4aeb8a7b7c35c54afacc367789dfa5cc66dc201447697c2ca428fc02c272f68c3b9edda77c
-
memory/396-171-0x0000000000000000-mapping.dmp
-
memory/1320-161-0x0000000000000000-mapping.dmp
-
memory/1320-172-0x0000000000B10000-0x0000000001548000-memory.dmpFilesize
10.2MB
-
memory/1320-169-0x0000000000B10000-0x0000000001548000-memory.dmpFilesize
10.2MB
-
memory/1320-176-0x0000000000B10000-0x0000000001548000-memory.dmpFilesize
10.2MB
-
memory/1764-173-0x0000000000000000-mapping.dmp
-
memory/2128-170-0x0000000000000000-mapping.dmp
-
memory/2328-165-0x0000000000000000-mapping.dmp
-
memory/3152-174-0x0000000000000000-mapping.dmp
-
memory/3368-168-0x0000000000000000-mapping.dmp
-
memory/4060-140-0x0000000000590000-0x00000000013AB000-memory.dmpFilesize
14.1MB
-
memory/4060-166-0x0000000000590000-0x00000000013AB000-memory.dmpFilesize
14.1MB
-
memory/4060-167-0x00000000771F0000-0x0000000077393000-memory.dmpFilesize
1.6MB
-
memory/4060-164-0x0000000000590000-0x00000000013AB000-memory.dmpFilesize
14.1MB
-
memory/4060-142-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/4060-141-0x0000000000590000-0x00000000013AB000-memory.dmpFilesize
14.1MB
-
memory/4060-130-0x0000000000590000-0x00000000013AB000-memory.dmpFilesize
14.1MB
-
memory/4060-139-0x0000000000590000-0x00000000013AB000-memory.dmpFilesize
14.1MB
-
memory/4060-138-0x0000000000590000-0x00000000013AB000-memory.dmpFilesize
14.1MB
-
memory/4060-137-0x0000000000590000-0x00000000013AB000-memory.dmpFilesize
14.1MB
-
memory/4060-136-0x0000000000590000-0x00000000013AB000-memory.dmpFilesize
14.1MB
-
memory/4060-135-0x00000000771F0000-0x0000000077393000-memory.dmpFilesize
1.6MB