6715c0eff16eb7fb62b4e3c5f355b0548c695e5b12705a731a9abb4f8c7fef31

Analysis

max time kernel
79s
max time network
88s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24/10/2022, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 706.6MB
Sample221024-qn7eyagge3
SHA256 856ee338756462e8041fa057c1a2a578536de2a6c559052c7e39f00760296e72
MD5 c3cc4a0e6e795464c7d4b5b96c91d70b
SHA1 dd398b58669733bbb48363f4ee163f3f9b1e6325
SHA512 d370f7c6bafe8676823b679706ab56a07ce60b84db2f97695a06813d538a16d42a7bf4f07dd879f0d12a9d3c3fbcdc5470ec584ade2e4b9cd0c14d4db88ba549
SSDEEP 24576:8PsWvw98o3C6ZC6BqNmK/cRgOnmq9g6ZB36rKX6sWWl3RuQ55313:8Z08ozZqfcOU7m6TlLl3
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery spyware upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1064	uXZ614ly.exe
1276	BIcT709B.exe
1292	IntelCacheUpdater.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/0x00090000000207e6-73.dat	upx
behavioral3/files/0x00090000000207e6-74.dat	upx
behavioral3/files/0x00090000000207e6-76.dat	upx
behavioral3/memory/1064-79-0x00000000003D0000-0x0000000001212000-memory.dmp	upx
behavioral3/memory/1064-108-0x00000000003D0000-0x0000000001212000-memory.dmp	upx

Loads dropped DLL 8 IoCs

pid	Process
836	vbc.exe
836	vbc.exe
836	vbc.exe
836	vbc.exe
836	vbc.exe
836	vbc.exe
1276	BIcT709B.exe
1276	BIcT709B.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1760	icacls.exe
2040	icacls.exe
1084	icacls.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 836	2028	Setup.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1276	BIcT709B.exe
1292	IntelCacheUpdater.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 836	2028	Setup.exe	27
PID 2028 wrote to memory of 836	2028	Setup.exe	27
PID 2028 wrote to memory of 836	2028	Setup.exe	27
PID 2028 wrote to memory of 836	2028	Setup.exe	27
PID 2028 wrote to memory of 836	2028	Setup.exe	27
PID 2028 wrote to memory of 836	2028	Setup.exe	27
PID 2028 wrote to memory of 836	2028	Setup.exe	27
PID 2028 wrote to memory of 836	2028	Setup.exe	27
PID 2028 wrote to memory of 836	2028	Setup.exe	27
PID 836 wrote to memory of 1064	836	vbc.exe	30
PID 836 wrote to memory of 1064	836	vbc.exe	30
PID 836 wrote to memory of 1064	836	vbc.exe	30
PID 836 wrote to memory of 1064	836	vbc.exe	30
PID 836 wrote to memory of 1276	836	vbc.exe	31
PID 836 wrote to memory of 1276	836	vbc.exe	31
PID 836 wrote to memory of 1276	836	vbc.exe	31
PID 836 wrote to memory of 1276	836	vbc.exe	31
PID 836 wrote to memory of 1276	836	vbc.exe	31
PID 836 wrote to memory of 1276	836	vbc.exe	31
PID 836 wrote to memory of 1276	836	vbc.exe	31
PID 1276 wrote to memory of 1832	1276	BIcT709B.exe	32
PID 1276 wrote to memory of 1832	1276	BIcT709B.exe	32
PID 1276 wrote to memory of 1832	1276	BIcT709B.exe	32
PID 1276 wrote to memory of 1832	1276	BIcT709B.exe	32
PID 1276 wrote to memory of 1832	1276	BIcT709B.exe	32
PID 1276 wrote to memory of 1832	1276	BIcT709B.exe	32
PID 1276 wrote to memory of 1832	1276	BIcT709B.exe	32
PID 1276 wrote to memory of 1760	1276	BIcT709B.exe	34
PID 1276 wrote to memory of 1760	1276	BIcT709B.exe	34
PID 1276 wrote to memory of 1760	1276	BIcT709B.exe	34
PID 1276 wrote to memory of 1760	1276	BIcT709B.exe	34
PID 1276 wrote to memory of 1760	1276	BIcT709B.exe	34
PID 1276 wrote to memory of 1760	1276	BIcT709B.exe	34
PID 1276 wrote to memory of 1760	1276	BIcT709B.exe	34
PID 1276 wrote to memory of 2040	1276	BIcT709B.exe	36
PID 1276 wrote to memory of 2040	1276	BIcT709B.exe	36
PID 1276 wrote to memory of 2040	1276	BIcT709B.exe	36
PID 1276 wrote to memory of 2040	1276	BIcT709B.exe	36
PID 1276 wrote to memory of 2040	1276	BIcT709B.exe	36
PID 1276 wrote to memory of 2040	1276	BIcT709B.exe	36
PID 1276 wrote to memory of 2040	1276	BIcT709B.exe	36
PID 1276 wrote to memory of 1084	1276	BIcT709B.exe	38
PID 1276 wrote to memory of 1084	1276	BIcT709B.exe	38
PID 1276 wrote to memory of 1084	1276	BIcT709B.exe	38
PID 1276 wrote to memory of 1084	1276	BIcT709B.exe	38
PID 1276 wrote to memory of 1084	1276	BIcT709B.exe	38
PID 1276 wrote to memory of 1084	1276	BIcT709B.exe	38
PID 1276 wrote to memory of 1084	1276	BIcT709B.exe	38
PID 1384 wrote to memory of 1292	1384	taskeng.exe	41
PID 1384 wrote to memory of 1292	1384	taskeng.exe	41
PID 1384 wrote to memory of 1292	1384	taskeng.exe	41
PID 1384 wrote to memory of 1292	1384	taskeng.exe	41

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Users\Admin\AppData\Roaming\uXZ614ly.exe
    "C:\Users\Admin\AppData\Roaming\uXZ614ly.exe"
    3⤵
    - Executes dropped EXE
    PID:1064
- - C:\Users\Admin\AppData\Roaming\BIcT709B.exe
    "C:\Users\Admin\AppData\Roaming\BIcT709B.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /TN "Windows\IntelComputingToolkit\IntelUpdaterTask" /TR "C:\ProgramData\IntelToolkit\IntelCacheUpdater.exe" /SC MINUTE
      4⤵
      Creates scheduled task(s)
      PID:1832
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\ProgramData\IntelToolkit" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      PID:1760
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\ProgramData\IntelToolkit" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      PID:2040
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\ProgramData\IntelToolkit" /inheritance:e /deny "admin:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      PID:1084

C:\Windows\system32\taskeng.exe
taskeng.exe {6A457B77-A692-4830-B9F3-E87B731DD73A} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\ProgramData\IntelToolkit\IntelCacheUpdater.exe
  C:\ProgramData\IntelToolkit\IntelCacheUpdater.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IntelCacheUpdater.exe

Path C:\ProgramData\IntelToolkit\IntelCacheUpdater.exe
Size 5.8MB
SHA256 0596dd9f0350b7526c910a9a26e45b1886fc5e9130d96ea2543935a4bc410295
MD5 bc58c4d7ccbc8648b230d14f1faba9a8
SHA1 f200c48690b86270aa81690970f071acba82541c
SHA512 ed41e2a3b3a3c673dc3e36d6e38ea177701614a8e761a1966ba2ce4a24cb4c2252a7a8223020732cfdff9711230db40560cde75d76e31734f52e1c4152815512
SSDEEP 98304:kLhSbHKhquqi9g5tSnkRFrc7eCt/bavgz0iy0ErxBoFqu0BFAiCDHfSdea:6UFqoTCpsZikzoFPwFAqdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntelCacheUpdater.exe

Path C:\ProgramData\IntelToolkit\IntelCacheUpdater.exe
Size 5.8MB
SHA256 0596dd9f0350b7526c910a9a26e45b1886fc5e9130d96ea2543935a4bc410295
MD5 bc58c4d7ccbc8648b230d14f1faba9a8
SHA1 f200c48690b86270aa81690970f071acba82541c
SHA512 ed41e2a3b3a3c673dc3e36d6e38ea177701614a8e761a1966ba2ce4a24cb4c2252a7a8223020732cfdff9711230db40560cde75d76e31734f52e1c4152815512
SSDEEP 98304:kLhSbHKhquqi9g5tSnkRFrc7eCt/bavgz0iy0ErxBoFqu0BFAiCDHfSdea:6UFqoTCpsZikzoFPwFAqdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BIcT709B.exe

Path C:\Users\Admin\AppData\Roaming\BIcT709B.exe
Size 5.8MB
SHA256 0596dd9f0350b7526c910a9a26e45b1886fc5e9130d96ea2543935a4bc410295
MD5 bc58c4d7ccbc8648b230d14f1faba9a8
SHA1 f200c48690b86270aa81690970f071acba82541c
SHA512 ed41e2a3b3a3c673dc3e36d6e38ea177701614a8e761a1966ba2ce4a24cb4c2252a7a8223020732cfdff9711230db40560cde75d76e31734f52e1c4152815512
SSDEEP 98304:kLhSbHKhquqi9g5tSnkRFrc7eCt/bavgz0iy0ErxBoFqu0BFAiCDHfSdea:6UFqoTCpsZikzoFPwFAqdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BIcT709B.exe

Path C:\Users\Admin\AppData\Roaming\BIcT709B.exe
Size 5.8MB
SHA256 0596dd9f0350b7526c910a9a26e45b1886fc5e9130d96ea2543935a4bc410295
MD5 bc58c4d7ccbc8648b230d14f1faba9a8
SHA1 f200c48690b86270aa81690970f071acba82541c
SHA512 ed41e2a3b3a3c673dc3e36d6e38ea177701614a8e761a1966ba2ce4a24cb4c2252a7a8223020732cfdff9711230db40560cde75d76e31734f52e1c4152815512
SSDEEP 98304:kLhSbHKhquqi9g5tSnkRFrc7eCt/bavgz0iy0ErxBoFqu0BFAiCDHfSdea:6UFqoTCpsZikzoFPwFAqdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uXZ614ly.exe

Path C:\Users\Admin\AppData\Roaming\uXZ614ly.exe
Size 4.3MB
SHA256 65d77c6d99bfdf41472afef809ff3a719e16610ac76fc68994b10bbae824dc6d
MD5 72bb89449f18177af0ab1d2d5570a696
SHA1 454773e14818ddcd18f0d5c7d770ee64611f03cd
SHA512 9576d2acc1e4d8743723880037931faec95d174a9c626836c9e8d497a4c70e7e9a5aa24775bf120ae7126186058e15093f7afe0dfb7ebe9bd1591f733cf897bb
SSDEEP 98304:RM8Zh7jDK7K9EsLas8ih5O8P19yUbJMrdMDxXVazaA6H9:R/ZBK7cay5tvyUbJMJMlXUa9d
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \Users\Admin\AppData\LocalLow\mozglue.dll
Size 612KB
SHA256 4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
MD5 f07d9977430e762b563eaadc2b94bbfa
SHA1 da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA512 6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
SSDEEP 12288:dfsiG5KNZea77VUHQqROmbIDm0ICRfCtbtEE/2OH9E2ARlZYSd:df53NZea3V+QqROmum0nRKx79E2ARlrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \Users\Admin\AppData\LocalLow\nss3.dll
Size 1.9MB
SHA256 c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
MD5 f67d08e8c02574cbc2f1122c53bfb976
SHA1 6522992957e7e4d074947cad63189f308a80fcf2
SHA512 2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
SSDEEP 49152:6dvFywfzFAF7fg39IwA49Kap9bGt+qoStYnOsbqbeQom7gN7BpDD5SkIN1g5D92+:pptximYfpx8OwNiVG09
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\LocalLow\sqlite3.dll
Size 1.0MB
SHA256 47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
MD5 dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1 bbac1dd8a07c6069415c04b62747d794736d0689
SHA512 b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
SSDEEP 24576:9jxwSkSteuT4P/y7HjsXAGJyGvN5z4Rui2IXLbO:9Vww8HyrjsvyWN54RZH+
MD5 SHA1 SHA512 SSDEEP

Submit Download

BIcT709B.exe

Path \Users\Admin\AppData\Roaming\BIcT709B.exe
Size 5.8MB
SHA256 0596dd9f0350b7526c910a9a26e45b1886fc5e9130d96ea2543935a4bc410295
MD5 bc58c4d7ccbc8648b230d14f1faba9a8
SHA1 f200c48690b86270aa81690970f071acba82541c
SHA512 ed41e2a3b3a3c673dc3e36d6e38ea177701614a8e761a1966ba2ce4a24cb4c2252a7a8223020732cfdff9711230db40560cde75d76e31734f52e1c4152815512
SSDEEP 98304:kLhSbHKhquqi9g5tSnkRFrc7eCt/bavgz0iy0ErxBoFqu0BFAiCDHfSdea:6UFqoTCpsZikzoFPwFAqdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BIcT709B.exe

Path \Users\Admin\AppData\Roaming\BIcT709B.exe
Size 5.8MB
SHA256 0596dd9f0350b7526c910a9a26e45b1886fc5e9130d96ea2543935a4bc410295
MD5 bc58c4d7ccbc8648b230d14f1faba9a8
SHA1 f200c48690b86270aa81690970f071acba82541c
SHA512 ed41e2a3b3a3c673dc3e36d6e38ea177701614a8e761a1966ba2ce4a24cb4c2252a7a8223020732cfdff9711230db40560cde75d76e31734f52e1c4152815512
SSDEEP 98304:kLhSbHKhquqi9g5tSnkRFrc7eCt/bavgz0iy0ErxBoFqu0BFAiCDHfSdea:6UFqoTCpsZikzoFPwFAqdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BIcT709B.exe

Path \Users\Admin\AppData\Roaming\BIcT709B.exe
Size 5.8MB
SHA256 0596dd9f0350b7526c910a9a26e45b1886fc5e9130d96ea2543935a4bc410295
MD5 bc58c4d7ccbc8648b230d14f1faba9a8
SHA1 f200c48690b86270aa81690970f071acba82541c
SHA512 ed41e2a3b3a3c673dc3e36d6e38ea177701614a8e761a1966ba2ce4a24cb4c2252a7a8223020732cfdff9711230db40560cde75d76e31734f52e1c4152815512
SSDEEP 98304:kLhSbHKhquqi9g5tSnkRFrc7eCt/bavgz0iy0ErxBoFqu0BFAiCDHfSdea:6UFqoTCpsZikzoFPwFAqdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uXZ614ly.exe

Path \Users\Admin\AppData\Roaming\uXZ614ly.exe
Size 4.3MB
SHA256 65d77c6d99bfdf41472afef809ff3a719e16610ac76fc68994b10bbae824dc6d
MD5 72bb89449f18177af0ab1d2d5570a696
SHA1 454773e14818ddcd18f0d5c7d770ee64611f03cd
SHA512 9576d2acc1e4d8743723880037931faec95d174a9c626836c9e8d497a4c70e7e9a5aa24775bf120ae7126186058e15093f7afe0dfb7ebe9bd1591f733cf897bb
SSDEEP 98304:RM8Zh7jDK7K9EsLas8ih5O8P19yUbJMrdMDxXVazaA6H9:R/ZBK7cay5tvyUbJMJMlXUa9d
MD5 SHA1 SHA512 SSDEEP

Submit Download

uXZ614ly.exe

Path \Users\Admin\AppData\Roaming\uXZ614ly.exe
Size 4.3MB
SHA256 65d77c6d99bfdf41472afef809ff3a719e16610ac76fc68994b10bbae824dc6d
MD5 72bb89449f18177af0ab1d2d5570a696
SHA1 454773e14818ddcd18f0d5c7d770ee64611f03cd
SHA512 9576d2acc1e4d8743723880037931faec95d174a9c626836c9e8d497a4c70e7e9a5aa24775bf120ae7126186058e15093f7afe0dfb7ebe9bd1591f733cf897bb
SSDEEP 98304:RM8Zh7jDK7K9EsLas8ih5O8P19yUbJMrdMDxXVazaA6H9:R/ZBK7cay5tvyUbJMJMlXUa9d
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/836-55-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/836-77-0x0000000003A10000-0x0000000004852000-memory.dmp

Download

memory/836-78-0x0000000003A10000-0x0000000004852000-memory.dmp

Download

memory/836-57-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/836-69-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/836-65-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1064-79-0x00000000003D0000-0x0000000001212000-memory.dmp

Download

memory/1064-108-0x00000000003D0000-0x0000000001212000-memory.dmp

Download

memory/1276-87-0x0000000000400000-0x0000000000D5A000-memory.dmp

Download

memory/1276-90-0x0000000000400000-0x0000000000D5A000-memory.dmp

Download

memory/1276-100-0x0000000000400000-0x0000000000D5A000-memory.dmp

Download

memory/1292-107-0x0000000000400000-0x0000000000D5A000-memory.dmp

Download

memory/1292-104-0x0000000000400000-0x0000000000D5A000-memory.dmp

Download

memory/2028-66-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/2028-68-0x00000000003A0000-0x0000000000400000-memory.dmp

Download

memory/2028-54-0x0000000076961000-0x0000000076963000-memory.dmp

Download