Overview

overview

8

Static

static

setup.exe

windows7-x64

8

setup.exe

windows10-2004-x64

8

Resubmissions

26/10/2022, 00:25

221026-aqw4zsecb8 8

26/10/2022, 00:18

221026-allsfseca9 8

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/10/2022, 00:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup.exe

  • Size

    17.5MB

  • MD5

    61659f366a57a43102f9b69ac00e3aa1

  • SHA1

    07aa4f66688ff2e5466d61e947eb0bd2a607910b

  • SHA256

    6087004fc16d11ff78f73284741e3ee39d74ce6a64f7546046a155c6404c7865

  • SHA512

    9b668c1fb3571962ef5cf9de6f427946bfccc53e3f14a24a3ae317d7768f998e80507b868f851c9bfc282486a458fe304671cbb8391c320a86bf301b9e9852c9

  • SSDEEP

    393216:Olsw8RwUfNSyBpg0kN+/UGHDHdSP8KBwIcA:Et86UVSweBqUGHDcPV99

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Registers COM server for autorun 1 TTPs 4 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\AppData\Local\Temp\is-64STE.tmp\setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-64STE.tmp\setup.tmp" /SL5="$701CE,17564147,831488,C:\Users\Admin\AppData\Local\Temp\setup.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Program Files (x86)\ASClientGW\AsClientGw.exe
        "C:\Program Files (x86)\ASClientGW\AsClientGw.exe"
        3⤵
        • Executes dropped EXE
        PID:2952
  • C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\NewUnblock.jfif" /ForceBootstrapPaint3D
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4396
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
    1⤵
    • Drops file in System32 directory
    PID:4140
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1052
  • C:\Windows\system32\dxdiag.exe
    "C:\Windows\system32\dxdiag.exe"
    1⤵
    • Registers COM server for autorun
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2664

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\ASClientGW\AsClientGw.exe
    Filesize

    438KB

    MD5

    1ef4e79a7448605ca4ce722b9dd294cd

    SHA1

    2f6d07f645a28abe75f3c4090fee6dffaeea6158

    SHA256

    11924a1a550f9245283d92514c92e391bb81bd516c63a0d669fb529eddf2f8e8

    SHA512

    5d27c642fd75607591b6e19cad5ffb267823e723a4fda1f5d4dd4ba6d1fa6003c66d979a77d5955a4dfb56f988f000c8b5940cfabf2ba1be3d0f7e6059c97ed6

    Download Submit

  • C:\Program Files (x86)\ASClientGW\AsClientGw.exe
    Filesize

    438KB

    MD5

    1ef4e79a7448605ca4ce722b9dd294cd

    SHA1

    2f6d07f645a28abe75f3c4090fee6dffaeea6158

    SHA256

    11924a1a550f9245283d92514c92e391bb81bd516c63a0d669fb529eddf2f8e8

    SHA512

    5d27c642fd75607591b6e19cad5ffb267823e723a4fda1f5d4dd4ba6d1fa6003c66d979a77d5955a4dfb56f988f000c8b5940cfabf2ba1be3d0f7e6059c97ed6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-64STE.tmp\setup.tmp
    Filesize

    3.0MB

    MD5

    51a7fbe68243ac1875f31d08e8cca74d

    SHA1

    d5595fab17d6a09b638e166f3b4945a2f0c9e540

    SHA256

    4e1a51f79e656bde98b3b8502c8000509c52ec7eac3a1d2f13e10d3a89b227ad

    SHA512

    4db557b8e08b78252a704bd5b25c179dc69d1c9c815c6443daf398085b8cd15dce8a6bb8cc537ebbd988d9b66b1f92eceebff17ed29a261ad684076977f5fc77

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-64STE.tmp\setup.tmp
    Filesize

    3.0MB

    MD5

    51a7fbe68243ac1875f31d08e8cca74d

    SHA1

    d5595fab17d6a09b638e166f3b4945a2f0c9e540

    SHA256

    4e1a51f79e656bde98b3b8502c8000509c52ec7eac3a1d2f13e10d3a89b227ad

    SHA512

    4db557b8e08b78252a704bd5b25c179dc69d1c9c815c6443daf398085b8cd15dce8a6bb8cc537ebbd988d9b66b1f92eceebff17ed29a261ad684076977f5fc77

    Download Submit

  • memory/976-132-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

    Download

  • memory/976-136-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

    Download

  • memory/976-141-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

    Download

  • memory/4140-142-0x0000019543D60000-0x0000019543D70000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4140-143-0x0000019543DA0000-0x0000019543DB0000-memory.dmp

    Filesize

    64KB

    Download