Analysis
-
max time kernel
37s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-11-2022 16:00
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
Setup.exe
-
Size
700.0MB
-
MD5
9dae9dd61d07c02000a5ea2500bfb5b2
-
SHA1
61cb4fa8376d97a8f93effc906a95941e3375a2b
-
SHA256
baa358f10014adf2569d7e697bbd59fe98e884a6f65d9063e6c04f8dccbe2302
-
SHA512
a8c70b97a52a12b1b9251c70635220a765cce0f9553d75a9271fd9eba1fbaa329be2dbf2db1f601ce2f4cc20a4590e772fd9b15c9c5560723eef6cb7ea2ae975
-
SSDEEP
98304:n1EqlRyB+/T6Mzg2NA6S6m2ytriL3Yj+ijoIq:niwRyB+xUwQtrijuW
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exeSetup.exepid process 1252 powershell.exe 780 Setup.exe 780 Setup.exe 780 Setup.exe 780 Setup.exe 780 Setup.exe 780 Setup.exe 780 Setup.exe 780 Setup.exe 780 Setup.exe 780 Setup.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Setup.exepowershell.exedescription pid process Token: SeDebugPrivilege 780 Setup.exe Token: SeDebugPrivilege 1252 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup.exedescription pid process target process PID 780 wrote to memory of 1252 780 Setup.exe powershell.exe PID 780 wrote to memory of 1252 780 Setup.exe powershell.exe PID 780 wrote to memory of 1252 780 Setup.exe powershell.exe PID 780 wrote to memory of 1252 780 Setup.exe powershell.exe PID 780 wrote to memory of 1988 780 Setup.exe Setup.exe PID 780 wrote to memory of 1988 780 Setup.exe Setup.exe PID 780 wrote to memory of 1988 780 Setup.exe Setup.exe PID 780 wrote to memory of 1988 780 Setup.exe Setup.exe PID 780 wrote to memory of 1988 780 Setup.exe Setup.exe PID 780 wrote to memory of 1988 780 Setup.exe Setup.exe PID 780 wrote to memory of 1988 780 Setup.exe Setup.exe PID 780 wrote to memory of 1724 780 Setup.exe Setup.exe PID 780 wrote to memory of 1724 780 Setup.exe Setup.exe PID 780 wrote to memory of 1724 780 Setup.exe Setup.exe PID 780 wrote to memory of 1724 780 Setup.exe Setup.exe PID 780 wrote to memory of 1724 780 Setup.exe Setup.exe PID 780 wrote to memory of 1724 780 Setup.exe Setup.exe PID 780 wrote to memory of 1724 780 Setup.exe Setup.exe PID 780 wrote to memory of 948 780 Setup.exe Setup.exe PID 780 wrote to memory of 948 780 Setup.exe Setup.exe PID 780 wrote to memory of 948 780 Setup.exe Setup.exe PID 780 wrote to memory of 948 780 Setup.exe Setup.exe PID 780 wrote to memory of 948 780 Setup.exe Setup.exe PID 780 wrote to memory of 948 780 Setup.exe Setup.exe PID 780 wrote to memory of 948 780 Setup.exe Setup.exe PID 780 wrote to memory of 340 780 Setup.exe Setup.exe PID 780 wrote to memory of 340 780 Setup.exe Setup.exe PID 780 wrote to memory of 340 780 Setup.exe Setup.exe PID 780 wrote to memory of 340 780 Setup.exe Setup.exe PID 780 wrote to memory of 340 780 Setup.exe Setup.exe PID 780 wrote to memory of 340 780 Setup.exe Setup.exe PID 780 wrote to memory of 340 780 Setup.exe Setup.exe PID 780 wrote to memory of 868 780 Setup.exe Setup.exe PID 780 wrote to memory of 868 780 Setup.exe Setup.exe PID 780 wrote to memory of 868 780 Setup.exe Setup.exe PID 780 wrote to memory of 868 780 Setup.exe Setup.exe PID 780 wrote to memory of 868 780 Setup.exe Setup.exe PID 780 wrote to memory of 868 780 Setup.exe Setup.exe PID 780 wrote to memory of 868 780 Setup.exe Setup.exe PID 780 wrote to memory of 908 780 Setup.exe Setup.exe PID 780 wrote to memory of 908 780 Setup.exe Setup.exe PID 780 wrote to memory of 908 780 Setup.exe Setup.exe PID 780 wrote to memory of 908 780 Setup.exe Setup.exe PID 780 wrote to memory of 908 780 Setup.exe Setup.exe PID 780 wrote to memory of 908 780 Setup.exe Setup.exe PID 780 wrote to memory of 908 780 Setup.exe Setup.exe PID 780 wrote to memory of 684 780 Setup.exe Setup.exe PID 780 wrote to memory of 684 780 Setup.exe Setup.exe PID 780 wrote to memory of 684 780 Setup.exe Setup.exe PID 780 wrote to memory of 684 780 Setup.exe Setup.exe PID 780 wrote to memory of 684 780 Setup.exe Setup.exe PID 780 wrote to memory of 684 780 Setup.exe Setup.exe PID 780 wrote to memory of 684 780 Setup.exe Setup.exe PID 780 wrote to memory of 692 780 Setup.exe Setup.exe PID 780 wrote to memory of 692 780 Setup.exe Setup.exe PID 780 wrote to memory of 692 780 Setup.exe Setup.exe PID 780 wrote to memory of 692 780 Setup.exe Setup.exe PID 780 wrote to memory of 692 780 Setup.exe Setup.exe PID 780 wrote to memory of 692 780 Setup.exe Setup.exe PID 780 wrote to memory of 692 780 Setup.exe Setup.exe PID 780 wrote to memory of 1716 780 Setup.exe Setup.exe PID 780 wrote to memory of 1716 780 Setup.exe Setup.exe PID 780 wrote to memory of 1716 780 Setup.exe Setup.exe PID 780 wrote to memory of 1716 780 Setup.exe Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵PID:336
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/780-54-0x0000000076321000-0x0000000076323000-memory.dmpFilesize
8KB
-
memory/780-55-0x0000000000070000-0x0000000000518000-memory.dmpFilesize
4.7MB
-
memory/780-56-0x0000000004EA0000-0x0000000004F6C000-memory.dmpFilesize
816KB
-
memory/780-57-0x0000000000FD0000-0x0000000001062000-memory.dmpFilesize
584KB
-
memory/1252-58-0x0000000000000000-mapping.dmp
-
memory/1252-60-0x000000006F980000-0x000000006FF2B000-memory.dmpFilesize
5.7MB
-
memory/1252-61-0x000000006F980000-0x000000006FF2B000-memory.dmpFilesize
5.7MB