7d2d951a80874ac6d0194f5c972e76c2d92be57627198e2a7c011811868a91dd

Analysis

max time kernel
60s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

driver_booster_setup_cyri.exe
Size

24.7MB
MD5

291dd01e49c206cb9f1f7892d1b3776e
SHA1

cf46cd488fccdad30d1e381dbf3f10992b6b3430
SHA256

7d2d951a80874ac6d0194f5c972e76c2d92be57627198e2a7c011811868a91dd
SHA512

b4ae258d903057cff0c2fdeb265f544fe3191d86e692fbbfcfca6bac747b2d46938adbba5bde28fddbb83a7869eab8c2579512a13352f8e4c582b5bfc0e985f7
SSDEEP

393216:/4I5UMYEojxBzIUWUdQ5/lXUryjYCRcSUbUMAWNArssIKXxYdKDc46YE:/4+UDvDzLNW/5l8CRiYwArcKXxYYDIYE

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3016	driver_booster_setup_cyri.tmp
5012	setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	driver_booster_setup_cyri.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3016	driver_booster_setup_cyri.tmp
3016	driver_booster_setup_cyri.tmp
3016	driver_booster_setup_cyri.tmp
3016	driver_booster_setup_cyri.tmp
5012	setup.exe
5012	setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	driver_booster_setup_cyri.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5012	setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3016	2044	driver_booster_setup_cyri.exe	80
PID 2044 wrote to memory of 3016	2044	driver_booster_setup_cyri.exe	80
PID 2044 wrote to memory of 3016	2044	driver_booster_setup_cyri.exe	80
PID 3016 wrote to memory of 5012	3016	driver_booster_setup_cyri.tmp	81
PID 3016 wrote to memory of 5012	3016	driver_booster_setup_cyri.tmp	81
PID 3016 wrote to memory of 5012	3016	driver_booster_setup_cyri.tmp	81

C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe
"C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\is-S4PBP.tmp\driver_booster_setup_cyri.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-S4PBP.tmp\driver_booster_setup_cyri.tmp" /SL5="$9007C,25203947,139264,C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\setup.exe" "C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe" /title="Driver Booster 9" /dbver=9.1.0.142 /eula="C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\EULA.rtf" /noemailpage /nochromepmt
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:5012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\setup.exe

Filesize
7.1MB

MD5
b9561578e1dd583f74bbd0e1dfe91105

SHA1
c8dae9e25a35759d4e6e08a3116319aef02a15bf

SHA256
8e6c349e197158a3f44f15e85bec54690e2ce6a6676867de193fe67dbaec93cf

SHA512
8f28759a6ef591aaef5cd1096fb7dea1e9f4b4469dca8257561e32bf27cf75eb191c54d575f40c3e3179cf0604f5bb962c4f73bf641fa68153b15d9480af29e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\setup.exe

Filesize
7.1MB

MD5
b9561578e1dd583f74bbd0e1dfe91105

SHA1
c8dae9e25a35759d4e6e08a3116319aef02a15bf

SHA256
8e6c349e197158a3f44f15e85bec54690e2ce6a6676867de193fe67dbaec93cf

SHA512
8f28759a6ef591aaef5cd1096fb7dea1e9f4b4469dca8257561e32bf27cf75eb191c54d575f40c3e3179cf0604f5bb962c4f73bf641fa68153b15d9480af29e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-S4PBP.tmp\driver_booster_setup_cyri.tmp

Filesize
1.2MB

MD5
68b52a0b8e3d45bf3b520a0e7f16dad1

SHA1
e50408326eafb5ca8adc70db29c33b64e25bbbbd

SHA256
b409d6d6f8896dc2afd1774479c741ca253c0e9b4732daaa08af84aa9c96888b

SHA512
b8e0b486e2b9652831eb8efe48cf9575eef49204e827a64d69ae7c9c30304b2d98a66c28f1072fe8596847c15f13bbf7ec39d7708684ff64051bbae7ed063faf

Download Submit
memory/2044-132-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2044-136-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2044-137-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2044-141-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download