Analysis
-
max time kernel
41s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 06:20
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
Setup.exe
-
Size
8.6MB
-
MD5
f2dd70af258a8c466be64a0dd05391fb
-
SHA1
fc5143246ae64d68de85b9c14b4228e016a610fb
-
SHA256
91ce19acfaf87e7815b34850b1f26ba8c910bd93b471e8a4272f54e553b3ca73
-
SHA512
a04dc565babde3cdf22541f5aa0ed7bdddd050f0bfeaca7a7705ae1b3170d8bc786c9ad48edf73d0021b378a972c1b646ec01b4c3b67e5b08e57559fd48a8420
-
SSDEEP
98304:n1EqlRyB+/T6Mzg2NA6S6m2ytriL3Yj+ijoIq:niwRyB+xUwQtrijuW
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exeSetup.exepid process 2024 powershell.exe 1632 Setup.exe 1632 Setup.exe 1632 Setup.exe 1632 Setup.exe 1632 Setup.exe 1632 Setup.exe 1632 Setup.exe 1632 Setup.exe 1632 Setup.exe 1632 Setup.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Setup.exepowershell.exedescription pid process Token: SeDebugPrivilege 1632 Setup.exe Token: SeDebugPrivilege 2024 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup.exedescription pid process target process PID 1632 wrote to memory of 2024 1632 Setup.exe powershell.exe PID 1632 wrote to memory of 2024 1632 Setup.exe powershell.exe PID 1632 wrote to memory of 2024 1632 Setup.exe powershell.exe PID 1632 wrote to memory of 2024 1632 Setup.exe powershell.exe PID 1632 wrote to memory of 1548 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1548 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1548 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1548 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1548 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1548 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1548 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1540 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1540 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1540 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1540 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1540 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1540 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1540 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1308 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1308 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1308 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1308 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1308 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1308 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1308 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1628 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1628 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1628 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1628 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1628 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1628 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1628 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1652 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1652 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1652 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1652 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1652 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1652 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1652 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 884 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 884 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 884 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 884 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 884 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 884 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 884 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1380 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1380 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1380 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1380 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1380 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1380 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1380 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1788 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1788 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1788 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1788 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1788 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1788 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1788 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1472 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1472 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1472 1632 Setup.exe Setup.exe PID 1632 wrote to memory of 1472 1632 Setup.exe Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1632-55-0x0000000000210000-0x00000000006B8000-memory.dmpFilesize
4.7MB
-
memory/1632-56-0x0000000004C60000-0x0000000004D2C000-memory.dmpFilesize
816KB
-
memory/1632-57-0x0000000004E80000-0x0000000004F12000-memory.dmpFilesize
584KB
-
memory/2024-58-0x0000000000000000-mapping.dmp
-
memory/2024-60-0x000000006FF90000-0x000000007053B000-memory.dmpFilesize
5.7MB
-
memory/2024-61-0x000000006FF90000-0x000000007053B000-memory.dmpFilesize
5.7MB