Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 06:52
Behavioral task
behavioral1
Sample
b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe
Resource
win10v2004-20221111-en
General
-
Target
b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe
-
Size
396KB
-
MD5
20a17e1e0b00ac8a180a673f13571a5c
-
SHA1
0fe1ff555d5a8995383ecbb9c9bd34ee951bdf0d
-
SHA256
b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15
-
SHA512
d5f829d8b528d1c3803180a387927b92b994fcef39c23e3d967c76f8dd78b20c13937011ac069e83026fd22b5d405383ed766ca675a868af32d6287eb612c6be
-
SSDEEP
12288:QjkArEN249AyE/rbaMct4bO2/VUO5QGKEBy6ij:LFE//Tct4bOs+MQGKcQj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
setup.exepid process 1452 setup.exe -
Processes:
resource yara_rule behavioral2/memory/2576-132-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/2576-143-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/2576-145-0x0000000000400000-0x00000000004C1000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe -
Drops startup file 2 IoCs
Processes:
WScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.vbs WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.vbs WScript.exe -
Loads dropped DLL 5 IoCs
Processes:
setup.exepid process 1452 setup.exe 1452 setup.exe 1452 setup.exe 1452 setup.exe 1452 setup.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\update.vbs\"" WScript.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\update = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\update.vbs\"" WScript.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2576-132-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral2/memory/2576-143-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral2/memory/2576-145-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\setup.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\setup.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\setup.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\setup.exe nsis_installer_2 -
Modifies registry class 1 IoCs
Processes:
b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exedescription pid process target process PID 2576 wrote to memory of 1452 2576 b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe setup.exe PID 2576 wrote to memory of 1452 2576 b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe setup.exe PID 2576 wrote to memory of 1452 2576 b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe setup.exe PID 2576 wrote to memory of 1936 2576 b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe WScript.exe PID 2576 wrote to memory of 1936 2576 b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe WScript.exe PID 2576 wrote to memory of 1936 2576 b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe"C:\Users\Admin\AppData\Local\Temp\b49c9518ccbe525941afa9f85f9bea24b1833b9b06bfdd3626b8811b3eb1bc15.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp/setup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\update.vbs" 02⤵
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nss698D.tmp\BrandingURL.dllFilesize
4KB
MD571c46b663baa92ad941388d082af97e7
SHA15a9fcce065366a526d75cc5ded9aade7cadd6421
SHA256bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
SHA5125965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
-
C:\Users\Admin\AppData\Local\Temp\nss698D.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nss698D.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nss698D.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
C:\Users\Admin\AppData\Local\Temp\nss698D.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
97KB
MD5460ac7278d4f8b9c58e1e058fa2c3a49
SHA11b4eb9f5b43c07147f8479a1691598148a97a0bf
SHA25682e7518a186068816c4ffa280334cee65b13945d0c1fe6bbf8b77ef81c6a1b01
SHA5124d6d9bf2eb4a11321aae2a96d1994eae2672ea7f517a78a909a0d642c8cd8d68cba2d5510fcf5b341ddfc56e2cec1ec7266b2c1bcb56da9cdad4b03b70d04f66
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
97KB
MD5460ac7278d4f8b9c58e1e058fa2c3a49
SHA11b4eb9f5b43c07147f8479a1691598148a97a0bf
SHA25682e7518a186068816c4ffa280334cee65b13945d0c1fe6bbf8b77ef81c6a1b01
SHA5124d6d9bf2eb4a11321aae2a96d1994eae2672ea7f517a78a909a0d642c8cd8d68cba2d5510fcf5b341ddfc56e2cec1ec7266b2c1bcb56da9cdad4b03b70d04f66
-
C:\Users\Admin\AppData\Local\Temp\update.vbsFilesize
308KB
MD52abc8e958aec30bc980bae61c3c492ad
SHA1c4c17225c73afa362f78b84ac25660f46c4ab90c
SHA25658f654923a67f1d5cc9878fc7dac80f9df24d84f091110126da702574e79f5d6
SHA51280dc6b8601a98ee2090a7fd6e2887e6e7f7bfd55b45a2de1809314d70a89cb3f305de97f7e532f92b01b771efcf1fcd110ba1a45b816de484bfae5ca622d3388
-
memory/1452-139-0x00000000052E1000-0x00000000052E3000-memory.dmpFilesize
8KB
-
memory/1452-142-0x00000000052F1000-0x00000000052F4000-memory.dmpFilesize
12KB
-
memory/1452-133-0x0000000000000000-mapping.dmp
-
memory/1936-144-0x0000000000000000-mapping.dmp
-
memory/2576-132-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/2576-143-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/2576-145-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB