Analysis
-
max time kernel
171s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:25
Static task
static1
Behavioral task
behavioral1
Sample
ffc070af48fb1f64e11630d2dfcd55f3afe325feb8dd78c6102a4d390fe3a24d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ffc070af48fb1f64e11630d2dfcd55f3afe325feb8dd78c6102a4d390fe3a24d.exe
Resource
win10v2004-20221111-en
General
-
Target
ffc070af48fb1f64e11630d2dfcd55f3afe325feb8dd78c6102a4d390fe3a24d.exe
-
Size
5.7MB
-
MD5
3322907ae113079bd33355e4e9f63d22
-
SHA1
02134100cb5e2be44fab2f227fa3588d5e87ba34
-
SHA256
ffc070af48fb1f64e11630d2dfcd55f3afe325feb8dd78c6102a4d390fe3a24d
-
SHA512
a32fde7f82ab442405b69186c8ebd538d494b013aab3b70abc3df1f63eb5fd510a27a1bce55eaacdeae7e90b7bfd55b5d405c2d3bd371e30aec4d6b13a801675
-
SSDEEP
98304:5L+p957/mfkAb0JOyEmi+thHGAa0P9CQOGCfRJ2jlTDZ2l4wdcACdcruV95cz6:N89J/ANzywiJlgQNUJ2BTDYiqcAViVwO
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
optprosetup.exeoptprosetup.tmppid process 452 optprosetup.exe 4024 optprosetup.tmp -
Modifies AppInit DLL entries 2 TTPs
-
Loads dropped DLL 3 IoCs
Processes:
optprosetup.tmppid process 4024 optprosetup.tmp 4024 optprosetup.tmp 4024 optprosetup.tmp -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
optprosetup.tmpdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run optprosetup.tmp Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Optimizer Pro = "C:\\Program Files (x86)\\Optimizer Pro\\OptProLauncher.exe" optprosetup.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 36 IoCs
Processes:
optprosetup.tmpdescription ioc process File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProSchedule.exe optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-I2D3Q.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-A531B.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-ERQMP.tmp optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProReminder.exe optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProUninstaller.exe optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-VGOGE.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-4D2M6.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-I3OKB.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-00EQF.tmp optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProStart.exe optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProHelper.dll optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-OEOFV.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-4D6G6.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-JKF9T.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\unins000.msg optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProGuard.exe optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-JIKKL.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-OR2V6.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-7721D.tmp optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptimizerPro.chm optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-3MEKG.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\itdownload.dll optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\unins000.dat optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-D2KSE.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-U75R3.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-PM50S.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-T8J6K.tmp optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\unins000.dat optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\sqlite3.dll optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-H1KQ8.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-CMUAM.tmp optprosetup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
optprosetup.tmppid process 4024 optprosetup.tmp 4024 optprosetup.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
optprosetup.tmppid process 4024 optprosetup.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ffc070af48fb1f64e11630d2dfcd55f3afe325feb8dd78c6102a4d390fe3a24d.exeoptprosetup.exeoptprosetup.tmpdescription pid process target process PID 1044 wrote to memory of 452 1044 ffc070af48fb1f64e11630d2dfcd55f3afe325feb8dd78c6102a4d390fe3a24d.exe optprosetup.exe PID 1044 wrote to memory of 452 1044 ffc070af48fb1f64e11630d2dfcd55f3afe325feb8dd78c6102a4d390fe3a24d.exe optprosetup.exe PID 1044 wrote to memory of 452 1044 ffc070af48fb1f64e11630d2dfcd55f3afe325feb8dd78c6102a4d390fe3a24d.exe optprosetup.exe PID 452 wrote to memory of 4024 452 optprosetup.exe optprosetup.tmp PID 452 wrote to memory of 4024 452 optprosetup.exe optprosetup.tmp PID 452 wrote to memory of 4024 452 optprosetup.exe optprosetup.tmp PID 4024 wrote to memory of 1124 4024 optprosetup.tmp rundll32.exe PID 4024 wrote to memory of 1124 4024 optprosetup.tmp rundll32.exe PID 4024 wrote to memory of 1124 4024 optprosetup.tmp rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffc070af48fb1f64e11630d2dfcd55f3afe325feb8dd78c6102a4d390fe3a24d.exe"C:\Users\Admin\AppData\Local\Temp\ffc070af48fb1f64e11630d2dfcd55f3afe325feb8dd78c6102a4d390fe3a24d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\optprosetup.exeC:\Users\Admin\AppData\Local\Temp\\optprosetup.exe /VERYSILENT2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HVB38.tmp\optprosetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-HVB38.tmp\optprosetup.tmp" /SL5="$F014A,5286589,118784,C:\Users\Admin\AppData\Local\Temp\optprosetup.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT -install4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-7M6C8.tmp\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
C:\Users\Admin\AppData\Local\Temp\is-7M6C8.tmp\itdownload.dllFilesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
C:\Users\Admin\AppData\Local\Temp\is-7M6C8.tmp\itdownload.dllFilesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
C:\Users\Admin\AppData\Local\Temp\is-HVB38.tmp\optprosetup.tmpFilesize
1.1MB
MD550488cf899d007d697893fc72a823fb0
SHA1bc5512f623656ad69a054d558c35d463a5a8a6c1
SHA256d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf
SHA5122b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0
-
C:\Users\Admin\AppData\Local\Temp\is-HVB38.tmp\optprosetup.tmpFilesize
1.1MB
MD550488cf899d007d697893fc72a823fb0
SHA1bc5512f623656ad69a054d558c35d463a5a8a6c1
SHA256d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf
SHA5122b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0
-
C:\Users\Admin\AppData\Local\Temp\optprosetup.exeFilesize
5.5MB
MD53d31e999e8433d22b740ee0c55ac93ce
SHA173ad53e7f5198f124f70d31bf2b2c6511aa8caea
SHA256769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba
SHA51285654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b
-
C:\Users\Admin\AppData\Local\Temp\optprosetup.exeFilesize
5.5MB
MD53d31e999e8433d22b740ee0c55ac93ce
SHA173ad53e7f5198f124f70d31bf2b2c6511aa8caea
SHA256769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba
SHA51285654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b
-
memory/452-135-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/452-137-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/452-144-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/452-132-0x0000000000000000-mapping.dmp
-
memory/1124-146-0x0000000000000000-mapping.dmp
-
memory/4024-138-0x0000000000000000-mapping.dmp
-
memory/4024-143-0x0000000003300000-0x000000000333C000-memory.dmpFilesize
240KB