Overview

overview

8

Static

static

34b3aa5ad6...f1.exe

windows7-x64

8

34b3aa5ad6...f1.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    182s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 11:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    34b3aa5ad6d76962549ef17e15258ff1412000c50b6494a7480b100f5e2d4af1.exe

  • Size

    5.7MB

  • MD5

    1f143b66c12377637d387f0f8deacd49

  • SHA1

    2fd0f8ff33e4e964222afecac5d4ccc5396bf8c7

  • SHA256

    34b3aa5ad6d76962549ef17e15258ff1412000c50b6494a7480b100f5e2d4af1

  • SHA512

    5aeedee9ddd31175e7188a1bc2d01e2cbfff39f0b3b97919b470052ef01eefe0a9a0297baf17c317275bb8860fb078390a594a7fb602baf10645c8e5df788748

  • SSDEEP

    98304:rL+p957/mfkAb0JOyEmi+thHGAa0P9CQOGCfRJ2jlTDZ2l4wdcACdcruV95czO:n89J/ANzywiJlgQNUJ2BTDYiqcAViVwy

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 53 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34b3aa5ad6d76962549ef17e15258ff1412000c50b6494a7480b100f5e2d4af1.exe
    "C:\Users\Admin\AppData\Local\Temp\34b3aa5ad6d76962549ef17e15258ff1412000c50b6494a7480b100f5e2d4af1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3244
    • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
      C:\Users\Admin\AppData\Local\Temp\\optprosetup.exe /VERYSILENT
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Users\Admin\AppData\Local\Temp\is-CIT97.tmp\optprosetup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-CIT97.tmp\optprosetup.tmp" /SL5="$12004A,5286589,118784,C:\Users\Admin\AppData\Local\Temp\optprosetup.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT -install
          4⤵
          • Loads dropped DLL
          PID:972
        • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
          "C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"
          4⤵
          • Executes dropped EXE
          PID:3040
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT
      2⤵
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
    Filesize

    643KB

    MD5

    1713fa8e8ecdfb32c46dd466c63107c6

    SHA1

    3798f368de630f751d3c05de7f9cfe7134caa604

    SHA256

    8e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f

    SHA512

    71bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
    Filesize

    643KB

    MD5

    1713fa8e8ecdfb32c46dd466c63107c6

    SHA1

    3798f368de630f751d3c05de7f9cfe7134caa604

    SHA256

    8e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f

    SHA512

    71bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-7RJBE.tmp\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-7RJBE.tmp\itdownload.dll
    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-7RJBE.tmp\itdownload.dll
    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-CIT97.tmp\optprosetup.tmp
    Filesize

    1.1MB

    MD5

    50488cf899d007d697893fc72a823fb0

    SHA1

    bc5512f623656ad69a054d558c35d463a5a8a6c1

    SHA256

    d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf

    SHA512

    2b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-CIT97.tmp\optprosetup.tmp
    Filesize

    1.1MB

    MD5

    50488cf899d007d697893fc72a823fb0

    SHA1

    bc5512f623656ad69a054d558c35d463a5a8a6c1

    SHA256

    d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf

    SHA512

    2b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
    Filesize

    5.5MB

    MD5

    3d31e999e8433d22b740ee0c55ac93ce

    SHA1

    73ad53e7f5198f124f70d31bf2b2c6511aa8caea

    SHA256

    769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba

    SHA512

    85654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
    Filesize

    5.5MB

    MD5

    3d31e999e8433d22b740ee0c55ac93ce

    SHA1

    73ad53e7f5198f124f70d31bf2b2c6511aa8caea

    SHA256

    769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba

    SHA512

    85654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b

    Download Submit
  • \??\c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • memory/972-146-0x0000000000000000-mapping.dmp
    Download
  • memory/1412-144-0x00000000032F0000-0x000000000332C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/1412-138-0x0000000000000000-mapping.dmp
    Download
  • memory/1940-152-0x0000000000000000-mapping.dmp
    Download
  • memory/2704-141-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/2704-136-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/2704-133-0x0000000000000000-mapping.dmp
    Download
  • memory/2704-154-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/3040-149-0x0000000000000000-mapping.dmp
    Download