Analysis
-
max time kernel
192s -
max time network
198s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
24-11-2022 14:35
General
-
Target
4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23.exe
-
Size
3.3MB
-
MD5
c2f748e96d2db66b84c87e6a3465ceca
-
SHA1
fb87dd59f4b7498550af16fd3b21f44b9f6ac523
-
SHA256
4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23
-
SHA512
3c51d52e94a06c31224a0ae52bb383f3a01dcec3693f8fcd6e4ced46bc44e485797ed3201f8880e8a8703fb7f6d62dd974e738fc6a1c64fab1e6b1688cf0de41
-
SSDEEP
98304:OLeyl6lN3RiDXbkpLHj6u+qHqWRWJU7yii:OjEfsDgpbjCvJUu3
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 11 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 60 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 32 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23.exe"C:\Users\Admin\AppData\Local\Temp\4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RGMM0.tmp\4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23.tmp"C:\Users\Admin\AppData\Local\Temp\is-RGMM0.tmp\4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23.tmp" /SL5="$70124,2957012,148992,C:\Users\Admin\AppData\Local\Temp\4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\jscript.dll"3⤵
- Modifies registry class
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.tuneuppro.com/tupp/afterinstall_sp.asp?utm_content=AfterInstall&utm_term=Setup&page=install&&LangID=en3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1004 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Tuneup Pro\TuneupPro.exe"C:\Program Files (x86)\Tuneup Pro\TuneupPro.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Tuneup Pro\systweakasp.exe"C:\Program Files (x86)\Tuneup Pro\systweakasp.exe" /verysilent4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.3MB
MD5be2ce71fc87a375f96665b980ec59f7b
SHA15ecad41aee09c73f8f7bf1d8d49bea7a222fff85
SHA25688967773ef715fa98dc87a529d8d0e2f9d3e4783fab33e30f2df88df2a81bc76
SHA5121a5e44396114afd5ad4b51eeba4ec4a08c07b8664836acc126c6c255ed023e8cc5d7fa9104bde8c703d45b45d4ac02cb6e5983f26cd55efec13f5ba723918e05
-
Filesize
7.3MB
MD5be2ce71fc87a375f96665b980ec59f7b
SHA15ecad41aee09c73f8f7bf1d8d49bea7a222fff85
SHA25688967773ef715fa98dc87a529d8d0e2f9d3e4783fab33e30f2df88df2a81bc76
SHA5121a5e44396114afd5ad4b51eeba4ec4a08c07b8664836acc126c6c255ed023e8cc5d7fa9104bde8c703d45b45d4ac02cb6e5983f26cd55efec13f5ba723918e05
-
Filesize
124KB
MD571a2dca8f626fcef8bff7e2c17c67a7f
SHA15aaea93ec3f4d722d7ea0c2d86bc4f3cbdce5c92
SHA256b55a978443ef0b873875910283bedfab0c3133bac7be72a68ed5146f83f1ef8c
SHA5125244918679eba6e7af8e367c66c3d1bdcfa2323400994ecda37ccd697fb28b52ffdad992650929ec98b98ae9e0213074368a8881c6a62e48579c30f17051a17d
-
Filesize
83KB
MD5bbf623a44f466bf544d2418f4473a7e4
SHA1684e3b0396a143d23f64c3eda59f6b29291cf967
SHA256115fa830c0087b531655bc2974522d924405f718289c57769e9aae44c7b116d5
SHA512e6d3a359f63c34d3457e8c2c56addf8d90cf7ac7e99db6545fc6a3f713fb4b0f631d6aa75da7064effdb4df6001aa7a65e06a010cbeaf561cf865b4c3dc0670e
-
Filesize
153KB
MD516429d91b2a28595e3bb5f6a48faa705
SHA1aa195a50f21cf8935c7031543215151214c6ef4b
SHA2561b141a14ed518bf01f847d893e282b831d0f0cee87919bc2e98e54a3c80f5471
SHA512a6f0ba9812c2bf8b6ddac02fff963ad062a7f7fc08ee238d680e32eccb741f7875954765a5e86a2cd3ae0be72cd5b773a9c67425dfb106ecef8e285cdf02ad64
-
Filesize
579KB
MD58f2ca56d9c7c425facbe535745092ff2
SHA1f2cbbe9867a40a0928542dace51d8b94957dfcac
SHA2560c4e44adbd402f42a65bfdd4143a874b76bca9e3a51af3ede9268489e37a8bc4
SHA512a19cdddd7c9f4bea90e64b03c5f3635d07e25545d35a020ee10de1a79b61748e8673aac179746dce334338d536fdc71ba24479b9cf643e5550ecca3af5c9990e
-
Filesize
579KB
MD58f2ca56d9c7c425facbe535745092ff2
SHA1f2cbbe9867a40a0928542dace51d8b94957dfcac
SHA2560c4e44adbd402f42a65bfdd4143a874b76bca9e3a51af3ede9268489e37a8bc4
SHA512a19cdddd7c9f4bea90e64b03c5f3635d07e25545d35a020ee10de1a79b61748e8673aac179746dce334338d536fdc71ba24479b9cf643e5550ecca3af5c9990e
-
Filesize
1.2MB
MD53aabfe33f7b23e5b8409647b6b41996f
SHA18653690e9d2bae73243a8203b8dc9c34c5163d72
SHA256706612698e77b203d3058c2edda371cd5425f325bac7fbe0dfb6d8542dc37b4c
SHA5122e5ff22d9ff1bab18adeaf2ddde9724e1a14c1488fd5e0beed5196cfcad3f2e110588d7166cebe71f72072bc8ddcdee59b5929c3dd163f9b5e02c88a5e584792
-
Filesize
1.2MB
MD53aabfe33f7b23e5b8409647b6b41996f
SHA18653690e9d2bae73243a8203b8dc9c34c5163d72
SHA256706612698e77b203d3058c2edda371cd5425f325bac7fbe0dfb6d8542dc37b4c
SHA5122e5ff22d9ff1bab18adeaf2ddde9724e1a14c1488fd5e0beed5196cfcad3f2e110588d7166cebe71f72072bc8ddcdee59b5929c3dd163f9b5e02c88a5e584792
-
Filesize
7.3MB
MD5be2ce71fc87a375f96665b980ec59f7b
SHA15ecad41aee09c73f8f7bf1d8d49bea7a222fff85
SHA25688967773ef715fa98dc87a529d8d0e2f9d3e4783fab33e30f2df88df2a81bc76
SHA5121a5e44396114afd5ad4b51eeba4ec4a08c07b8664836acc126c6c255ed023e8cc5d7fa9104bde8c703d45b45d4ac02cb6e5983f26cd55efec13f5ba723918e05
-
Filesize
7.3MB
MD5be2ce71fc87a375f96665b980ec59f7b
SHA15ecad41aee09c73f8f7bf1d8d49bea7a222fff85
SHA25688967773ef715fa98dc87a529d8d0e2f9d3e4783fab33e30f2df88df2a81bc76
SHA5121a5e44396114afd5ad4b51eeba4ec4a08c07b8664836acc126c6c255ed023e8cc5d7fa9104bde8c703d45b45d4ac02cb6e5983f26cd55efec13f5ba723918e05
-
Filesize
7.3MB
MD5be2ce71fc87a375f96665b980ec59f7b
SHA15ecad41aee09c73f8f7bf1d8d49bea7a222fff85
SHA25688967773ef715fa98dc87a529d8d0e2f9d3e4783fab33e30f2df88df2a81bc76
SHA5121a5e44396114afd5ad4b51eeba4ec4a08c07b8664836acc126c6c255ed023e8cc5d7fa9104bde8c703d45b45d4ac02cb6e5983f26cd55efec13f5ba723918e05
-
Filesize
153KB
MD516429d91b2a28595e3bb5f6a48faa705
SHA1aa195a50f21cf8935c7031543215151214c6ef4b
SHA2561b141a14ed518bf01f847d893e282b831d0f0cee87919bc2e98e54a3c80f5471
SHA512a6f0ba9812c2bf8b6ddac02fff963ad062a7f7fc08ee238d680e32eccb741f7875954765a5e86a2cd3ae0be72cd5b773a9c67425dfb106ecef8e285cdf02ad64
-
Filesize
579KB
MD58f2ca56d9c7c425facbe535745092ff2
SHA1f2cbbe9867a40a0928542dace51d8b94957dfcac
SHA2560c4e44adbd402f42a65bfdd4143a874b76bca9e3a51af3ede9268489e37a8bc4
SHA512a19cdddd7c9f4bea90e64b03c5f3635d07e25545d35a020ee10de1a79b61748e8673aac179746dce334338d536fdc71ba24479b9cf643e5550ecca3af5c9990e
-
Filesize
1.2MB
MD53aabfe33f7b23e5b8409647b6b41996f
SHA18653690e9d2bae73243a8203b8dc9c34c5163d72
SHA256706612698e77b203d3058c2edda371cd5425f325bac7fbe0dfb6d8542dc37b4c
SHA5122e5ff22d9ff1bab18adeaf2ddde9724e1a14c1488fd5e0beed5196cfcad3f2e110588d7166cebe71f72072bc8ddcdee59b5929c3dd163f9b5e02c88a5e584792
-
Filesize
124KB
MD571a2dca8f626fcef8bff7e2c17c67a7f
SHA15aaea93ec3f4d722d7ea0c2d86bc4f3cbdce5c92
SHA256b55a978443ef0b873875910283bedfab0c3133bac7be72a68ed5146f83f1ef8c
SHA5125244918679eba6e7af8e367c66c3d1bdcfa2323400994ecda37ccd697fb28b52ffdad992650929ec98b98ae9e0213074368a8881c6a62e48579c30f17051a17d
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.2MB
MD53aabfe33f7b23e5b8409647b6b41996f
SHA18653690e9d2bae73243a8203b8dc9c34c5163d72
SHA256706612698e77b203d3058c2edda371cd5425f325bac7fbe0dfb6d8542dc37b4c
SHA5122e5ff22d9ff1bab18adeaf2ddde9724e1a14c1488fd5e0beed5196cfcad3f2e110588d7166cebe71f72072bc8ddcdee59b5929c3dd163f9b5e02c88a5e584792
-
Filesize
8KB
-
-
-
Filesize
172KB
-
Filesize
172KB
-
-
Filesize
188KB
-
Filesize
8KB
-
Filesize
188KB
-
Filesize
188KB
-