c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e

Analysis

max time kernel
236s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e.exe
Size

832KB
MD5

a6e1cfe61b4744c3529a1e1246378423
SHA1

26453f462ff8d158b734bd2c182e750f2dcd9242
SHA256

c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e
SHA512

28f60974da501243a521effd6d3bd1216fe3c045c4a150b9e81dc99873db0af9ed60305edd1bd54eba3e95b7fc0b95ba8de89e4660ea2a7753821b39ca4dd0a0
SSDEEP

24576:lpLGc/1HGsJEJ3aCsMk2gwPk5Dk4fJHtNVdc2EAT:j6EFCsurkK4fNt4i

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Setup.exe

pid process

2400 Setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2400	Setup.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

Setup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0"	Setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e.exe

description	pid	process	target process
PID 4828 wrote to memory of 2400	4828	c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e.exe	Setup.exe
PID 4828 wrote to memory of 2400	4828	c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e.exe	Setup.exe
PID 4828 wrote to memory of 2400	4828	c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e.exe	Setup.exe

C:\Users\Admin\AppData\Local\Temp\c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e.exe
"C:\Users\Admin\AppData\Local\Temp\c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4828

C:\Users\Admin\AppData\Local\Temp\a2bT5BBk9p\gDZJxRkT\Setup.exe
C:\Users\Admin\AppData\Local\Temp\a2bT5BBk9p\gDZJxRkT\Setup.exe --relaunch
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
PID:2400

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a2bT5BBk9p\gDZJxRkT\Setup.exe
Filesize
832KB

MD5
a6e1cfe61b4744c3529a1e1246378423

SHA1
26453f462ff8d158b734bd2c182e750f2dcd9242

SHA256
c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e

SHA512
28f60974da501243a521effd6d3bd1216fe3c045c4a150b9e81dc99873db0af9ed60305edd1bd54eba3e95b7fc0b95ba8de89e4660ea2a7753821b39ca4dd0a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\a2bT5BBk9p\gDZJxRkT\Setup.exe
Filesize
832KB

MD5
a6e1cfe61b4744c3529a1e1246378423

SHA1
26453f462ff8d158b734bd2c182e750f2dcd9242

SHA256
c1521b89e62844c2b1f0da65775609c63e2b0254dee15e84e2838377e47a218e

SHA512
28f60974da501243a521effd6d3bd1216fe3c045c4a150b9e81dc99873db0af9ed60305edd1bd54eba3e95b7fc0b95ba8de89e4660ea2a7753821b39ca4dd0a0

Download Submit
memory/2400-132-0x0000000000000000-mapping.dmp

Download