Analysis
-
max time kernel
111s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
24-11-2022 21:10
General
-
Target
setup.exe
-
Size
387.1MB
-
MD5
4cf297f44379b977259727674212f3b6
-
SHA1
984b21e22830bc91c079b2c4abec1d8564103015
-
SHA256
404bfccf09e40c3a803cd963af484ab97ad41922c20fa6539de35480052b95db
-
SHA512
78ec85b8d0cdb639baaa085af518cb95f886b39ee6a0a31b50ebdfa90a7fdef2cb38842c1f25ae31ffa207a3f1f67ae8fee97a8882df2d922f9854f796ebd2dd
-
SSDEEP
98304:akL1HpTUVyLydhR621kJA/X470cXaWngeKgQv9X/dK:11HRUVAydn6ZAfu0cXaWgeKggc
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OK9FK.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-OK9FK.tmp\setup.tmp" /SL5="$A011A,5002006,950272,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /VERYSILENT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5MD61.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-5MD61.tmp\setup.tmp" /SL5="$B011A,5002006,950272,C:\Users\Admin\AppData\Local\Temp\setup.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD52211cc814fe8232a655de68b70d057c9
SHA126b30c522443b25896dc6d02de24b326a25e3283
SHA25624ad009d7135131c6b2697d6ef68fb02a6eb246d3ec3422f6f3a45c16dc64e1f
SHA51280b1bf4aa912c0831423649e859fddf35b5423b5f31f0c202dfa3417ccc74798a45be6941480581208ce4e1937aa45a5df6dba34be47131c7882b2487e59f635
-
Filesize
283KB
MD52042954224db036cd61431f3f15062ba
SHA10026b23ea3743bd2189b8954e4afdf6408eeb9c8
SHA2561511f1e103762e40594bf6cf8e3e9bc0bba144864700aa142f666b1fe72d2cad
SHA5121cfa4fda0f67e2cd0dde5b8b3f33497a1ffa73bf4b7929b3e543b9cdc361430d8afe83b06d4b7038dcaf4b1ad04d84cafb7e11c7613316f62b40e9ca5d945ffc
-
Filesize
3.1MB
MD52211cc814fe8232a655de68b70d057c9
SHA126b30c522443b25896dc6d02de24b326a25e3283
SHA25624ad009d7135131c6b2697d6ef68fb02a6eb246d3ec3422f6f3a45c16dc64e1f
SHA51280b1bf4aa912c0831423649e859fddf35b5423b5f31f0c202dfa3417ccc74798a45be6941480581208ce4e1937aa45a5df6dba34be47131c7882b2487e59f635
-
Filesize
283KB
MD52042954224db036cd61431f3f15062ba
SHA10026b23ea3743bd2189b8954e4afdf6408eeb9c8
SHA2561511f1e103762e40594bf6cf8e3e9bc0bba144864700aa142f666b1fe72d2cad
SHA5121cfa4fda0f67e2cd0dde5b8b3f33497a1ffa73bf4b7929b3e543b9cdc361430d8afe83b06d4b7038dcaf4b1ad04d84cafb7e11c7613316f62b40e9ca5d945ffc
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
-
-
-
Filesize
156KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB