Overview

overview

8

Static

static

e3a2008dd8...06.exe

windows7-x64

8

e3a2008dd8...06.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    203s
  • max time network
    227s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 13:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e3a2008dd8a115dda9e5109b0965744e591f00ceafbdedc8291594feef251f06.exe

  • Size

    5.7MB

  • MD5

    2edad48321223ce46e3b1b567cbe7eca

  • SHA1

    9f6bb6230bab8143c64bf4179b1cf6a22e7c4818

  • SHA256

    e3a2008dd8a115dda9e5109b0965744e591f00ceafbdedc8291594feef251f06

  • SHA512

    c41ca288b3637784e913a04759615f8484e0b815410f4013ef0a025d27e13c374d5f4f7d15b0dc99e7c3d0d82d753514cdf6e390f2536b25880c4ca6212fc5af

  • SSDEEP

    98304:rL+wWs7EMO5L6LeyN4mB7ksBDfkPfurxqftiHaSWHD+JiQ0NSHtj5zV:nfE15eiyNqcDAfhVR+JifYtdB

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 53 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3a2008dd8a115dda9e5109b0965744e591f00ceafbdedc8291594feef251f06.exe
    "C:\Users\Admin\AppData\Local\Temp\e3a2008dd8a115dda9e5109b0965744e591f00ceafbdedc8291594feef251f06.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
      C:\Users\Admin\AppData\Local\Temp\\optprosetup.exe /VERYSILENT
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Users\Admin\AppData\Local\Temp\is-724QT.tmp\optprosetup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-724QT.tmp\optprosetup.tmp" /SL5="$90048,5283427,118784,C:\Users\Admin\AppData\Local\Temp\optprosetup.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:228
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT -install
          4⤵
          • Loads dropped DLL
          PID:2812
        • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
          "C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"
          4⤵
          • Executes dropped EXE
          PID:4772
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT
      2⤵
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      PID:4648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
    Filesize

    643KB

    MD5

    1713fa8e8ecdfb32c46dd466c63107c6

    SHA1

    3798f368de630f751d3c05de7f9cfe7134caa604

    SHA256

    8e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f

    SHA512

    71bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
    Filesize

    643KB

    MD5

    1713fa8e8ecdfb32c46dd466c63107c6

    SHA1

    3798f368de630f751d3c05de7f9cfe7134caa604

    SHA256

    8e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f

    SHA512

    71bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-2JF91.tmp\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-2JF91.tmp\itdownload.dll
    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-2JF91.tmp\itdownload.dll
    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-724QT.tmp\optprosetup.tmp
    Filesize

    1.1MB

    MD5

    50488cf899d007d697893fc72a823fb0

    SHA1

    bc5512f623656ad69a054d558c35d463a5a8a6c1

    SHA256

    d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf

    SHA512

    2b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-724QT.tmp\optprosetup.tmp
    Filesize

    1.1MB

    MD5

    50488cf899d007d697893fc72a823fb0

    SHA1

    bc5512f623656ad69a054d558c35d463a5a8a6c1

    SHA256

    d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf

    SHA512

    2b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
    Filesize

    5.5MB

    MD5

    24bcaf1bbb1f29e0245416b5d2873e46

    SHA1

    ebf1d052c13b9f415afe09541bdab68f37429922

    SHA256

    fe4797861027b93ec089ffb3c3adcfc35c56a91839cfe5fcff79eeb8ea520d40

    SHA512

    aeff74eecba81fa8ca6afba44628e725e65334e8f712e5a7c0ab14fb48b1b495730d69a3264258ecbe01ae1693b3781db4b08221bc377d8a11e29e0c3766d55c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
    Filesize

    5.5MB

    MD5

    24bcaf1bbb1f29e0245416b5d2873e46

    SHA1

    ebf1d052c13b9f415afe09541bdab68f37429922

    SHA256

    fe4797861027b93ec089ffb3c3adcfc35c56a91839cfe5fcff79eeb8ea520d40

    SHA512

    aeff74eecba81fa8ca6afba44628e725e65334e8f712e5a7c0ab14fb48b1b495730d69a3264258ecbe01ae1693b3781db4b08221bc377d8a11e29e0c3766d55c

    Download Submit
  • \??\c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • memory/228-137-0x0000000000000000-mapping.dmp
    Download
  • memory/228-143-0x00000000032E0000-0x000000000331C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/552-144-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/552-140-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/552-132-0x0000000000000000-mapping.dmp
    Download
  • memory/552-135-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/552-154-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/2812-146-0x0000000000000000-mapping.dmp
    Download
  • memory/4648-149-0x0000000000000000-mapping.dmp
    Download
  • memory/4772-151-0x0000000000000000-mapping.dmp
    Download