Overview

overview

8

Static

static

3ead94fb53...d0.exe

windows7-x64

8

3ead94fb53...d0.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    132s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 15:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ead94fb536b3ef07de53af5b6357296b94ffddbe773595348ff9e22ef038ed0.exe

  • Size

    5.7MB

  • MD5

    1a44409d5b2ab13bf53b11906f0683c0

  • SHA1

    882864d436455deaedbfec8a78bab968f848488d

  • SHA256

    3ead94fb536b3ef07de53af5b6357296b94ffddbe773595348ff9e22ef038ed0

  • SHA512

    2af5ef4d4310014cd39d58b0d2d8e274c553cfd3eb3d04bda245c16834262eea2a7b582004548e239f5eed2fc6654a7161d3b8aaaea4a5d719b367f252b3f674

  • SSDEEP

    98304:6L+p957/mfkAb0JOyEmi+thHGAa0P9CQOGCfRJ2jlTDZ2l4wdcACdcruV95czC:m89J/ANzywiJlgQNUJ2BTDYiqcAViVw+

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 53 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ead94fb536b3ef07de53af5b6357296b94ffddbe773595348ff9e22ef038ed0.exe
    "C:\Users\Admin\AppData\Local\Temp\3ead94fb536b3ef07de53af5b6357296b94ffddbe773595348ff9e22ef038ed0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
      C:\Users\Admin\AppData\Local\Temp\\optprosetup.exe /VERYSILENT
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Users\Admin\AppData\Local\Temp\is-5VB14.tmp\optprosetup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-5VB14.tmp\optprosetup.tmp" /SL5="$6004C,5286589,118784,C:\Users\Admin\AppData\Local\Temp\optprosetup.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT -install
          4⤵
          • Loads dropped DLL
          PID:4684
        • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
          "C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"
          4⤵
          • Executes dropped EXE
          PID:4436
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT
      2⤵
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:4688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
    Filesize

    643KB

    MD5

    1713fa8e8ecdfb32c46dd466c63107c6

    SHA1

    3798f368de630f751d3c05de7f9cfe7134caa604

    SHA256

    8e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f

    SHA512

    71bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
    Filesize

    643KB

    MD5

    1713fa8e8ecdfb32c46dd466c63107c6

    SHA1

    3798f368de630f751d3c05de7f9cfe7134caa604

    SHA256

    8e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f

    SHA512

    71bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-5VB14.tmp\optprosetup.tmp
    Filesize

    1.1MB

    MD5

    50488cf899d007d697893fc72a823fb0

    SHA1

    bc5512f623656ad69a054d558c35d463a5a8a6c1

    SHA256

    d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf

    SHA512

    2b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-5VB14.tmp\optprosetup.tmp
    Filesize

    1.1MB

    MD5

    50488cf899d007d697893fc72a823fb0

    SHA1

    bc5512f623656ad69a054d558c35d463a5a8a6c1

    SHA256

    d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf

    SHA512

    2b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-LBDE5.tmp\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-LBDE5.tmp\itdownload.dll
    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-LBDE5.tmp\itdownload.dll
    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
    Filesize

    5.5MB

    MD5

    3d31e999e8433d22b740ee0c55ac93ce

    SHA1

    73ad53e7f5198f124f70d31bf2b2c6511aa8caea

    SHA256

    769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba

    SHA512

    85654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
    Filesize

    5.5MB

    MD5

    3d31e999e8433d22b740ee0c55ac93ce

    SHA1

    73ad53e7f5198f124f70d31bf2b2c6511aa8caea

    SHA256

    769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba

    SHA512

    85654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b

    Download Submit
  • \??\c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • memory/1128-140-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/1128-132-0x0000000000000000-mapping.dmp
    Download
  • memory/1128-135-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/1128-153-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/1740-137-0x0000000000000000-mapping.dmp
    Download
  • memory/1740-143-0x0000000003330000-0x000000000336C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/4436-150-0x0000000000000000-mapping.dmp
    Download
  • memory/4684-145-0x0000000000000000-mapping.dmp
    Download
  • memory/4688-148-0x0000000000000000-mapping.dmp
    Download