Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:21
Behavioral task
behavioral1
Sample
1797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923.exe
Resource
win10v2004-20220901-en
General
-
Target
1797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923.exe
-
Size
464KB
-
MD5
90db9ee9a2be838479ab2e70e4dfd936
-
SHA1
59de7435ffd0cb577e05d2360ba3af0570b788d8
-
SHA256
1797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923
-
SHA512
615d3f1e58dc58e8045db4be0a58d273b1e402a8513a678aa5f00cf18f0e76507ebee4befc72a2cb52d465960fe614c8c0d9f6cbfce41c78e0e6d50751536df3
-
SSDEEP
12288:pg89R3qKtzPQkSNkG1XEZ3+7ytZcnepd1hjSRn:pg89T0LP2cn21hWRn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Setup.exepid process 4992 Setup.exe -
Processes:
resource yara_rule behavioral2/memory/1536-132-0x0000000000060000-0x0000000000193CA0-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\a26OqCG6hd\0t03DGsh\Setup.exe upx C:\Users\Admin\AppData\Local\Temp\a26OqCG6hd\0t03DGsh\Setup.exe upx behavioral2/memory/4992-136-0x0000000000350000-0x0000000000483CA0-memory.dmp upx behavioral2/memory/4992-137-0x0000000000350000-0x0000000000483CA0-memory.dmp upx behavioral2/memory/1536-138-0x0000000000060000-0x0000000000193CA0-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
Setup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1" Setup.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\Setup.exe = "0" Setup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923.exedescription pid process target process PID 1536 wrote to memory of 4992 1536 1797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923.exe Setup.exe PID 1536 wrote to memory of 4992 1536 1797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923.exe Setup.exe PID 1536 wrote to memory of 4992 1536 1797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923.exe Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923.exe"C:\Users\Admin\AppData\Local\Temp\1797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\a26OqCG6hd\0t03DGsh\Setup.exeC:\Users\Admin\AppData\Local\Temp\a26OqCG6hd\0t03DGsh\Setup.exe --relaunch2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
PID:4992
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a26OqCG6hd\0t03DGsh\Setup.exeFilesize
464KB
MD590db9ee9a2be838479ab2e70e4dfd936
SHA159de7435ffd0cb577e05d2360ba3af0570b788d8
SHA2561797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923
SHA512615d3f1e58dc58e8045db4be0a58d273b1e402a8513a678aa5f00cf18f0e76507ebee4befc72a2cb52d465960fe614c8c0d9f6cbfce41c78e0e6d50751536df3
-
C:\Users\Admin\AppData\Local\Temp\a26OqCG6hd\0t03DGsh\Setup.exeFilesize
464KB
MD590db9ee9a2be838479ab2e70e4dfd936
SHA159de7435ffd0cb577e05d2360ba3af0570b788d8
SHA2561797455f05cd7e4b398731fcd19e4a78d23d3a1730244106c1f0051b5d710923
SHA512615d3f1e58dc58e8045db4be0a58d273b1e402a8513a678aa5f00cf18f0e76507ebee4befc72a2cb52d465960fe614c8c0d9f6cbfce41c78e0e6d50751536df3
-
memory/1536-132-0x0000000000060000-0x0000000000193CA0-memory.dmpFilesize
1.2MB
-
memory/1536-138-0x0000000000060000-0x0000000000193CA0-memory.dmpFilesize
1.2MB
-
memory/4992-133-0x0000000000000000-mapping.dmp
-
memory/4992-136-0x0000000000350000-0x0000000000483CA0-memory.dmpFilesize
1.2MB
-
memory/4992-137-0x0000000000350000-0x0000000000483CA0-memory.dmpFilesize
1.2MB