5702c61d4b1dfa2586a24d13e7148d304da805689ca0c5162913bd450462eac3

Analysis

max time kernel
176s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5702c61d4b1dfa2586a24d13e7148d304da805689ca0c5162913bd450462eac3.exe
Size

1.1MB
MD5

e6e9460b20d78b691f2c33bb98ef276b
SHA1

c855261d335143d939dd4bb887e878883008fe9b
SHA256

5702c61d4b1dfa2586a24d13e7148d304da805689ca0c5162913bd450462eac3
SHA512

2c18a467de6c12f9af6f7fdd7d83035cb974fc76e65cca2737be2f2a6d7f2781e0453e013d55d213afabdc81244148f0faf006d49d663399f0dd38a714b5bc65
SSDEEP

24576:lWvknOMEfSd6LrehHtFoBw9dzRBYhtHEqzXhkUi0S9I+9:lUeOMmo2rkNFo6z7YbtzKpq+9

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
988	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\Setup.exe = "0"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND	Setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 988	4924	5702c61d4b1dfa2586a24d13e7148d304da805689ca0c5162913bd450462eac3.exe	80
PID 4924 wrote to memory of 988	4924	5702c61d4b1dfa2586a24d13e7148d304da805689ca0c5162913bd450462eac3.exe	80
PID 4924 wrote to memory of 988	4924	5702c61d4b1dfa2586a24d13e7148d304da805689ca0c5162913bd450462eac3.exe	80

C:\Users\Admin\AppData\Local\Temp\5702c61d4b1dfa2586a24d13e7148d304da805689ca0c5162913bd450462eac3.exe
"C:\Users\Admin\AppData\Local\Temp\5702c61d4b1dfa2586a24d13e7148d304da805689ca0c5162913bd450462eac3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\a2d2qy9H8i\U0Juiq72\Setup.exe
  C:\Users\Admin\AppData\Local\Temp\a2d2qy9H8i\U0Juiq72\Setup.exe --relaunch
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  PID:988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a2d2qy9H8i\U0Juiq72\Setup.exe

Filesize
1.1MB

MD5
e6e9460b20d78b691f2c33bb98ef276b

SHA1
c855261d335143d939dd4bb887e878883008fe9b

SHA256
5702c61d4b1dfa2586a24d13e7148d304da805689ca0c5162913bd450462eac3

SHA512
2c18a467de6c12f9af6f7fdd7d83035cb974fc76e65cca2737be2f2a6d7f2781e0453e013d55d213afabdc81244148f0faf006d49d663399f0dd38a714b5bc65

Download Submit
C:\Users\Admin\AppData\Local\Temp\a2d2qy9H8i\U0Juiq72\Setup.exe

Filesize
1.1MB

MD5
e6e9460b20d78b691f2c33bb98ef276b

SHA1
c855261d335143d939dd4bb887e878883008fe9b

SHA256
5702c61d4b1dfa2586a24d13e7148d304da805689ca0c5162913bd450462eac3

SHA512
2c18a467de6c12f9af6f7fdd7d83035cb974fc76e65cca2737be2f2a6d7f2781e0453e013d55d213afabdc81244148f0faf006d49d663399f0dd38a714b5bc65

Download Submit
memory/988-884-0x0000000001FC1000-0x0000000002051000-memory.dmp

Filesize
576KB

Download
memory/988-941-0x0000000001FC1000-0x0000000002051000-memory.dmp

Filesize
576KB

Download
memory/4924-161-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-171-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-138-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-140-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-141-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-142-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-139-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-143-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-144-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-146-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-145-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-147-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-148-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-149-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-150-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-151-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-152-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-153-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-154-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-156-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-155-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-158-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-159-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-157-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-160-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-162-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-163-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-132-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-164-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-170-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-133-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-166-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-165-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-169-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-167-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-168-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-172-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-173-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-174-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-175-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-176-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-177-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-179-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-178-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-180-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-182-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-181-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-183-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-184-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-185-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-186-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-188-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-187-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-190-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-189-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-191-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-193-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-192-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-194-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-195-0x0000000002180000-0x000000000227D000-memory.dmp

Filesize
1012KB

Download
memory/4924-486-0x0000000002181000-0x0000000002211000-memory.dmp

Filesize
576KB

Download