Analysis
-
max time kernel
82s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 08:44
Static task
static1
Behavioral task
behavioral1
Sample
a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe
Resource
win10v2004-20221111-en
General
-
Target
a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe
-
Size
675KB
-
MD5
520967b89e3c199aeb953dd96a5b1934
-
SHA1
53edcbf7659478031a05a37fe1f2df05fa4a1658
-
SHA256
a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834
-
SHA512
77a1a9a906d269ded0147563f50f78da3740497d7d23986b869556fce3effadf9088694d917d5302db8cf318d7e908f67dedf8619c5f52d22d85a9ed3a9667c7
-
SSDEEP
12288:cfNb4S3eYs5lSl4sRmKXsq42aJuMBvN1Bxb5dIYs3g1RwS3wGvTbd1wjop+w:ANEq+xKX62aJuYvNPd543A6S/vTPwjoh
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
irsetup.exealg.exepid process 2020 irsetup.exe 520 alg.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx behavioral1/memory/2020-65-0x0000000000400000-0x000000000057F000-memory.dmp upx behavioral1/memory/2020-66-0x0000000000400000-0x000000000057F000-memory.dmp upx behavioral1/memory/2020-72-0x0000000000400000-0x000000000057F000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exeirsetup.exepid process 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe 2020 irsetup.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
irsetup.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run irsetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Application Layer Gateway = "C:\\Program Files (x86)\\Common Files\\alg.exe" irsetup.exe -
Drops file in Program Files directory 2 IoCs
Processes:
irsetup.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\alg.exe irsetup.exe File created C:\Program Files (x86)\Common Files\alg.exe irsetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
alg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main alg.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch alg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" alg.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
irsetup.exealg.exepid process 2020 irsetup.exe 2020 irsetup.exe 520 alg.exe 520 alg.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exeirsetup.exedescription pid process target process PID 1244 wrote to memory of 2020 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe irsetup.exe PID 1244 wrote to memory of 2020 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe irsetup.exe PID 1244 wrote to memory of 2020 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe irsetup.exe PID 1244 wrote to memory of 2020 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe irsetup.exe PID 1244 wrote to memory of 2020 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe irsetup.exe PID 1244 wrote to memory of 2020 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe irsetup.exe PID 1244 wrote to memory of 2020 1244 a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe irsetup.exe PID 2020 wrote to memory of 520 2020 irsetup.exe alg.exe PID 2020 wrote to memory of 520 2020 irsetup.exe alg.exe PID 2020 wrote to memory of 520 2020 irsetup.exe alg.exe PID 2020 wrote to memory of 520 2020 irsetup.exe alg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe"C:\Users\Admin\AppData\Local\Temp\a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:654882 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\a5fa03912e42b146af3cbe6dbf816137d09c29388725a1ab566f910780c92834.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-3406023954-474543476-3319432036-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Common Files\alg.exe"C:\Program Files (x86)\Common Files\alg.exe"3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\alg.exeFilesize
33KB
MD595e93dab48ebaad753dadae83b666556
SHA15415f8aec7736d00ccd217ef8389721882109a21
SHA256eb7bdd197576b898ee19bc0bd51f1902c179ce48079e8bf34b46ae675cecabca
SHA51202b8d49bed87a9624402d593c032af34a41621128f6d050d01213f382a533079250c584cd386c6e4f5e2889f0721ecf00471dd881a2b6fc82dfb2c073e7ea84f
-
C:\Program Files (x86)\Common Files\alg.exeFilesize
33KB
MD595e93dab48ebaad753dadae83b666556
SHA15415f8aec7736d00ccd217ef8389721882109a21
SHA256eb7bdd197576b898ee19bc0bd51f1902c179ce48079e8bf34b46ae675cecabca
SHA51202b8d49bed87a9624402d593c032af34a41621128f6d050d01213f382a533079250c584cd386c6e4f5e2889f0721ecf00471dd881a2b6fc82dfb2c073e7ea84f
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
563KB
MD576da2c7c124183acf74251db2a336a79
SHA1e3af0b141c37fe8db95397970aac0f9545e8b45a
SHA25677a0ee56b68c5524c79201bc045aed9c212a90f4f28d5f08a8c15507df94aad0
SHA512b160aa92810da8dc71cfffcc5ee0eeaf3058dcd39a0b1c0f02fd03436d011d9f50b46c0bea984cf3ee732162601e3a140b408655c647ff00654fa59d8fb2a8e4
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
563KB
MD576da2c7c124183acf74251db2a336a79
SHA1e3af0b141c37fe8db95397970aac0f9545e8b45a
SHA25677a0ee56b68c5524c79201bc045aed9c212a90f4f28d5f08a8c15507df94aad0
SHA512b160aa92810da8dc71cfffcc5ee0eeaf3058dcd39a0b1c0f02fd03436d011d9f50b46c0bea984cf3ee732162601e3a140b408655c647ff00654fa59d8fb2a8e4
-
\Program Files (x86)\Common Files\alg.exeFilesize
33KB
MD595e93dab48ebaad753dadae83b666556
SHA15415f8aec7736d00ccd217ef8389721882109a21
SHA256eb7bdd197576b898ee19bc0bd51f1902c179ce48079e8bf34b46ae675cecabca
SHA51202b8d49bed87a9624402d593c032af34a41621128f6d050d01213f382a533079250c584cd386c6e4f5e2889f0721ecf00471dd881a2b6fc82dfb2c073e7ea84f
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
563KB
MD576da2c7c124183acf74251db2a336a79
SHA1e3af0b141c37fe8db95397970aac0f9545e8b45a
SHA25677a0ee56b68c5524c79201bc045aed9c212a90f4f28d5f08a8c15507df94aad0
SHA512b160aa92810da8dc71cfffcc5ee0eeaf3058dcd39a0b1c0f02fd03436d011d9f50b46c0bea984cf3ee732162601e3a140b408655c647ff00654fa59d8fb2a8e4
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
563KB
MD576da2c7c124183acf74251db2a336a79
SHA1e3af0b141c37fe8db95397970aac0f9545e8b45a
SHA25677a0ee56b68c5524c79201bc045aed9c212a90f4f28d5f08a8c15507df94aad0
SHA512b160aa92810da8dc71cfffcc5ee0eeaf3058dcd39a0b1c0f02fd03436d011d9f50b46c0bea984cf3ee732162601e3a140b408655c647ff00654fa59d8fb2a8e4
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
563KB
MD576da2c7c124183acf74251db2a336a79
SHA1e3af0b141c37fe8db95397970aac0f9545e8b45a
SHA25677a0ee56b68c5524c79201bc045aed9c212a90f4f28d5f08a8c15507df94aad0
SHA512b160aa92810da8dc71cfffcc5ee0eeaf3058dcd39a0b1c0f02fd03436d011d9f50b46c0bea984cf3ee732162601e3a140b408655c647ff00654fa59d8fb2a8e4
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
563KB
MD576da2c7c124183acf74251db2a336a79
SHA1e3af0b141c37fe8db95397970aac0f9545e8b45a
SHA25677a0ee56b68c5524c79201bc045aed9c212a90f4f28d5f08a8c15507df94aad0
SHA512b160aa92810da8dc71cfffcc5ee0eeaf3058dcd39a0b1c0f02fd03436d011d9f50b46c0bea984cf3ee732162601e3a140b408655c647ff00654fa59d8fb2a8e4
-
memory/520-68-0x0000000000000000-mapping.dmp
-
memory/520-71-0x000007FEF3CF0000-0x000007FEF4713000-memory.dmpFilesize
10.1MB
-
memory/520-73-0x000007FEEE000000-0x000007FEEF096000-memory.dmpFilesize
16.6MB
-
memory/520-74-0x0000000000B46000-0x0000000000B65000-memory.dmpFilesize
124KB
-
memory/520-75-0x0000000000B46000-0x0000000000B65000-memory.dmpFilesize
124KB
-
memory/1244-64-0x00000000027A0000-0x000000000291F000-memory.dmpFilesize
1.5MB
-
memory/1244-63-0x00000000027A0000-0x000000000291F000-memory.dmpFilesize
1.5MB
-
memory/1244-54-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB
-
memory/2020-65-0x0000000000400000-0x000000000057F000-memory.dmpFilesize
1.5MB
-
memory/2020-66-0x0000000000400000-0x000000000057F000-memory.dmpFilesize
1.5MB
-
memory/2020-59-0x0000000000000000-mapping.dmp
-
memory/2020-72-0x0000000000400000-0x000000000057F000-memory.dmpFilesize
1.5MB