Analysis
-
max time kernel
1423s -
max time network
1209s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-es -
resource tags
arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
29-11-2022 08:58
Static task
static1
Behavioral task
behavioral1
Sample
Setup_201.exe
Resource
win10v2004-20220812-es
General
-
Target
Setup_201.exe
-
Size
19.8MB
-
MD5
72f2f9e5b2923d6e7bdc80dc573e59cd
-
SHA1
784c224574ebb49815c03e05ef00ccacf7b49ba4
-
SHA256
cd8b6b851582c99b66567ade47e710279c1fe5ff5d18fc13a7628262007bf1b5
-
SHA512
8c186683a89ba4ae3e22525134bb36e22cce2bf41ab586a33f21f4347847b0b65c10e677ff2cc73fcc9a75864690c732aa181ec8edf35a3d8c7f9641161b408d
-
SSDEEP
393216:0xFSQtXwr7GGvK3crmpkCTrbumOrCh22vFgHdr3fH:0xm+GSMCpJGmOs2Qwdrv
Malware Config
Extracted
C:\Program Files\7-Zip\History.txt
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
GluebSystem.exepid process 5104 GluebSystem.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
GluebSystem.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" GluebSystem.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup_201.exeSetup_201.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Setup_201.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Setup_201.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 1144 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
GluebSystem.exeSetup_201.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\7z.exe GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt GluebSystem.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\7z.dll GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\7z.sfx GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt GluebSystem.exe File created C:\Program Files\7-Zip\Lang\tg.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\descript.ion GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt GluebSystem.exe File created C:\Program Files\7-Zip\Lang\sw.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll GluebSystem.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe GluebSystem.exe File created C:\Program Files (x86)\GlueSatisfyingdozSystem\GluebSystem.exe Setup_201.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt GluebSystem.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt GluebSystem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1116 4700 WerFault.exe -
Modifies registry class 20 IoCs
Processes:
GluebSystem.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" GluebSystem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" GluebSystem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip GluebSystem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" GluebSystem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" GluebSystem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" GluebSystem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 GluebSystem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" GluebSystem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} GluebSystem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" GluebSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" GluebSystem.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup_201.exeSetup_201.exepid process 4544 Setup_201.exe 4544 Setup_201.exe 632 Setup_201.exe 632 Setup_201.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Setup_201.exeSetup_201.exedescription pid process Token: SeDebugPrivilege 4544 Setup_201.exe Token: SeDebugPrivilege 632 Setup_201.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
Setup_201.exeSetup_201.exeGluebSystem.exepid process 4544 Setup_201.exe 4544 Setup_201.exe 632 Setup_201.exe 632 Setup_201.exe 5104 GluebSystem.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Setup_201.exeSetup_201.exedescription pid process target process PID 4544 wrote to memory of 632 4544 Setup_201.exe Setup_201.exe PID 4544 wrote to memory of 632 4544 Setup_201.exe Setup_201.exe PID 4544 wrote to memory of 632 4544 Setup_201.exe Setup_201.exe PID 632 wrote to memory of 5104 632 Setup_201.exe GluebSystem.exe PID 632 wrote to memory of 5104 632 Setup_201.exe GluebSystem.exe PID 632 wrote to memory of 5104 632 Setup_201.exe GluebSystem.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_201.exe"C:\Users\Admin\AppData\Local\Temp\Setup_201.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup_201.exe"C:\Users\Admin\AppData\Local\Temp\Setup_201.exe" /aq /tn2⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GlueSatisfyingdozSystem\GluebSystem.exe"C:\Program Files (x86)\GlueSatisfyingdozSystem\GluebSystem.exe"3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 4700 -ip 47001⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4700 -s 24601⤵
- Program crash
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GlueSatisfyingdozSystem\GluebSystem.exeFilesize
1.5MB
MD5a6a0f7c173094f8dafef996157751ecf
SHA1c0dcae7c4c80be25661d22400466b4ea074fc580
SHA256b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
SHA512965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94
-
C:\Program Files (x86)\GlueSatisfyingdozSystem\GluebSystem.exeFilesize
1.5MB
MD5a6a0f7c173094f8dafef996157751ecf
SHA1c0dcae7c4c80be25661d22400466b4ea074fc580
SHA256b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
SHA512965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94
-
C:\Program Files\7-Zip\7-zip.dllFilesize
92KB
MD5c3af132ea025d289ab4841fc00bb74af
SHA10a9973d5234cc55b8b97bbb82c722b910c71cbaf
SHA25656b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52
SHA512707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2
-
memory/632-132-0x0000000000000000-mapping.dmp
-
memory/5104-133-0x0000000000000000-mapping.dmp