8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e

Analysis

max time kernel
188s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e.exe
Size

8.6MB
MD5

6b8c5f84fadc175d328c36214aa5fa09
SHA1

fd1987cfe5916aef22bfdcb116eb767528822e1c
SHA256

8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e
SHA512

515a7109b058bf9e5b1192240a332eff87fd59f0388373a9ac6edfa21f38e1558ec76a75c2d911da5c9f96b30f37483d864b0fe5ff3c42b1fcad4c36ce9aa7fa
SSDEEP

196608:PS7/tI2t37W2rGdd72bfuH7bff4+It9YAKPAERIRCTQCFo:PS7t17xU2A7bXpIt9YAKPAERN9m

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3928	driverrobot_setup.exe
4192	fos.exe
2972	driverrobot_setup.tmp
4800	ApnStub.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023167-136.dat	upx
behavioral2/files/0x0007000000023167-137.dat	upx
behavioral2/memory/4192-138-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/4192-152-0x0000000000400000-0x0000000000562000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e.exe

Loads dropped DLL 1 IoCs

pid	Process
2972	driverrobot_setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	4192	WerFault.exe	88

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5c0000000100000004000000000400007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64	ApnStub.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	ApnStub.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4192	fos.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 3928	3424	8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e.exe	87
PID 3424 wrote to memory of 3928	3424	8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e.exe	87
PID 3424 wrote to memory of 3928	3424	8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e.exe	87
PID 3424 wrote to memory of 4192	3424	8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e.exe	88
PID 3424 wrote to memory of 4192	3424	8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e.exe	88
PID 3424 wrote to memory of 4192	3424	8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e.exe	88
PID 3928 wrote to memory of 2972	3928	driverrobot_setup.exe	89
PID 3928 wrote to memory of 2972	3928	driverrobot_setup.exe	89
PID 3928 wrote to memory of 2972	3928	driverrobot_setup.exe	89
PID 2972 wrote to memory of 4800	2972	driverrobot_setup.tmp	94
PID 2972 wrote to memory of 4800	2972	driverrobot_setup.tmp	94
PID 2972 wrote to memory of 4800	2972	driverrobot_setup.tmp	94

C:\Users\Admin\AppData\Local\Temp\8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e.exe
"C:\Users\Admin\AppData\Local\Temp\8f45ef569a85736d832df5123be8b349f119471f27808a8080813bfe24faf74e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Users\Admin\AppData\Local\Temp\driverrobot_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\driverrobot_setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Users\Admin\AppData\Local\Temp\is-EJ294.tmp\driverrobot_setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-EJ294.tmp\driverrobot_setup.tmp" /SL5="$A003E,8031791,182272,C:\Users\Admin\AppData\Local\Temp\driverrobot_setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\is-SFR0N.tmp\ApnStub.exe
      "C:\Users\Admin\AppData\Local\Temp\is-SFR0N.tmp\ApnStub.exe" /tb=BLT /local
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      PID:4800
- C:\Users\Admin\AppData\Local\Temp\fos.exe
  "C:\Users\Admin\AppData\Local\Temp\fos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 496
    3⤵
    - Program crash
    PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4192 -ip 4192
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\driverrobot_setup.exe

Filesize
8.1MB

MD5
f04a2ba51d8dff61aee292e17c8b4c33

SHA1
acb2915d30a16f3ae91f9d4644563563e41a881d

SHA256
ce7a9c9b6d4fb19567ac633eb5c7bd4b2ccf6910a7bc8babcb160556c581706c

SHA512
b5414b6d230dc49b6178bceac7da76eb76e117bcd51a326d870878a913f70e113beaa4d5b40d45a2cff1721526e14af6e3fd87cca0a51119d85c8705df543b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\driverrobot_setup.exe

Filesize
8.1MB

MD5
f04a2ba51d8dff61aee292e17c8b4c33

SHA1
acb2915d30a16f3ae91f9d4644563563e41a881d

SHA256
ce7a9c9b6d4fb19567ac633eb5c7bd4b2ccf6910a7bc8babcb160556c581706c

SHA512
b5414b6d230dc49b6178bceac7da76eb76e117bcd51a326d870878a913f70e113beaa4d5b40d45a2cff1721526e14af6e3fd87cca0a51119d85c8705df543b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\fos.exe

Filesize
605KB

MD5
8c5b801a212cb4a7f4f93a6ed04606c3

SHA1
d3ac0fb9debac323528ff438a40ef35b33b28f96

SHA256
1a4bb580d701caff9c6eda9952ea6d45950a769d38100880d1968c3a725aad35

SHA512
2196214366cc9a69f10832fa4a2b1200b0995a60bad587d07314d63f0287fced66991f92ce69f3b46a14c7ddbe97a7c440608c15a087e00037a5e0360745d96e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fos.exe

Filesize
605KB

MD5
8c5b801a212cb4a7f4f93a6ed04606c3

SHA1
d3ac0fb9debac323528ff438a40ef35b33b28f96

SHA256
1a4bb580d701caff9c6eda9952ea6d45950a769d38100880d1968c3a725aad35

SHA512
2196214366cc9a69f10832fa4a2b1200b0995a60bad587d07314d63f0287fced66991f92ce69f3b46a14c7ddbe97a7c440608c15a087e00037a5e0360745d96e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EJ294.tmp\driverrobot_setup.tmp

Filesize
1.1MB

MD5
13af9473e57f0f5f54882fa9fa0bd954

SHA1
78afeb66b851c48388f4c891cfc00d2471ab31ce

SHA256
e49be9733181c38e2b44c8f3253800eda3f84fe63e9afc492cbbcf61b648680c

SHA512
bd8097462d1062e475352f554b871852752f37fb8a8c4309e9f6e61ede69de614d0a710a87cb1c90bc0ff30dd06d762ce7ed734b1396b79b58ee31863eef4b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EJ294.tmp\driverrobot_setup.tmp

Filesize
1.1MB

MD5
13af9473e57f0f5f54882fa9fa0bd954

SHA1
78afeb66b851c48388f4c891cfc00d2471ab31ce

SHA256
e49be9733181c38e2b44c8f3253800eda3f84fe63e9afc492cbbcf61b648680c

SHA512
bd8097462d1062e475352f554b871852752f37fb8a8c4309e9f6e61ede69de614d0a710a87cb1c90bc0ff30dd06d762ce7ed734b1396b79b58ee31863eef4b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SFR0N.tmp\APNIC.dll

Filesize
236KB

MD5
0994a240f1a80d332c24930a1b713633

SHA1
fb51f7e178cdf4713c8de0a9ed001e9b622eb71c

SHA256
85af9002c0513ee7ec5a6751aed976a2a6213e13a0bd3cf9dbe7c4cd143bb561

SHA512
2e12210f42bf963628cba33673ece225762d53a9b1b8b77a8830a39e5d7df62daf1e7b45661063e4f1b28b32a89c9bd0a114aa67b039ac370a5a832762b2b1fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SFR0N.tmp\ApnStub.exe

Filesize
105KB

MD5
23ee55d0c183cc6e85c8fb97fb5973e8

SHA1
1a99d3266ce87fb2164e1153b4fd5815ac71dedc

SHA256
1696415e21f97128683de57bc8e159b2c076577595416b50769a006c531007e5

SHA512
b8b74d3c6decde5cff3d0d022cc65f00a5ce99f8af4ddb31c2f3b435675e0ef0f35917709b0b7ee4339918e416bfbfcabd39c2321d036a4841ac2ac389eab623

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SFR0N.tmp\ApnStub.exe

Filesize
105KB

MD5
23ee55d0c183cc6e85c8fb97fb5973e8

SHA1
1a99d3266ce87fb2164e1153b4fd5815ac71dedc

SHA256
1696415e21f97128683de57bc8e159b2c076577595416b50769a006c531007e5

SHA512
b8b74d3c6decde5cff3d0d022cc65f00a5ce99f8af4ddb31c2f3b435675e0ef0f35917709b0b7ee4339918e416bfbfcabd39c2321d036a4841ac2ac389eab623

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SFR0N.tmp\blt_kill_process.dll

Filesize
48KB

MD5
c16fe94c25fbdcbdc117f3ce65898b6d

SHA1
3931e9a128b7652f3e74cc18752396b235b4222e

SHA256
210b14086083cf034640771b6a71e3185c220141c9b4dae20bd58abc9d6fbe97

SHA512
05c95292264172493e2b1626ddcb9671f6781186761b7922b76ba9b0704fa6fb20a04656aa3aae1477afcbd43408d6ee530aabfef1f5976dbf048a079b00901b

Download Submit
memory/3928-141-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3928-139-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4192-138-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4192-152-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download