Analysis
-
max time kernel
254s -
max time network
257s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
16-12-2022 12:38
Static task
static1
Behavioral task
behavioral1
Sample
BraveBrowserSetup.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
300 seconds
General
-
Target
BraveBrowserSetup.exe
-
Size
309.1MB
-
MD5
931195d97525e56b81273de435a1b23a
-
SHA1
a7b1888845db32aceb0c0d8a98a448e94ac95d0a
-
SHA256
bd06228669802c5ee2f00c900dd17efd1763780b17f05346d5ddcf6ead24297b
-
SHA512
c53b492d548f9cbd1f35aff646fe5344b141bf226aa78eb39c05914ff2704fd4cd9c5ed336967354b3311db487f60271374783ef6d485187ea714cd506912792
-
SSDEEP
24576:jgo+DDRIgvlC+pKc8zDkfxUXtWjPMBzuxK2:M5DDRISrxUcjPMBzuxv
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
BraveBrowserSetup.exedescription pid process target process PID 1216 set thread context of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 560 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BraveBrowserSetup.exepowershell.exedescription pid process Token: SeDebugPrivilege 1216 BraveBrowserSetup.exe Token: SeDebugPrivilege 560 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
BraveBrowserSetup.exedescription pid process target process PID 1216 wrote to memory of 560 1216 BraveBrowserSetup.exe powershell.exe PID 1216 wrote to memory of 560 1216 BraveBrowserSetup.exe powershell.exe PID 1216 wrote to memory of 560 1216 BraveBrowserSetup.exe powershell.exe PID 1216 wrote to memory of 560 1216 BraveBrowserSetup.exe powershell.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1216 wrote to memory of 268 1216 BraveBrowserSetup.exe BraveBrowserSetup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup.exe"C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup.exeC:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-70-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/268-68-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/268-63-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/268-76-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/268-64-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/268-75-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/268-73-0x000000000042DB8C-mapping.dmp
-
memory/268-66-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/268-72-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/560-60-0x000000006F200000-0x000000006F7AB000-memory.dmpFilesize
5.7MB
-
memory/560-62-0x000000006F200000-0x000000006F7AB000-memory.dmpFilesize
5.7MB
-
memory/560-58-0x0000000000000000-mapping.dmp
-
memory/560-61-0x000000006F200000-0x000000006F7AB000-memory.dmpFilesize
5.7MB
-
memory/1216-54-0x0000000000810000-0x00000000008D6000-memory.dmpFilesize
792KB
-
memory/1216-56-0x0000000000780000-0x0000000000812000-memory.dmpFilesize
584KB
-
memory/1216-55-0x0000000004890000-0x0000000004950000-memory.dmpFilesize
768KB
-
memory/1216-57-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB