Analysis
-
max time kernel
270s -
max time network
291s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2022 13:58
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20220812-en
General
-
Target
Setup.exe
-
Size
837.3MB
-
MD5
bf6b5f2d76fb058e3e6a38cbdbdd22a5
-
SHA1
dfef116bd3994f05476040608d63fd8af19d09d7
-
SHA256
b2f86cda9f22b4adc43c5bb08dfc2625619ab487c5f172b35ce190ac6d8782a9
-
SHA512
c06b9dc975d707038efc2a88c45f629fa3944bc5b7ecf2d979e5f8db52e60b161f42e82de92c7ed80482acb90bac436eeda77407047efab943380de72d57e9f4
-
SSDEEP
12288:PO5wC1Qx3/FeGLO9g4afrfYF3pVIyZZ8tfX9D6V01lpnOrsPgi:25wslGLacfYF8yEtftGY/Or+h
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Setup.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 3692 set thread context of 3796 3692 Setup.exe Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup.exepowershell.exepid process 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 4464 powershell.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 4464 powershell.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe 3692 Setup.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Setup.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3692 Setup.exe Token: SeDebugPrivilege 4464 powershell.exe Token: SeDebugPrivilege 3464 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Setup.execmd.exedescription pid process target process PID 3692 wrote to memory of 4464 3692 Setup.exe powershell.exe PID 3692 wrote to memory of 4464 3692 Setup.exe powershell.exe PID 3692 wrote to memory of 4464 3692 Setup.exe powershell.exe PID 3692 wrote to memory of 4936 3692 Setup.exe cmd.exe PID 3692 wrote to memory of 4936 3692 Setup.exe cmd.exe PID 3692 wrote to memory of 4936 3692 Setup.exe cmd.exe PID 4936 wrote to memory of 3464 4936 cmd.exe powershell.exe PID 4936 wrote to memory of 3464 4936 cmd.exe powershell.exe PID 4936 wrote to memory of 3464 4936 cmd.exe powershell.exe PID 3692 wrote to memory of 3796 3692 Setup.exe Setup.exe PID 3692 wrote to memory of 3796 3692 Setup.exe Setup.exe PID 3692 wrote to memory of 3796 3692 Setup.exe Setup.exe PID 3692 wrote to memory of 3796 3692 Setup.exe Setup.exe PID 3692 wrote to memory of 3796 3692 Setup.exe Setup.exe PID 3692 wrote to memory of 3796 3692 Setup.exe Setup.exe PID 3692 wrote to memory of 3796 3692 Setup.exe Setup.exe PID 3692 wrote to memory of 3796 3692 Setup.exe Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD58a1df57b40b78ed68c822945a18a9595
SHA1955480cf164ea714ddd961ed58d0b62a8b410cbd
SHA2564449a37af253aee00c95aa449f6bfd4626fc719280cfda389092b3743ac2e538
SHA5126b24a657c82eb15f7649d40c0226eb81b15bf31bc02de66c6648fb40fd92d75509a2db1242007832ee0f5215ab596141d708d394bf87569ce6d2ce24fe4d5687
-
memory/3464-161-0x00000000070C0000-0x00000000070C8000-memory.dmpFilesize
32KB
-
memory/3464-160-0x00000000070E0000-0x00000000070FA000-memory.dmpFilesize
104KB
-
memory/3464-159-0x0000000005660000-0x000000000566E000-memory.dmpFilesize
56KB
-
memory/3464-158-0x0000000007160000-0x00000000071F6000-memory.dmpFilesize
600KB
-
memory/3464-157-0x0000000006F20000-0x0000000006F2A000-memory.dmpFilesize
40KB
-
memory/3464-156-0x0000000006120000-0x000000000613E000-memory.dmpFilesize
120KB
-
memory/3464-155-0x000000006FFC0000-0x000000007000C000-memory.dmpFilesize
304KB
-
memory/3464-154-0x0000000006160000-0x0000000006192000-memory.dmpFilesize
200KB
-
memory/3464-145-0x0000000000000000-mapping.dmp
-
memory/3692-135-0x0000000005A90000-0x0000000005AB2000-memory.dmpFilesize
136KB
-
memory/3692-134-0x0000000005880000-0x0000000005912000-memory.dmpFilesize
584KB
-
memory/3692-132-0x0000000000AD0000-0x0000000000B8A000-memory.dmpFilesize
744KB
-
memory/3692-133-0x0000000005D50000-0x00000000062F4000-memory.dmpFilesize
5.6MB
-
memory/3796-147-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3796-150-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3796-146-0x0000000000000000-mapping.dmp
-
memory/3796-152-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4464-143-0x0000000006CA0000-0x0000000006CBA000-memory.dmpFilesize
104KB
-
memory/4464-142-0x0000000007FC0000-0x000000000863A000-memory.dmpFilesize
6.5MB
-
memory/4464-141-0x00000000067B0000-0x00000000067CE000-memory.dmpFilesize
120KB
-
memory/4464-140-0x0000000006060000-0x00000000060C6000-memory.dmpFilesize
408KB
-
memory/4464-139-0x0000000005FF0000-0x0000000006056000-memory.dmpFilesize
408KB
-
memory/4464-138-0x0000000005920000-0x0000000005F48000-memory.dmpFilesize
6.2MB
-
memory/4464-137-0x00000000051F0000-0x0000000005226000-memory.dmpFilesize
216KB
-
memory/4464-136-0x0000000000000000-mapping.dmp
-
memory/4936-144-0x0000000000000000-mapping.dmp