Analysis
-
max time kernel
36s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-01-2023 10:32
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20221111-en
General
-
Target
Setup.exe
-
Size
358.2MB
-
MD5
aa2152760ef244611379b8e449f5b998
-
SHA1
b3c11e7420f3e0ba1a0d84d575dc3154410cc805
-
SHA256
0b1947e86f51a393cacb9e7d35f03b1fa0a3d7242328924441bcc70d5c5edac7
-
SHA512
cfcfe05c4a3b56746567f1f613313d1a3f409421fab00e56750f166f9848ef44bc9a99cd1486783a1835dcc83a3b69bfcbba878b0c61cee8e4abf77b94720fd5
-
SSDEEP
98304:uSk6F51U6HNesMycfbbEHv0mrSCcBT7h58oql8V6QYOaBBQY:LkiXRN8KS8oqlXB+
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Setup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe -
Processes:
Setup.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Setup.exedescription ioc process File opened for modification \??\PhysicalDrive0 Setup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Setup.exepid process 2004 Setup.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 2004 set thread context of 828 2004 Setup.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Setup.exepowershell.exepid process 2004 Setup.exe 1504 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Setup.exepowershell.exedescription pid process Token: SeDebugPrivilege 2004 Setup.exe Token: SeDebugPrivilege 1504 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Setup.exedescription pid process target process PID 2004 wrote to memory of 1504 2004 Setup.exe powershell.exe PID 2004 wrote to memory of 1504 2004 Setup.exe powershell.exe PID 2004 wrote to memory of 1504 2004 Setup.exe powershell.exe PID 2004 wrote to memory of 1504 2004 Setup.exe powershell.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe PID 2004 wrote to memory of 828 2004 Setup.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/828-69-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/828-76-0x00000000004088ED-mapping.dmp
-
memory/828-75-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/828-74-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/828-72-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/828-70-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1504-67-0x000000006E400000-0x000000006E9AB000-memory.dmpFilesize
5.7MB
-
memory/1504-68-0x000000006E400000-0x000000006E9AB000-memory.dmpFilesize
5.7MB
-
memory/1504-65-0x000000006E400000-0x000000006E9AB000-memory.dmpFilesize
5.7MB
-
memory/1504-63-0x0000000000000000-mapping.dmp
-
memory/2004-61-0x0000000005210000-0x00000000052B6000-memory.dmpFilesize
664KB
-
memory/2004-54-0x0000000075D11000-0x0000000075D13000-memory.dmpFilesize
8KB
-
memory/2004-62-0x0000000005B30000-0x0000000005BC2000-memory.dmpFilesize
584KB
-
memory/2004-66-0x0000000000080000-0x0000000000B26000-memory.dmpFilesize
10.6MB
-
memory/2004-60-0x0000000000080000-0x0000000000B26000-memory.dmpFilesize
10.6MB
-
memory/2004-59-0x0000000000080000-0x0000000000B26000-memory.dmpFilesize
10.6MB
-
memory/2004-56-0x0000000077380000-0x0000000077500000-memory.dmpFilesize
1.5MB
-
memory/2004-55-0x0000000000080000-0x0000000000B26000-memory.dmpFilesize
10.6MB
-
memory/2004-78-0x0000000000080000-0x0000000000B26000-memory.dmpFilesize
10.6MB
-
memory/2004-79-0x0000000077380000-0x0000000077500000-memory.dmpFilesize
1.5MB