d2a4739ea4806b865ccadd0d9af3b57bfe16e6c2e45610fde4deabcb55ac473f

Analysis

max time kernel
593s
max time network
597s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2023, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OriginThinSetup.exe
Size

16.2MB
MD5

196000b96715c129748433e7b239eb3e
SHA1

811f4d93a71cebcf0789e95644033017f2098cb3
SHA256

d2a4739ea4806b865ccadd0d9af3b57bfe16e6c2e45610fde4deabcb55ac473f
SHA512

92a1a776b3f80f8ad83566809b8a38af000f5239a72a12f509c40a988a618c21794960641c0e1850182bd8d670c73c192b5438c52eff738e200500c7d309ca9a
SSDEEP

393216:kY+4RmNA8lNOgCtTvrACahClnc3lDUwScDJ6:kY+48kTAMYDo

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1492	Setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	OriginThinSetup.exe

Loads dropped DLL 5 IoCs

pid	Process
3260	OriginThinSetup.exe
3260	OriginThinSetup.exe
1492	Setup.exe
1492	Setup.exe
1492	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3260	OriginThinSetup.exe
3260	OriginThinSetup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3260	OriginThinSetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 1492	3260	OriginThinSetup.exe	80
PID 3260 wrote to memory of 1492	3260	OriginThinSetup.exe	80
PID 3260 wrote to memory of 1492	3260	OriginThinSetup.exe	80

C:\Users\Admin\AppData\Local\Temp\OriginThinSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OriginThinSetup.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\Origin\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Origin\Setup.exe" /launcherTime=240549359
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Origin\Setup.exe

Filesize
15.9MB

MD5
6770aad82dbbe946c3d82c9f300a719f

SHA1
92d1dd476ed7a46257bf26227d2a0f4299be94a3

SHA256
39fc394095b9b6975b9444d7bb9d4edf5b86f288a043eba80f49e1c5fee933d2

SHA512
1de5bfa7406b50c23fee8d2b42c571aa9132a8716a4694d3e47e77d04ac3dc5f9494528b7f8e88790feb868885d168b9b45148f3871b136261bf52ec8fc22dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Origin\Setup.exe

Filesize
15.9MB

MD5
6770aad82dbbe946c3d82c9f300a719f

SHA1
92d1dd476ed7a46257bf26227d2a0f4299be94a3

SHA256
39fc394095b9b6975b9444d7bb9d4edf5b86f288a043eba80f49e1c5fee933d2

SHA512
1de5bfa7406b50c23fee8d2b42c571aa9132a8716a4694d3e47e77d04ac3dc5f9494528b7f8e88790feb868885d168b9b45148f3871b136261bf52ec8fc22dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Origin\installerdll240549359.dll

Filesize
1.9MB

MD5
6f37c9f4699d5c69685a0f2d91e9c3f9

SHA1
3245485c4f42ec60c49dfd1bf6f388b76a23d30b

SHA256
2bbbc2b72401853b61fdae288fc0a8b80c0721a2c08f8eda30cbf87c13ab3fef

SHA512
50d53362006c6f090efc3ff224f290edd824ed3ede133cc29f0786d5f7916170423e0bf3d3b4c1b4617d7b8628cdb48eafb6e7291e88fcf3fa8465d03a1da719

Download Submit
C:\Users\Admin\AppData\Local\Temp\Origin\nshA6F5.tmp\System.dll

Filesize
11KB

MD5
1290200e40ae16a493b89ccf4173e81e

SHA1
bcbc4e9515a0add11aa8cc2554545436a2ee5884

SHA256
b8813d15f9a843a555dd3fa1c83eb0965807946d61b5eae9b5b285f7d56c9ba8

SHA512
a5b056379535285731cbe59b1fd749c0cfcadcacd2a8c8337795cc6cc313fc6dd0e8cf18dd9a2ed9ef39674f9a3349274c4734f67bde8ce2300dd6cc71955511

Download Submit
C:\Users\Admin\AppData\Local\Temp\Origin\nshA6F5.tmp\UserInfo.dll

Filesize
4KB

MD5
d49f4084090a5d1918db65cf5559e431

SHA1
f90ac39aff7608a6ab7b685bf7fa8740a104485c

SHA256
d588140a504322e672409aa4bc8a9aa398f36b9846e9a651a24246d8cae29507

SHA512
d01496b67ea5552e1fcd9762d4080b84cb6cb8779ced92394846b89cc8b08eb47fdb07317b41696ee5f9c61c52694331d3255cd49b482c9dbe24dca3d79954d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Origin\nshA6F5.tmp\UserInfo.dll

Filesize
4KB

MD5
d49f4084090a5d1918db65cf5559e431

SHA1
f90ac39aff7608a6ab7b685bf7fa8740a104485c

SHA256
d588140a504322e672409aa4bc8a9aa398f36b9846e9a651a24246d8cae29507

SHA512
d01496b67ea5552e1fcd9762d4080b84cb6cb8779ced92394846b89cc8b08eb47fdb07317b41696ee5f9c61c52694331d3255cd49b482c9dbe24dca3d79954d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Origin\nsl7DF1.tmp\System.dll

Filesize
11KB

MD5
1290200e40ae16a493b89ccf4173e81e

SHA1
bcbc4e9515a0add11aa8cc2554545436a2ee5884

SHA256
b8813d15f9a843a555dd3fa1c83eb0965807946d61b5eae9b5b285f7d56c9ba8

SHA512
a5b056379535285731cbe59b1fd749c0cfcadcacd2a8c8337795cc6cc313fc6dd0e8cf18dd9a2ed9ef39674f9a3349274c4734f67bde8ce2300dd6cc71955511

Download Submit