Analysis
-
max time kernel
118s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2023 14:08
Static task
static1
General
-
Target
BraveBrowserSetup.exe
-
Size
309.1MB
-
MD5
931195d97525e56b81273de435a1b23a
-
SHA1
a7b1888845db32aceb0c0d8a98a448e94ac95d0a
-
SHA256
bd06228669802c5ee2f00c900dd17efd1763780b17f05346d5ddcf6ead24297b
-
SHA512
c53b492d548f9cbd1f35aff646fe5344b141bf226aa78eb39c05914ff2704fd4cd9c5ed336967354b3311db487f60271374783ef6d485187ea714cd506912792
-
SSDEEP
24576:jgo+DDRIgvlC+pKc8zDkfxUXtWjPMBzuxK2:M5DDRISrxUcjPMBzuxv
Malware Config
Extracted
vidar
56.2
1853
https://t.me/+nxuZybmPtR01ZmE0
-
profile_id
1853
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BraveBrowserSetup.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation BraveBrowserSetup.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BraveBrowserSetup.exedescription pid process target process PID 1132 set thread context of 2424 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeBraveBrowserSetup.exepid process 1620 powershell.exe 1620 powershell.exe 1132 BraveBrowserSetup.exe 1132 BraveBrowserSetup.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BraveBrowserSetup.exepowershell.exedescription pid process Token: SeDebugPrivilege 1132 BraveBrowserSetup.exe Token: SeDebugPrivilege 1620 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
BraveBrowserSetup.exedescription pid process target process PID 1132 wrote to memory of 1620 1132 BraveBrowserSetup.exe powershell.exe PID 1132 wrote to memory of 1620 1132 BraveBrowserSetup.exe powershell.exe PID 1132 wrote to memory of 1620 1132 BraveBrowserSetup.exe powershell.exe PID 1132 wrote to memory of 2452 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2452 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2452 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2424 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2424 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2424 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2424 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2424 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2424 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2424 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2424 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe PID 1132 wrote to memory of 2424 1132 BraveBrowserSetup.exe BraveBrowserSetup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup.exe"C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup.exeC:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup.exeC:\Users\Admin\AppData\Local\Temp\BraveBrowserSetup.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1132-132-0x0000000000310000-0x00000000003D6000-memory.dmpFilesize
792KB
-
memory/1132-133-0x00000000052F0000-0x0000000005894000-memory.dmpFilesize
5.6MB
-
memory/1132-134-0x0000000004E40000-0x0000000004ED2000-memory.dmpFilesize
584KB
-
memory/1132-135-0x0000000004F00000-0x0000000004F22000-memory.dmpFilesize
136KB
-
memory/1620-140-0x0000000005CC0000-0x0000000005D26000-memory.dmpFilesize
408KB
-
memory/1620-143-0x00000000067D0000-0x00000000067EA000-memory.dmpFilesize
104KB
-
memory/1620-138-0x00000000055B0000-0x0000000005BD8000-memory.dmpFilesize
6.2MB
-
memory/1620-139-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/1620-136-0x0000000000000000-mapping.dmp
-
memory/1620-141-0x00000000062C0000-0x00000000062DE000-memory.dmpFilesize
120KB
-
memory/1620-142-0x0000000007920000-0x0000000007F9A000-memory.dmpFilesize
6.5MB
-
memory/1620-137-0x0000000002CD0000-0x0000000002D06000-memory.dmpFilesize
216KB
-
memory/2424-145-0x0000000000000000-mapping.dmp
-
memory/2424-146-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2424-147-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2424-148-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2424-149-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2424-150-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2452-144-0x0000000000000000-mapping.dmp