Analysis
-
max time kernel
118s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2023 22:44
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20220812-en
General
-
Target
Setup.exe
-
Size
726.0MB
-
MD5
88f5792ceda4df58f4c9bec9bbdd4a04
-
SHA1
60bf9077b57289caa614025bf2824eab086b2157
-
SHA256
021ebf3c52ec1eb0b1ad741222f3b6795f794e26cc043beecf802a58d3ec2904
-
SHA512
61f065f317c7f66081223b66f6653e118e93e778a3350f0a57867938dca2dfc8c57d157d0ae02f72b93904fefa24cf541975443867f09cb4e13d4d77139781d8
-
SSDEEP
98304:SnWvdJR3w+AZorxot0eX+9mQe+Azi7vDPXHjBs0gChji/AEipDFXfY7k/I:Sn2D3K3G7YUNs+EgJg7aI
Malware Config
Extracted
raccoon
1269ed6cdc166a49ecc72e46095cface
http://79.137.197.160/
http://79.137.197.190/
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4588 2520 WerFault.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Setup.exetaskmgr.exepid process 540 Setup.exe 540 Setup.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 1040 taskmgr.exe Token: SeSystemProfilePrivilege 1040 taskmgr.exe Token: SeCreateGlobalPrivilege 1040 taskmgr.exe Token: 33 1040 taskmgr.exe Token: SeIncBasePriorityPrivilege 1040 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
Processes:
taskmgr.exepid process 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
Processes:
taskmgr.exepid process 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe 1040 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 448 -p 2520 -ip 25201⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2520 -s 7721⤵
- Program crash
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/540-132-0x0000000000400000-0x0000000000D6E000-memory.dmpFilesize
9.4MB
-
memory/540-134-0x0000000000400000-0x0000000000D6E000-memory.dmpFilesize
9.4MB
-
memory/540-135-0x0000000000400000-0x0000000000D6E000-memory.dmpFilesize
9.4MB
-
memory/540-136-0x0000000000400000-0x0000000000D6E000-memory.dmpFilesize
9.4MB