Analysis
-
max time kernel
84s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 01:15
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220812-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
voiceadequovl.exevoiceadequovl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 5 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 744 voiceadequovl.exe 4892 voiceadequovl.exe 1248 voiceadequovl.exe 3240 voiceadequovl.exe 2732 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
voiceadequovl.exedescription pid process target process PID 4892 set thread context of 2732 4892 voiceadequovl.exe voiceadequovl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exevoiceadequovl.exepowershell.exepid process 32 powershell.exe 32 powershell.exe 4892 voiceadequovl.exe 4892 voiceadequovl.exe 3532 powershell.exe 4892 voiceadequovl.exe 4892 voiceadequovl.exe 3532 powershell.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 4892 voiceadequovl.exe Token: SeDebugPrivilege 32 powershell.exe Token: SeDebugPrivilege 3532 powershell.exe Token: SeIncreaseQuotaPrivilege 616 wmic.exe Token: SeSecurityPrivilege 616 wmic.exe Token: SeTakeOwnershipPrivilege 616 wmic.exe Token: SeLoadDriverPrivilege 616 wmic.exe Token: SeSystemProfilePrivilege 616 wmic.exe Token: SeSystemtimePrivilege 616 wmic.exe Token: SeProfSingleProcessPrivilege 616 wmic.exe Token: SeIncBasePriorityPrivilege 616 wmic.exe Token: SeCreatePagefilePrivilege 616 wmic.exe Token: SeBackupPrivilege 616 wmic.exe Token: SeRestorePrivilege 616 wmic.exe Token: SeShutdownPrivilege 616 wmic.exe Token: SeDebugPrivilege 616 wmic.exe Token: SeSystemEnvironmentPrivilege 616 wmic.exe Token: SeRemoteShutdownPrivilege 616 wmic.exe Token: SeUndockPrivilege 616 wmic.exe Token: SeManageVolumePrivilege 616 wmic.exe Token: 33 616 wmic.exe Token: 34 616 wmic.exe Token: 35 616 wmic.exe Token: 36 616 wmic.exe Token: SeIncreaseQuotaPrivilege 616 wmic.exe Token: SeSecurityPrivilege 616 wmic.exe Token: SeTakeOwnershipPrivilege 616 wmic.exe Token: SeLoadDriverPrivilege 616 wmic.exe Token: SeSystemProfilePrivilege 616 wmic.exe Token: SeSystemtimePrivilege 616 wmic.exe Token: SeProfSingleProcessPrivilege 616 wmic.exe Token: SeIncBasePriorityPrivilege 616 wmic.exe Token: SeCreatePagefilePrivilege 616 wmic.exe Token: SeBackupPrivilege 616 wmic.exe Token: SeRestorePrivilege 616 wmic.exe Token: SeShutdownPrivilege 616 wmic.exe Token: SeDebugPrivilege 616 wmic.exe Token: SeSystemEnvironmentPrivilege 616 wmic.exe Token: SeRemoteShutdownPrivilege 616 wmic.exe Token: SeUndockPrivilege 616 wmic.exe Token: SeManageVolumePrivilege 616 wmic.exe Token: 33 616 wmic.exe Token: 34 616 wmic.exe Token: 35 616 wmic.exe Token: 36 616 wmic.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.execmd.exedescription pid process target process PID 4808 wrote to memory of 744 4808 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4808 wrote to memory of 744 4808 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4808 wrote to memory of 744 4808 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 744 wrote to memory of 4892 744 voiceadequovl.exe voiceadequovl.exe PID 744 wrote to memory of 4892 744 voiceadequovl.exe voiceadequovl.exe PID 744 wrote to memory of 4892 744 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 32 4892 voiceadequovl.exe powershell.exe PID 4892 wrote to memory of 32 4892 voiceadequovl.exe powershell.exe PID 4892 wrote to memory of 32 4892 voiceadequovl.exe powershell.exe PID 4892 wrote to memory of 3888 4892 voiceadequovl.exe cmd.exe PID 4892 wrote to memory of 3888 4892 voiceadequovl.exe cmd.exe PID 4892 wrote to memory of 3888 4892 voiceadequovl.exe cmd.exe PID 3888 wrote to memory of 3532 3888 cmd.exe powershell.exe PID 3888 wrote to memory of 3532 3888 cmd.exe powershell.exe PID 3888 wrote to memory of 3532 3888 cmd.exe powershell.exe PID 4892 wrote to memory of 1248 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 1248 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 1248 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 3240 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 3240 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 3240 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 4892 wrote to memory of 2732 4892 voiceadequovl.exe voiceadequovl.exe PID 2732 wrote to memory of 616 2732 voiceadequovl.exe wmic.exe PID 2732 wrote to memory of 616 2732 voiceadequovl.exe wmic.exe PID 2732 wrote to memory of 616 2732 voiceadequovl.exe wmic.exe PID 2732 wrote to memory of 1404 2732 voiceadequovl.exe cmd.exe PID 2732 wrote to memory of 1404 2732 voiceadequovl.exe cmd.exe PID 2732 wrote to memory of 1404 2732 voiceadequovl.exe cmd.exe PID 1404 wrote to memory of 2676 1404 cmd.exe WMIC.exe PID 1404 wrote to memory of 2676 1404 cmd.exe WMIC.exe PID 1404 wrote to memory of 2676 1404 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5978e7a09880d871d307a4f1115e432bb
SHA18984b34c32fb93be6cdf57c4979b057a8b269e20
SHA256d0f8cd45a9f30d6ac0af75796a44e3ff1d7cd9bdeaa568f740c6d441779783f9
SHA5125ea4e5ba4e4d6dcecf6ccc46e19e871ba78b52fc12e66c54f6035db93529cb620519a473bb47a9ed5edadb5699d208f2d6769dd09df5380118a933904ba2bcf1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
358.5MB
MD501cb88d3ffb38a7ef134c61983960c76
SHA1c24e0f84637e31069f5dc89c3debcf5f127d7025
SHA25606e7ff8d4d2ab602d0d078f3be878774dae311af8238a0b47ae31e86198a82b0
SHA5124d26218b9dc893139e2d3011d3cd3fec115a2713a3854c970e970f2b9db6b1c2db493e43f947318eb9a7b0a75ae662e82f331e94bf0e01bb7c55ad4a54698cac
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
248.2MB
MD5f60f515f3eef637d3ae0b6af1eb8ac31
SHA1e809531f495ec088750a6b20aa24a1a71a474409
SHA2564a1d68c3336bf86ba46637c5cbc22bdb996177221d5a5329538e0fda160e2316
SHA5121f9e5dfc59a5aba10e131e942ec86f72f0b6c99f3697f27a2842b606fac72a6d6765d128d9f9cf9119d404f352e0148c9a5b30d7e79beb2d30c8cbc0e1f7d514
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
244.1MB
MD538a283b41e5018db647f26cfc187b166
SHA185dabf1388a7c952389a2431d27d654a95f477ed
SHA256837d2bb5588610a80df7d8edaa64fc33954924634150036bf2ac26825875fb32
SHA5128499e319bd28d6d333552c1fb2862489bb2b1f9666e20730c6efe5ef085ad4c5df51318c2a56b71cd325eb0cc78b2134fb0920279def45f350f863f8035a44f4
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
141.8MB
MD5b145cd307d28dc6d3964903f3662376d
SHA1affc82b56dc483298f159554603b961b13d72473
SHA2561c697c41453c54d878b83055debd85673d3d4976cd52bfce4cb41ad20cf24b83
SHA512c16131adca20044d38d6bbcc0ebaf1552557403977cacf20e1c13d0b2309e73d73fea79f36993b2a58907cba3bd027d7b6574dad1143e5f7ebe14f569c730a0f
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
139.8MB
MD54dbdaa69040db8dba325a441178f4e89
SHA1d689e9455230f723ff1bb219f6e1165f574193b9
SHA2563865dba13d5670984bfafe4d87f30a106c34e31fba0d81dddb1b4f6dc836372c
SHA512adfee94215ba5e6d1034e50c812e7697990b5e7816a2dc561990c7b9d4c1ac302c0c3e996c608aea7ab0acfb063bde5fb49d84d27c5906d522196a2b03b1964e
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
140.4MB
MD521b882a4486e94d313dc225a74ab531a
SHA11c3728e0a9af24621cc7791cadef48a8204bd018
SHA256c41e47b8a54ccc75d96a5d51da5742f700eddbfeb171b2bb1d787ed1e127119f
SHA51299015a3a3663789c5aad3909298461656390759e24dbb565d38720781212b2a8b47790e6216bf6c9c278df9dbdcd1628ba269333c79a20b78a4c293509a7bf2c
-
memory/32-144-0x00000000053E0000-0x0000000005446000-memory.dmpFilesize
408KB
-
memory/32-141-0x0000000002480000-0x00000000024B6000-memory.dmpFilesize
216KB
-
memory/32-142-0x0000000004CD0000-0x00000000052F8000-memory.dmpFilesize
6.2MB
-
memory/32-145-0x0000000005A60000-0x0000000005A7E000-memory.dmpFilesize
120KB
-
memory/32-146-0x00000000070D0000-0x000000000774A000-memory.dmpFilesize
6.5MB
-
memory/32-147-0x0000000005F50000-0x0000000005F6A000-memory.dmpFilesize
104KB
-
memory/32-140-0x0000000000000000-mapping.dmp
-
memory/32-143-0x0000000005370000-0x00000000053D6000-memory.dmpFilesize
408KB
-
memory/616-167-0x0000000000000000-mapping.dmp
-
memory/744-132-0x0000000000000000-mapping.dmp
-
memory/916-174-0x0000000000000000-mapping.dmp
-
memory/1248-151-0x0000000000000000-mapping.dmp
-
memory/1404-169-0x0000000000000000-mapping.dmp
-
memory/2676-170-0x0000000000000000-mapping.dmp
-
memory/2732-155-0x0000000000000000-mapping.dmp
-
memory/2732-156-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/2732-159-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/2732-161-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/2732-176-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3240-153-0x0000000000000000-mapping.dmp
-
memory/3532-166-0x0000000007030000-0x000000000703A000-memory.dmpFilesize
40KB
-
memory/3532-171-0x00000000056E0000-0x00000000056EE000-memory.dmpFilesize
56KB
-
memory/3532-164-0x0000000070D90000-0x0000000070DDC000-memory.dmpFilesize
304KB
-
memory/3532-163-0x0000000006250000-0x0000000006282000-memory.dmpFilesize
200KB
-
memory/3532-168-0x0000000007270000-0x0000000007306000-memory.dmpFilesize
600KB
-
memory/3532-149-0x0000000000000000-mapping.dmp
-
memory/3532-173-0x00000000071D0000-0x00000000071D8000-memory.dmpFilesize
32KB
-
memory/3532-165-0x0000000006230000-0x000000000624E000-memory.dmpFilesize
120KB
-
memory/3532-172-0x00000000071F0000-0x000000000720A000-memory.dmpFilesize
104KB
-
memory/3888-148-0x0000000000000000-mapping.dmp
-
memory/4092-175-0x0000000000000000-mapping.dmp
-
memory/4892-138-0x0000000000A30000-0x00000000011A4000-memory.dmpFilesize
7.5MB
-
memory/4892-139-0x00000000070F0000-0x0000000007112000-memory.dmpFilesize
136KB
-
memory/4892-135-0x0000000000000000-mapping.dmp