Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 12:51
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220812-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 3 IoCs
pid Process 976 voiceadequovl.exe 620 voiceadequovl.exe 3772 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 620 set thread context of 3772 620 voiceadequovl.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2808 powershell.exe 2808 powershell.exe 1336 powershell.exe 1336 powershell.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 620 voiceadequovl.exe Token: SeDebugPrivilege 2808 powershell.exe Token: SeDebugPrivilege 1336 powershell.exe Token: SeIncreaseQuotaPrivilege 2020 wmic.exe Token: SeSecurityPrivilege 2020 wmic.exe Token: SeTakeOwnershipPrivilege 2020 wmic.exe Token: SeLoadDriverPrivilege 2020 wmic.exe Token: SeSystemProfilePrivilege 2020 wmic.exe Token: SeSystemtimePrivilege 2020 wmic.exe Token: SeProfSingleProcessPrivilege 2020 wmic.exe Token: SeIncBasePriorityPrivilege 2020 wmic.exe Token: SeCreatePagefilePrivilege 2020 wmic.exe Token: SeBackupPrivilege 2020 wmic.exe Token: SeRestorePrivilege 2020 wmic.exe Token: SeShutdownPrivilege 2020 wmic.exe Token: SeDebugPrivilege 2020 wmic.exe Token: SeSystemEnvironmentPrivilege 2020 wmic.exe Token: SeRemoteShutdownPrivilege 2020 wmic.exe Token: SeUndockPrivilege 2020 wmic.exe Token: SeManageVolumePrivilege 2020 wmic.exe Token: 33 2020 wmic.exe Token: 34 2020 wmic.exe Token: 35 2020 wmic.exe Token: 36 2020 wmic.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3460 wrote to memory of 976 3460 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 80 PID 3460 wrote to memory of 976 3460 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 80 PID 3460 wrote to memory of 976 3460 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 80 PID 976 wrote to memory of 620 976 voiceadequovl.exe 88 PID 976 wrote to memory of 620 976 voiceadequovl.exe 88 PID 976 wrote to memory of 620 976 voiceadequovl.exe 88 PID 620 wrote to memory of 2808 620 voiceadequovl.exe 90 PID 620 wrote to memory of 2808 620 voiceadequovl.exe 90 PID 620 wrote to memory of 2808 620 voiceadequovl.exe 90 PID 620 wrote to memory of 4984 620 voiceadequovl.exe 92 PID 620 wrote to memory of 4984 620 voiceadequovl.exe 92 PID 620 wrote to memory of 4984 620 voiceadequovl.exe 92 PID 4984 wrote to memory of 1336 4984 cmd.exe 94 PID 4984 wrote to memory of 1336 4984 cmd.exe 94 PID 4984 wrote to memory of 1336 4984 cmd.exe 94 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 620 wrote to memory of 3772 620 voiceadequovl.exe 95 PID 3772 wrote to memory of 2020 3772 voiceadequovl.exe 96 PID 3772 wrote to memory of 2020 3772 voiceadequovl.exe 96 PID 3772 wrote to memory of 2020 3772 voiceadequovl.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
-
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵PID:1172
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵PID:3904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵PID:1848
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵PID:1972
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56195a91754effb4df74dbc72cdf4f7a6
SHA1aba262f5726c6d77659fe0d3195e36a85046b427
SHA2563254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
SHA512ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
-
Filesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
Filesize
16KB
MD5deffc9bdf40188b46016316bbb229fd9
SHA1dd10acfacd48546dac16779762cc0dd623fc2b07
SHA2560fa589eee5b7662568a3f258a0f8eba6cae4bc692716c8494a829d8ae11b3b20
SHA512f36ad4d2b8682d2436a015506ba3c3f9f6ad6764e5e3ee2ef26657f4f8657d47fcc4f28c84d337f6e0cd8342b75535234cc46a8517f9745743cbaa076e12b1be
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
Filesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
Filesize
158.4MB
MD5d45be6675d58f66858318170a82ff195
SHA15b15d34fd899d4edbfd38453dd4a995af19a0cfa
SHA256dcfc1947c87bb5fd33fbb26dfa4139a77d846db5dad3b2e13d1b2e99f96b20b4
SHA5121d4f90d7ad82e08ff76d95e5ed750474152136757503d4ac7ddf02fcaaa27e0a7087deda31a536a4af74d4db1c9fc02251225f9394bca2576c5ebaee72f6f882