Analysis
-
max time kernel
144s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 13:13
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
voiceadequovl.exevoiceadequovl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 4 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 1936 voiceadequovl.exe 1276 voiceadequovl.exe 4592 voiceadequovl.exe 844 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
voiceadequovl.exedescription pid process target process PID 1276 set thread context of 844 1276 voiceadequovl.exe voiceadequovl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exevoiceadequovl.exepowershell.exepid process 1896 powershell.exe 1896 powershell.exe 1276 voiceadequovl.exe 1276 voiceadequovl.exe 2316 powershell.exe 2316 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1276 voiceadequovl.exe Token: SeDebugPrivilege 1896 powershell.exe Token: SeDebugPrivilege 2316 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exedescription pid process target process PID 4476 wrote to memory of 1936 4476 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4476 wrote to memory of 1936 4476 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4476 wrote to memory of 1936 4476 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1936 wrote to memory of 1276 1936 voiceadequovl.exe voiceadequovl.exe PID 1936 wrote to memory of 1276 1936 voiceadequovl.exe voiceadequovl.exe PID 1936 wrote to memory of 1276 1936 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 1896 1276 voiceadequovl.exe powershell.exe PID 1276 wrote to memory of 1896 1276 voiceadequovl.exe powershell.exe PID 1276 wrote to memory of 1896 1276 voiceadequovl.exe powershell.exe PID 1276 wrote to memory of 876 1276 voiceadequovl.exe cmd.exe PID 1276 wrote to memory of 876 1276 voiceadequovl.exe cmd.exe PID 1276 wrote to memory of 876 1276 voiceadequovl.exe cmd.exe PID 876 wrote to memory of 2316 876 cmd.exe powershell.exe PID 876 wrote to memory of 2316 876 cmd.exe powershell.exe PID 876 wrote to memory of 2316 876 cmd.exe powershell.exe PID 1276 wrote to memory of 4592 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 4592 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 4592 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe PID 1276 wrote to memory of 844 1276 voiceadequovl.exe voiceadequovl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD53aca836f1f2ad57a8a297ccfb3dd1a1e
SHA176c48faad7a3223b9c2cb6146d3598dc409cd492
SHA256587a0b6c40dfe3ec3ec1d54422949fd5635fb598aeffad7bb070114c5eca8a54
SHA5128d3a9d5ba39ae368c59325841c8d3cb0d95545c0a7455760900051be8184a40df146ce10036ce6e33c4ce0d4769b76687c9a2508bb37d8706bed94daaf48e929
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
130.8MB
MD59adcdfa1f3f0ddde19cc7fd7800d9235
SHA151677aa9a4237273cde9d8916ec899424c964aa0
SHA25605436f3482ac523568e17d67d2d1270e41940f9247e7266a98f83c2205688fac
SHA51214f179f9d3f6930b1730b3a81979adeaf1625e8a11a6ad00a7411459e3b52ef57417f32a97ffcaa9238efa455c5a5f641eaac602b143adacf82213b64c001458
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
130.8MB
MD53518627d38d8d3915db15156cfe9d8f2
SHA1d41d272919f4a3bede4a34f2aa3fd963fff79a68
SHA256212769d6e1b6926b32e13514622f62d4fcc41059f623b80d3b1d830c76ca3945
SHA5123cdd9cc88e1204c72e51d35ddbf6207b70955c37ca7fa90d529426db2f895613b60f859221aab44f6c670b69b7a981bb37af7f3a6abc3475a7ddaa40a8a42249
-
memory/844-157-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/844-159-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/844-172-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/844-154-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/844-153-0x0000000000000000-mapping.dmp
-
memory/876-148-0x0000000000000000-mapping.dmp
-
memory/1276-139-0x0000000006C50000-0x0000000006C72000-memory.dmpFilesize
136KB
-
memory/1276-138-0x0000000000590000-0x0000000000D04000-memory.dmpFilesize
7.5MB
-
memory/1276-135-0x0000000000000000-mapping.dmp
-
memory/1572-161-0x0000000000000000-mapping.dmp
-
memory/1716-167-0x0000000000000000-mapping.dmp
-
memory/1896-142-0x0000000004F70000-0x0000000005598000-memory.dmpFilesize
6.2MB
-
memory/1896-141-0x0000000000B20000-0x0000000000B56000-memory.dmpFilesize
216KB
-
memory/1896-140-0x0000000000000000-mapping.dmp
-
memory/1896-147-0x00000000061F0000-0x000000000620A000-memory.dmpFilesize
104KB
-
memory/1896-146-0x0000000007530000-0x0000000007BAA000-memory.dmpFilesize
6.5MB
-
memory/1896-145-0x0000000004F40000-0x0000000004F5E000-memory.dmpFilesize
120KB
-
memory/1896-144-0x00000000055A0000-0x0000000005606000-memory.dmpFilesize
408KB
-
memory/1896-143-0x0000000004ED0000-0x0000000004F36000-memory.dmpFilesize
408KB
-
memory/1936-132-0x0000000000000000-mapping.dmp
-
memory/2316-162-0x0000000004F20000-0x0000000004F52000-memory.dmpFilesize
200KB
-
memory/2316-163-0x0000000070FF0000-0x000000007103C000-memory.dmpFilesize
304KB
-
memory/2316-164-0x0000000004F00000-0x0000000004F1E000-memory.dmpFilesize
120KB
-
memory/2316-165-0x00000000075D0000-0x00000000075DA000-memory.dmpFilesize
40KB
-
memory/2316-168-0x0000000007810000-0x00000000078A6000-memory.dmpFilesize
600KB
-
memory/2316-171-0x00000000060A0000-0x00000000060AE000-memory.dmpFilesize
56KB
-
memory/2316-149-0x0000000000000000-mapping.dmp
-
memory/3396-170-0x0000000000000000-mapping.dmp
-
memory/3536-166-0x0000000000000000-mapping.dmp
-
memory/3760-169-0x0000000000000000-mapping.dmp
-
memory/4592-151-0x0000000000000000-mapping.dmp