Analysis
-
max time kernel
136s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 13:26
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220812-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
voiceadequovl.exevoiceadequovl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 3 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 1116 voiceadequovl.exe 1520 voiceadequovl.exe 972 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
voiceadequovl.exedescription pid process target process PID 1520 set thread context of 972 1520 voiceadequovl.exe voiceadequovl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3408 powershell.exe 3408 powershell.exe 4024 powershell.exe 4024 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1520 voiceadequovl.exe Token: SeDebugPrivilege 3408 powershell.exe Token: SeDebugPrivilege 4024 powershell.exe Token: SeIncreaseQuotaPrivilege 1824 wmic.exe Token: SeSecurityPrivilege 1824 wmic.exe Token: SeTakeOwnershipPrivilege 1824 wmic.exe Token: SeLoadDriverPrivilege 1824 wmic.exe Token: SeSystemProfilePrivilege 1824 wmic.exe Token: SeSystemtimePrivilege 1824 wmic.exe Token: SeProfSingleProcessPrivilege 1824 wmic.exe Token: SeIncBasePriorityPrivilege 1824 wmic.exe Token: SeCreatePagefilePrivilege 1824 wmic.exe Token: SeBackupPrivilege 1824 wmic.exe Token: SeRestorePrivilege 1824 wmic.exe Token: SeShutdownPrivilege 1824 wmic.exe Token: SeDebugPrivilege 1824 wmic.exe Token: SeSystemEnvironmentPrivilege 1824 wmic.exe Token: SeRemoteShutdownPrivilege 1824 wmic.exe Token: SeUndockPrivilege 1824 wmic.exe Token: SeManageVolumePrivilege 1824 wmic.exe Token: 33 1824 wmic.exe Token: 34 1824 wmic.exe Token: 35 1824 wmic.exe Token: 36 1824 wmic.exe Token: SeIncreaseQuotaPrivilege 1824 wmic.exe Token: SeSecurityPrivilege 1824 wmic.exe Token: SeTakeOwnershipPrivilege 1824 wmic.exe Token: SeLoadDriverPrivilege 1824 wmic.exe Token: SeSystemProfilePrivilege 1824 wmic.exe Token: SeSystemtimePrivilege 1824 wmic.exe Token: SeProfSingleProcessPrivilege 1824 wmic.exe Token: SeIncBasePriorityPrivilege 1824 wmic.exe Token: SeCreatePagefilePrivilege 1824 wmic.exe Token: SeBackupPrivilege 1824 wmic.exe Token: SeRestorePrivilege 1824 wmic.exe Token: SeShutdownPrivilege 1824 wmic.exe Token: SeDebugPrivilege 1824 wmic.exe Token: SeSystemEnvironmentPrivilege 1824 wmic.exe Token: SeRemoteShutdownPrivilege 1824 wmic.exe Token: SeUndockPrivilege 1824 wmic.exe Token: SeManageVolumePrivilege 1824 wmic.exe Token: 33 1824 wmic.exe Token: 34 1824 wmic.exe Token: 35 1824 wmic.exe Token: 36 1824 wmic.exe Token: SeIncreaseQuotaPrivilege 3652 WMIC.exe Token: SeSecurityPrivilege 3652 WMIC.exe Token: SeTakeOwnershipPrivilege 3652 WMIC.exe Token: SeLoadDriverPrivilege 3652 WMIC.exe Token: SeSystemProfilePrivilege 3652 WMIC.exe Token: SeSystemtimePrivilege 3652 WMIC.exe Token: SeProfSingleProcessPrivilege 3652 WMIC.exe Token: SeIncBasePriorityPrivilege 3652 WMIC.exe Token: SeCreatePagefilePrivilege 3652 WMIC.exe Token: SeBackupPrivilege 3652 WMIC.exe Token: SeRestorePrivilege 3652 WMIC.exe Token: SeShutdownPrivilege 3652 WMIC.exe Token: SeDebugPrivilege 3652 WMIC.exe Token: SeSystemEnvironmentPrivilege 3652 WMIC.exe Token: SeRemoteShutdownPrivilege 3652 WMIC.exe Token: SeUndockPrivilege 3652 WMIC.exe Token: SeManageVolumePrivilege 3652 WMIC.exe Token: 33 3652 WMIC.exe Token: 34 3652 WMIC.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.execmd.exedescription pid process target process PID 3044 wrote to memory of 1116 3044 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 3044 wrote to memory of 1116 3044 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 3044 wrote to memory of 1116 3044 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1116 wrote to memory of 1520 1116 voiceadequovl.exe voiceadequovl.exe PID 1116 wrote to memory of 1520 1116 voiceadequovl.exe voiceadequovl.exe PID 1116 wrote to memory of 1520 1116 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 3408 1520 voiceadequovl.exe powershell.exe PID 1520 wrote to memory of 3408 1520 voiceadequovl.exe powershell.exe PID 1520 wrote to memory of 3408 1520 voiceadequovl.exe powershell.exe PID 1520 wrote to memory of 2096 1520 voiceadequovl.exe cmd.exe PID 1520 wrote to memory of 2096 1520 voiceadequovl.exe cmd.exe PID 1520 wrote to memory of 2096 1520 voiceadequovl.exe cmd.exe PID 2096 wrote to memory of 4024 2096 cmd.exe powershell.exe PID 2096 wrote to memory of 4024 2096 cmd.exe powershell.exe PID 2096 wrote to memory of 4024 2096 cmd.exe powershell.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 972 1520 voiceadequovl.exe voiceadequovl.exe PID 972 wrote to memory of 1824 972 voiceadequovl.exe wmic.exe PID 972 wrote to memory of 1824 972 voiceadequovl.exe wmic.exe PID 972 wrote to memory of 1824 972 voiceadequovl.exe wmic.exe PID 972 wrote to memory of 3140 972 voiceadequovl.exe cmd.exe PID 972 wrote to memory of 3140 972 voiceadequovl.exe cmd.exe PID 972 wrote to memory of 3140 972 voiceadequovl.exe cmd.exe PID 3140 wrote to memory of 3652 3140 cmd.exe WMIC.exe PID 3140 wrote to memory of 3652 3140 cmd.exe WMIC.exe PID 3140 wrote to memory of 3652 3140 cmd.exe WMIC.exe PID 972 wrote to memory of 4484 972 voiceadequovl.exe cmd.exe PID 972 wrote to memory of 4484 972 voiceadequovl.exe cmd.exe PID 972 wrote to memory of 4484 972 voiceadequovl.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD56195a91754effb4df74dbc72cdf4f7a6
SHA1aba262f5726c6d77659fe0d3195e36a85046b427
SHA2563254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
SHA512ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD598c20d2300f2c23d286d322c3fa36f16
SHA11b0c3011660d9ffa4012dfaf76897c7810353898
SHA256f9e88987e7933aff48a5a72382dcb70875e207d587e69aba40a44af5ac4bc147
SHA512f366fbabf8fd250b6cf7a95f26552d046d01bac693c218b99ade0dcefb97962f86d5d4dd6dd241d3d8ab1dcb278590ddd893ebb0e6ee0d746aab5e8f3f48a9d8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
242.0MB
MD5e2b04059ec1f9af389790512f6d61674
SHA141e843a820d7afa5665d2effaf8c8cbe341a72e0
SHA256c2a2399725d50f1ae447ebac131cf80c6fc8df1d6220f472a09bb947fb9cda3e
SHA512027768ba7ecede5cb8f313f6598f1f60b1dab306741141995e5c9b13c9a8ebb303c7984c9d7e8797d404fab4976a364f98d59866d63e1102a0dc1f7873b9ceec
-
memory/972-157-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/972-172-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/972-152-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/972-151-0x0000000000000000-mapping.dmp
-
memory/972-155-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1116-132-0x0000000000000000-mapping.dmp
-
memory/1520-138-0x0000000000540000-0x0000000000CB4000-memory.dmpFilesize
7.5MB
-
memory/1520-139-0x0000000006C00000-0x0000000006C22000-memory.dmpFilesize
136KB
-
memory/1520-135-0x0000000000000000-mapping.dmp
-
memory/1824-159-0x0000000000000000-mapping.dmp
-
memory/2096-148-0x0000000000000000-mapping.dmp
-
memory/3140-164-0x0000000000000000-mapping.dmp
-
memory/3324-168-0x0000000000000000-mapping.dmp
-
memory/3408-142-0x0000000005030000-0x0000000005658000-memory.dmpFilesize
6.2MB
-
memory/3408-143-0x00000000057D0000-0x0000000005836000-memory.dmpFilesize
408KB
-
memory/3408-147-0x00000000063B0000-0x00000000063CA000-memory.dmpFilesize
104KB
-
memory/3408-146-0x00000000074D0000-0x0000000007B4A000-memory.dmpFilesize
6.5MB
-
memory/3408-145-0x0000000005E40000-0x0000000005E5E000-memory.dmpFilesize
120KB
-
memory/3408-144-0x0000000005840000-0x00000000058A6000-memory.dmpFilesize
408KB
-
memory/3408-140-0x0000000000000000-mapping.dmp
-
memory/3408-141-0x00000000048C0000-0x00000000048F6000-memory.dmpFilesize
216KB
-
memory/3652-165-0x0000000000000000-mapping.dmp
-
memory/4024-163-0x0000000007290000-0x000000000729A000-memory.dmpFilesize
40KB
-
memory/4024-149-0x0000000000000000-mapping.dmp
-
memory/4024-162-0x0000000006480000-0x000000000649E000-memory.dmpFilesize
120KB
-
memory/4024-166-0x00000000074C0000-0x0000000007556000-memory.dmpFilesize
600KB
-
memory/4024-161-0x00000000752A0000-0x00000000752EC000-memory.dmpFilesize
304KB
-
memory/4024-169-0x0000000005D40000-0x0000000005D4E000-memory.dmpFilesize
56KB
-
memory/4024-170-0x0000000007420000-0x000000000743A000-memory.dmpFilesize
104KB
-
memory/4024-171-0x0000000007400000-0x0000000007408000-memory.dmpFilesize
32KB
-
memory/4024-160-0x00000000064A0000-0x00000000064D2000-memory.dmpFilesize
200KB
-
memory/4484-167-0x0000000000000000-mapping.dmp