Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 13:29
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
voiceadequovl.exevoiceadequovl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 3 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 484 voiceadequovl.exe 1288 voiceadequovl.exe 3552 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
voiceadequovl.exedescription pid process target process PID 1288 set thread context of 3552 1288 voiceadequovl.exe voiceadequovl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 204 powershell.exe 204 powershell.exe 3648 powershell.exe 3648 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1288 voiceadequovl.exe Token: SeDebugPrivilege 204 powershell.exe Token: SeDebugPrivilege 3648 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.exedescription pid process target process PID 2904 wrote to memory of 484 2904 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 2904 wrote to memory of 484 2904 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 2904 wrote to memory of 484 2904 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 484 wrote to memory of 1288 484 voiceadequovl.exe voiceadequovl.exe PID 484 wrote to memory of 1288 484 voiceadequovl.exe voiceadequovl.exe PID 484 wrote to memory of 1288 484 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 204 1288 voiceadequovl.exe powershell.exe PID 1288 wrote to memory of 204 1288 voiceadequovl.exe powershell.exe PID 1288 wrote to memory of 204 1288 voiceadequovl.exe powershell.exe PID 1288 wrote to memory of 4492 1288 voiceadequovl.exe cmd.exe PID 1288 wrote to memory of 4492 1288 voiceadequovl.exe cmd.exe PID 1288 wrote to memory of 4492 1288 voiceadequovl.exe cmd.exe PID 4492 wrote to memory of 3648 4492 cmd.exe powershell.exe PID 4492 wrote to memory of 3648 4492 cmd.exe powershell.exe PID 4492 wrote to memory of 3648 4492 cmd.exe powershell.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 1288 wrote to memory of 3552 1288 voiceadequovl.exe voiceadequovl.exe PID 3552 wrote to memory of 3180 3552 voiceadequovl.exe wmic.exe PID 3552 wrote to memory of 3180 3552 voiceadequovl.exe wmic.exe PID 3552 wrote to memory of 3180 3552 voiceadequovl.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
56KB
MD5ea1a294133d0f531d5a520ab06fa1881
SHA1dccd5b851a9cbe7902e9f53c4e2ebd98e65f6436
SHA256221a11a74006bf538f78315a7860110688f7d028a757ef1b26185284fdc1f954
SHA512af109b037d059b3b61c10ee24554c09259f470d48031cbc69e07286bb505d330f59b71f0254c93607f47d0387be78a9dc638292ab527e03656bdde2e9149d1bf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5ae6a293b7b9f26fa935156d5571afc86
SHA1c1b2f06fe93ca42e024ada986e9243317158c702
SHA256c66d1a0ed07e0b44789109df2ab3424b7bd1428e95e9b97e579e41df6ac1a7b0
SHA51269d697a4e7893906036f59a84ad17e713ab54bd20153416b75fb6c758949f9183687b2566e5b6aff28c10de6a343779e7fca38d98ef761a19fe71d2fb8f61661
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
159.0MB
MD50987692cd77cdaab33ca400b4ba2880b
SHA1475f8d163f4c4a2f5dcf5c1e7a415144283c1cc0
SHA2560b78c329099d788ff1fb61433347eaed47f8f3aab4e66406e31e602a594140a7
SHA512fc50da481b3ea68a9cb3f8cf839a252e0b367829230a9a85e6918957aa9891975a83365800927330f5af4e9b95a397a8bdddabe1153ac28ad9718faed8318da7
-
memory/204-142-0x0000000005A90000-0x00000000060B8000-memory.dmpFilesize
6.2MB
-
memory/204-146-0x00000000080C0000-0x000000000873A000-memory.dmpFilesize
6.5MB
-
memory/204-141-0x0000000003320000-0x0000000003356000-memory.dmpFilesize
216KB
-
memory/204-147-0x0000000006D80000-0x0000000006D9A000-memory.dmpFilesize
104KB
-
memory/204-143-0x00000000060C0000-0x0000000006126000-memory.dmpFilesize
408KB
-
memory/204-144-0x0000000006220000-0x0000000006286000-memory.dmpFilesize
408KB
-
memory/204-145-0x0000000006880000-0x000000000689E000-memory.dmpFilesize
120KB
-
memory/204-140-0x0000000000000000-mapping.dmp
-
memory/484-132-0x0000000000000000-mapping.dmp
-
memory/1288-139-0x00000000074B0000-0x00000000074D2000-memory.dmpFilesize
136KB
-
memory/1288-138-0x0000000000DF0000-0x0000000001564000-memory.dmpFilesize
7.5MB
-
memory/1288-135-0x0000000000000000-mapping.dmp
-
memory/1440-165-0x0000000000000000-mapping.dmp
-
memory/2452-164-0x0000000000000000-mapping.dmp
-
memory/3180-158-0x0000000000000000-mapping.dmp
-
memory/3552-150-0x0000000000000000-mapping.dmp
-
memory/3552-156-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3552-154-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3552-151-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3552-171-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3580-167-0x0000000000000000-mapping.dmp
-
memory/3648-149-0x0000000000000000-mapping.dmp
-
memory/3648-162-0x00000000079C0000-0x00000000079CA000-memory.dmpFilesize
40KB
-
memory/3648-163-0x0000000007BE0000-0x0000000007C76000-memory.dmpFilesize
600KB
-
memory/3648-161-0x0000000006BD0000-0x0000000006BEE000-memory.dmpFilesize
120KB
-
memory/3648-160-0x0000000074CC0000-0x0000000074D0C000-memory.dmpFilesize
304KB
-
memory/3648-168-0x00000000060F0000-0x00000000060FE000-memory.dmpFilesize
56KB
-
memory/3648-169-0x0000000007B60000-0x0000000007B7A000-memory.dmpFilesize
104KB
-
memory/3648-170-0x0000000007B40000-0x0000000007B48000-memory.dmpFilesize
32KB
-
memory/3648-159-0x00000000077C0000-0x00000000077F2000-memory.dmpFilesize
200KB
-
memory/4048-166-0x0000000000000000-mapping.dmp
-
memory/4492-148-0x0000000000000000-mapping.dmp