Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 13:31
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220812-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
voiceadequovl.exevoiceadequovl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 6 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 4280 voiceadequovl.exe 4092 voiceadequovl.exe 4536 voiceadequovl.exe 956 voiceadequovl.exe 1172 voiceadequovl.exe 2540 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exevoiceadequovl.exepowershell.exepid process 3728 powershell.exe 3728 powershell.exe 4092 voiceadequovl.exe 4092 voiceadequovl.exe 4092 voiceadequovl.exe 4092 voiceadequovl.exe 4092 voiceadequovl.exe 4092 voiceadequovl.exe 2028 powershell.exe 4092 voiceadequovl.exe 4092 voiceadequovl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4092 voiceadequovl.exe Token: SeDebugPrivilege 3728 powershell.exe Token: SeDebugPrivilege 2028 powershell.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exedescription pid process target process PID 3460 wrote to memory of 4280 3460 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 3460 wrote to memory of 4280 3460 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 3460 wrote to memory of 4280 3460 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4280 wrote to memory of 4092 4280 voiceadequovl.exe voiceadequovl.exe PID 4280 wrote to memory of 4092 4280 voiceadequovl.exe voiceadequovl.exe PID 4280 wrote to memory of 4092 4280 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 3728 4092 voiceadequovl.exe powershell.exe PID 4092 wrote to memory of 3728 4092 voiceadequovl.exe powershell.exe PID 4092 wrote to memory of 3728 4092 voiceadequovl.exe powershell.exe PID 4092 wrote to memory of 4468 4092 voiceadequovl.exe cmd.exe PID 4092 wrote to memory of 4468 4092 voiceadequovl.exe cmd.exe PID 4092 wrote to memory of 4468 4092 voiceadequovl.exe cmd.exe PID 4468 wrote to memory of 2028 4468 cmd.exe powershell.exe PID 4468 wrote to memory of 2028 4468 cmd.exe powershell.exe PID 4468 wrote to memory of 2028 4468 cmd.exe powershell.exe PID 4092 wrote to memory of 4536 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 4536 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 4536 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 956 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 956 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 956 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 1172 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 1172 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 1172 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 2540 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 2540 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 2540 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 960 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 960 4092 voiceadequovl.exe voiceadequovl.exe PID 4092 wrote to memory of 960 4092 voiceadequovl.exe voiceadequovl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5402af14a54d868a5f546f9443190af7f
SHA1f17064903551de86edb00ef17ae4c0302c213c21
SHA256ab551cf016c5df119575f3c956f30d772e21a5107c9c6990c5a9749efa7d9f0e
SHA512a7e05686bc3e1b96a984541e77a39614086fb043b7bfe91099d43916c5b57e584f8d954500e6158493b34907e9dcec0ce31851e57578239c1e072119dd57677c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
39.0MB
MD54c976ed646698096d43cf40fd033af7b
SHA151bca38b77ea5aa7651813f9b1682b8c673bf972
SHA256c3bb7c8ced315b819fe6e99b89c6427ba35902bd52dc8483985eef5471796ea5
SHA512fac03b2fca42aeb77a9ebb1bf5caec384b4545b025305eecb0fcb2cdeedfab2b887a0e3fe4050ea42343b517c82361c03a37be8e80c2cf66deec3187683f34ba
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
38.4MB
MD57237374e8e0509e92b908ea3a426f4ba
SHA11d28ade53812b241587c8f0363b151d307f0f87b
SHA256ce4ca8c51c1600cd87e6f01d48c73d3c759c2c5372b2ad96e272a52bff46347e
SHA512f8f06f0227c37ffc1481969aa3bbfccaac3da9097c7ee8e58ef09c44830e62f2785597f6ef75c9f49b58882e1a0b5c0a6ec098ac3a36810f53c89a7f49e54a6d
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
37.8MB
MD5faad2b07da6e85958ea504d38d2273cc
SHA1006ae0dde3ea76f0c6d528f6f01038f7a0958d02
SHA256b94e0f8fc03f628743237fb0afd938294ce173ac49dd3be52c4f526ad93bbe29
SHA5128ea953250823561f1ce2db6b9d989054af3f8915f69592820aece79a545c51e03e7a9e928962a698bf23622a2c2380fc8b199c8a16b352f5aacb15850028b71e
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
37.0MB
MD5535cfbb1f6798a776277008b740cf790
SHA1ee1d3ea40dd986dfe016caa5b916babb5afca4ef
SHA256a71eaa6b524c8df1574db3fc24e11a8e6a99325573e3a55da660d609b5ce7962
SHA512ee3066fa541a025114ad8a0afa547dc97de81099f0978e6089605cee45a082f43b3eb82b3dddff66bd8204f30a138456eb8dccdeb5e82bf5e6b975c5598f3908
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
37.4MB
MD51e8c89f803c13b0dd117e12f3c1bfada
SHA143e62bea3931689d8dfb7abc044261a97dd3424f
SHA256d5c6942a88fcf08a511f0ce6bf68812ecd30c35fa760289a6f61b55726b1cab1
SHA5120203267ddcecd2a7caa554feceb7be2501e793ba34085b7b9249877e589da53872129c30e473a15899004667121fac1d5be817847c3d01d69f19f47be7929281
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
36.8MB
MD582424df15a62ae7ba2f32489ebdfff4a
SHA191355cd77d7a73dd7e2e23f675b681c8b1ceb725
SHA256b3310adbef89836f5601a42cc946bdbfbb708982e261d107bf3ac325b7953af3
SHA51291889f762f13d89aab3e9dcc1202aa6573433460bea3d7b3708b18a450e871033b4239239bf251c3dc316b8c90800e596506045926c6ff76c107dfc32810e5ee
-
memory/956-153-0x0000000000000000-mapping.dmp
-
memory/960-159-0x0000000000000000-mapping.dmp
-
memory/1172-155-0x0000000000000000-mapping.dmp
-
memory/1800-177-0x0000000000000000-mapping.dmp
-
memory/2028-170-0x00000000065D0000-0x0000000006602000-memory.dmpFilesize
200KB
-
memory/2028-181-0x00000000075D0000-0x00000000075D8000-memory.dmpFilesize
32KB
-
memory/2028-180-0x00000000075F0000-0x000000000760A000-memory.dmpFilesize
104KB
-
memory/2028-179-0x0000000005F20000-0x0000000005F2E000-memory.dmpFilesize
56KB
-
memory/2028-178-0x0000000007690000-0x0000000007726000-memory.dmpFilesize
600KB
-
memory/2028-175-0x0000000007440000-0x000000000744A000-memory.dmpFilesize
40KB
-
memory/2028-149-0x0000000000000000-mapping.dmp
-
memory/2028-172-0x00000000065B0000-0x00000000065CE000-memory.dmpFilesize
120KB
-
memory/2028-171-0x0000000073B40000-0x0000000073B8C000-memory.dmpFilesize
304KB
-
memory/2480-176-0x0000000000000000-mapping.dmp
-
memory/2540-157-0x0000000000000000-mapping.dmp
-
memory/3192-168-0x0000000000000000-mapping.dmp
-
memory/3728-143-0x0000000005600000-0x0000000005666000-memory.dmpFilesize
408KB
-
memory/3728-144-0x0000000005DD0000-0x0000000005E36000-memory.dmpFilesize
408KB
-
memory/3728-147-0x00000000068F0000-0x000000000690A000-memory.dmpFilesize
104KB
-
memory/3728-146-0x0000000007C30000-0x00000000082AA000-memory.dmpFilesize
6.5MB
-
memory/3728-140-0x0000000000000000-mapping.dmp
-
memory/3728-145-0x00000000063F0000-0x000000000640E000-memory.dmpFilesize
120KB
-
memory/3728-141-0x0000000002B20000-0x0000000002B56000-memory.dmpFilesize
216KB
-
memory/3728-142-0x00000000056B0000-0x0000000005CD8000-memory.dmpFilesize
6.2MB
-
memory/4092-135-0x0000000000000000-mapping.dmp
-
memory/4092-139-0x0000000005DA0000-0x0000000005DC2000-memory.dmpFilesize
136KB
-
memory/4092-138-0x0000000000D20000-0x0000000001494000-memory.dmpFilesize
7.5MB
-
memory/4252-161-0x0000000000000000-mapping.dmp
-
memory/4252-166-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/4252-162-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/4252-165-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/4252-182-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/4280-132-0x0000000000000000-mapping.dmp
-
memory/4468-148-0x0000000000000000-mapping.dmp
-
memory/4500-173-0x0000000000000000-mapping.dmp
-
memory/4508-174-0x0000000000000000-mapping.dmp
-
memory/4536-151-0x0000000000000000-mapping.dmp