Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 13:35
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220812-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
voiceadequovl.exevoiceadequovl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 2 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exepid process 1016 voiceadequovl.exe 3912 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepowershell.exepid process 4188 powershell.exe 4188 powershell.exe 3528 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3912 voiceadequovl.exe Token: SeDebugPrivilege 4188 powershell.exe Token: SeDebugPrivilege 3528 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exedescription pid process target process PID 4892 wrote to memory of 1016 4892 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4892 wrote to memory of 1016 4892 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4892 wrote to memory of 1016 4892 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1016 wrote to memory of 3912 1016 voiceadequovl.exe voiceadequovl.exe PID 1016 wrote to memory of 3912 1016 voiceadequovl.exe voiceadequovl.exe PID 1016 wrote to memory of 3912 1016 voiceadequovl.exe voiceadequovl.exe PID 3912 wrote to memory of 4188 3912 voiceadequovl.exe powershell.exe PID 3912 wrote to memory of 4188 3912 voiceadequovl.exe powershell.exe PID 3912 wrote to memory of 4188 3912 voiceadequovl.exe powershell.exe PID 3912 wrote to memory of 4564 3912 voiceadequovl.exe cmd.exe PID 3912 wrote to memory of 4564 3912 voiceadequovl.exe cmd.exe PID 3912 wrote to memory of 4564 3912 voiceadequovl.exe cmd.exe PID 4564 wrote to memory of 3528 4564 cmd.exe powershell.exe PID 4564 wrote to memory of 3528 4564 cmd.exe powershell.exe PID 4564 wrote to memory of 3528 4564 cmd.exe powershell.exe PID 3912 wrote to memory of 2180 3912 voiceadequovl.exe voiceadequovl.exe PID 3912 wrote to memory of 2180 3912 voiceadequovl.exe voiceadequovl.exe PID 3912 wrote to memory of 2180 3912 voiceadequovl.exe voiceadequovl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD56195a91754effb4df74dbc72cdf4f7a6
SHA1aba262f5726c6d77659fe0d3195e36a85046b427
SHA2563254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
SHA512ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5e3c27eaa7ba8319eba83a3ede7147fd3
SHA1fabe33e589c1b1844c6a1406a1c0d437e6b884d3
SHA256a50dc1aa7049f040d9eefc7e3c559ea76054fcc1d1bb19adab8ca18aa803e687
SHA512cc243f227b39a127051ded06d9963f26181585d32ff53db9b78b4ae80eeb129abea44021b8dc65a7c34c1a77a24c334671406bcdef913ec20a7127141abf7b14
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
44.2MB
MD54e0ee541936eda55f1fb600340ae8cb7
SHA1c7c716ea601e54d91a786f3222c8995082bbeb82
SHA25627610219167f39ba791bcad5205d2497704f623aae4ea3b48e4f99b84afb0bfa
SHA51258e46f0cd2ace6f6d84117e63f1591772d5558f73b3d14ea4689f4a7878eb974d701f77988d79429b3b4dce4fe6d45d24ef77ba1eb4e5eaa288f0c53bd4efe43
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
43.1MB
MD5e5a6c58ca750b0bf624ea02699acea32
SHA18f724eaf1df9f426b58d076faebcdcd9f71d7eda
SHA2569fe1da0d9dc05687d980270d2758b6d39aa59a9ed9409210a441d51c79909c43
SHA512f24579f7e0bbae189ad160eda613abc066809335c38f7da985f4f9c98b35b2f7f467102049230fcf752150332d706132cfc9fc10ae407f3dc99b8ad7c5a4016a
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
39.6MB
MD54d01cf736f52444322f13c63d07f03dc
SHA1fad2413d5a373fad6d3652a4839e6000a6c2d7fb
SHA2568fde44b5a1ffc7a62d7321e15a061621beb2c8f00a04020e2bc838d4ef9d266b
SHA5122f8ac746b49d6a7d40198416afac70b6f00e86ac8facc7a881fe208ee65054e4ade2d1ca872dfc7d736fd58d2d886bbfe7c65724ffe0040e61e3f9d48598b7d8
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
42.1MB
MD591a082f74067da275a5a8559f84f5d83
SHA1f50b0db6dc044a3126ce6fa10258820730ca6160
SHA25689cd20cd046b771ef5171af1d16f1d642f864e394d2c8a0d0d0284205ec8f356
SHA512dcfcc9134d1fc0ad9364c2eee11ac19d968d7e7e5d9395a4d4f77790541ee26c93b6f99a2a1946a12914e31c6bbf6a82902a4c1c6b8002daa64739c814b6b869
-
memory/368-174-0x0000000000000000-mapping.dmp
-
memory/452-164-0x0000000000000000-mapping.dmp
-
memory/1016-132-0x0000000000000000-mapping.dmp
-
memory/1532-170-0x0000000000000000-mapping.dmp
-
memory/2180-151-0x0000000000000000-mapping.dmp
-
memory/3056-153-0x0000000000000000-mapping.dmp
-
memory/3528-166-0x0000000007810000-0x0000000007842000-memory.dmpFilesize
200KB
-
memory/3528-177-0x0000000007B80000-0x0000000007B88000-memory.dmpFilesize
32KB
-
memory/3528-176-0x0000000007BA0000-0x0000000007BBA000-memory.dmpFilesize
104KB
-
memory/3528-175-0x00000000064E0000-0x00000000064EE000-memory.dmpFilesize
56KB
-
memory/3528-149-0x0000000000000000-mapping.dmp
-
memory/3528-171-0x0000000007C40000-0x0000000007CD6000-memory.dmpFilesize
600KB
-
memory/3528-169-0x0000000007A00000-0x0000000007A0A000-memory.dmpFilesize
40KB
-
memory/3528-168-0x00000000077F0000-0x000000000780E000-memory.dmpFilesize
120KB
-
memory/3528-167-0x0000000075200000-0x000000007524C000-memory.dmpFilesize
304KB
-
memory/3808-172-0x0000000000000000-mapping.dmp
-
memory/3912-139-0x00000000056E0000-0x0000000005702000-memory.dmpFilesize
136KB
-
memory/3912-135-0x0000000000000000-mapping.dmp
-
memory/3912-138-0x0000000000650000-0x0000000000DC4000-memory.dmpFilesize
7.5MB
-
memory/3988-155-0x0000000000000000-mapping.dmp
-
memory/4072-159-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/4072-162-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/4072-163-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/4072-158-0x0000000000000000-mapping.dmp
-
memory/4188-141-0x0000000002680000-0x00000000026B6000-memory.dmpFilesize
216KB
-
memory/4188-142-0x0000000004E50000-0x0000000005478000-memory.dmpFilesize
6.2MB
-
memory/4188-140-0x0000000000000000-mapping.dmp
-
memory/4188-143-0x0000000005570000-0x00000000055D6000-memory.dmpFilesize
408KB
-
memory/4188-145-0x00000000049D0000-0x00000000049EE000-memory.dmpFilesize
120KB
-
memory/4188-144-0x0000000005650000-0x00000000056B6000-memory.dmpFilesize
408KB
-
memory/4188-146-0x00000000072A0000-0x000000000791A000-memory.dmpFilesize
6.5MB
-
memory/4188-147-0x0000000006170000-0x000000000618A000-memory.dmpFilesize
104KB
-
memory/4368-173-0x0000000000000000-mapping.dmp
-
memory/4564-148-0x0000000000000000-mapping.dmp