Analysis
-
max time kernel
104s -
max time network
106s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
13-02-2023 23:41
General
-
Target
ConnectSetup.exe
-
Size
287KB
-
MD5
270d3021cdab3d056773a7d4a1911d0f
-
SHA1
766f9e23b7ab0095928a5009ed6cc92955d703ad
-
SHA256
8aa76e787b8749290d0fdaaf6d5a2626f8fe359469d462f22fcf573f7183ac66
-
SHA512
9ddfab50ea2b5c5c4a98cd242ba76be992eadc26849646d082f53ab4025736215c5593b41ad7b27d7ea84139e76280b2c75f3d9e0212cbf5588fecd90afdc8e8
-
SSDEEP
6144:a0+v7MjXF2+OYzoBEpN/CyZeUbgVWXuV4byG4dV9:aAjXF2CAED/CyZeUbEWXuWbnyn
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ConnectSetup.exe"C:\Users\Admin\AppData\Local\Temp\ConnectSetup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\adobeconnectaddin\adobeconnectaddin.exe"C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\adobeconnectaddin\adobeconnectaddin.exe" /nolaunch2⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\adobeconnectaddin\adobeconnectaddin.exe"C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\adobeconnectaddin\adobeconnectaddin.exe" /CreateStartMenu /nolaunch2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Adobe\Connect\connect.exe"C:\Users\Admin\AppData\Roaming\Adobe\Connect\connect.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1e41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
779B
MD552459475bbead1cc9bba0ff24722c884
SHA11e6cddf21f19f4819050782cd075b72fc96abd7e
SHA25623866b98ab3cc0c8db11f876560468be263c7bfd29c2de29cb36e6eb68c5c67b
SHA5129fd1c809e66ae2443bdc9adb6e3bcc7b50a26eb6f518d317bd1b9a152cc9164145637fc393fdd6e4473e84dce947d638127259684a49bdd33dc5458385e6dbb6
-
Filesize
246B
MD5701ac0cda4e726436f762152cb401fcb
SHA1786cea9012fa5b8220253628379a245841ac658a
SHA25658ca09ad52ca0f3732a8749e5dec4d0f23c164f6d9f4649e720f081a29e544ea
SHA5124bf3eafea4937ca58a139f35a07b03511b0a5ed04d5afc7e219c9f16bde65aa770e05084b7be7f1d5cfe2fa46c4cab26dbc8b9c5c12c483357a114a0da763427
-
Filesize
17.4MB
MD52d5850ca99bbc9e75f04b99b41cd6bcd
SHA140141de8872afd1e09c438edb8d02a3422a56017
SHA256ed5db5497c66b3f70dd2107336d355e759b16dad81a31053b5cd48e6f310835b
SHA512d015aeb6c348163b0c0ce38d337d80b05a6cb171f1a19f99f476c5a35407b0013a04120872889b766036f49795c03d193c9e26aa4b967198930d57cddf0f3338
-
Filesize
17.4MB
MD52d5850ca99bbc9e75f04b99b41cd6bcd
SHA140141de8872afd1e09c438edb8d02a3422a56017
SHA256ed5db5497c66b3f70dd2107336d355e759b16dad81a31053b5cd48e6f310835b
SHA512d015aeb6c348163b0c0ce38d337d80b05a6cb171f1a19f99f476c5a35407b0013a04120872889b766036f49795c03d193c9e26aa4b967198930d57cddf0f3338
-
Filesize
782B
MD50084c8238279a26c5ca4fc02bd81fd92
SHA1d3464adf414b2fd018a81437f963b937d86bff99
SHA256c038e59346d7fa41c9775712f61a0ce068a148840bb6c7cbcad39f08e89da948
SHA5120594ef218f84c7cb7bf7e2a3c84174a29a438992dd9c4b4f4013a12463496311cf04f021320d536abbb9d70fa1d7c0c4d6c5330a8d6836b7920058f06e10fbfd
-
Filesize
17.5MB
MD5604822783cccee8637a517179565d56d
SHA1e41592d903a795a2576d3c1a1fbc994357238c92
SHA256eb90cb6f71eb674eb3b40c4dc2e5567311880030d6c2ea348b25fa7299cf9e15
SHA512c852fa3f085f2b5bd4fc6129d0c8fc737f0927474804dfdd04f588ebec98216e4ea2996efff37fbbbfcbbe8cadf8dc6ffb3a8b8036d855ea9cb6e3c1a2fc3445
-
Filesize
17.5MB
MD5604822783cccee8637a517179565d56d
SHA1e41592d903a795a2576d3c1a1fbc994357238c92
SHA256eb90cb6f71eb674eb3b40c4dc2e5567311880030d6c2ea348b25fa7299cf9e15
SHA512c852fa3f085f2b5bd4fc6129d0c8fc737f0927474804dfdd04f588ebec98216e4ea2996efff37fbbbfcbbe8cadf8dc6ffb3a8b8036d855ea9cb6e3c1a2fc3445
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB