Resubmissions
01-04-2023 05:43
230401-ge1rcsgc39 801-04-2023 05:42
230401-gejg3sgc36 701-04-2023 04:26
230401-e2jegsfh69 801-04-2023 02:49
230401-dbh6csgh41 801-04-2023 02:31
230401-czqdxagg7v 801-04-2023 02:27
230401-cxvwlsfd87 8Analysis
-
max time kernel
900s -
max time network
869s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
01-04-2023 04:26
General
-
Target
drfone_setup_full3824 (1).exe
-
Size
2.2MB
-
MD5
ee06eafbe8972c749a5161e54d3fdcd6
-
SHA1
80f4197cf15c36acaf37a1ab8159ec4ab2368c26
-
SHA256
e5e57cc01f94cd129db4fd88860253c0936cb2612a734cb176924ddfa3ffb862
-
SHA512
116c7274a1adc3274c046dfdeaf8b187ec31d42dd523522e372b3ce05aada949c4a56856a4cf9c2dfaa2571c5ec62a7629e476d72e8259fa854cfa921b4f83c9
-
SSDEEP
49152:suI4s4xwYeRQXEEpusP5uKKNeEzo/I/P5jaYRTkTun99ZS6Y0fxfNrBFS:b2Q30rNeEzoiP5ja0397Sb0fxfNrfS
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\drfone_setup_full3824 (1).exe"C:\Users\Admin\AppData\Local\Temp\drfone_setup_full3824 (1).exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\Wondershare\NFWCHK.exeC:\Users\Public\Documents\Wondershare\NFWCHK.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Public\Documents\Wondershare\drfone_full3824.exe"C:\Users\Public\Documents\Wondershare\drfone_full3824.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-drfone.log" /installpath: "C:\Program Files (x86)\Wondershare\drfone\" /DIR="C:\Program Files (x86)\Wondershare\drfone\" /WAEWIN=701E0 /PID=38242⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EQR5S.tmp\drfone_full3824.tmp"C:\Users\Admin\AppData\Local\Temp\is-EQR5S.tmp\drfone_full3824.tmp" /SL5="$60086,309495938,673280,C:\Users\Public\Documents\Wondershare\drfone_full3824.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-drfone.log" /installpath: "C:\Program Files (x86)\Wondershare\drfone\" /DIR="C:\Program Files (x86)\Wondershare\drfone\" /WAEWIN=701E0 /PID=38243⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JV9OU.tmp\ProcessKiller.exe"C:\Users\Admin\AppData\Local\Temp\is-JV9OU.tmp\ProcessKiller.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
496B
MD5509e932827303c8ebd638c30f0f5d5ff
SHA1c39ec86363128ae1bd9f33b5fe8c3db9eaf5db27
SHA256a0d6c4eda14672c322cf1749159c4092b54c139c3e9da9db1c6e0be6547a1171
SHA512b62b52dd3a1c7753e96bb4acba37354b6e28afeed9810de5340c782f4a6a1781d1ea93479542380e698e668f3147cf5431cac41e1954ce849032e0864b4ba676
-
Filesize
5KB
MD5918d3b8bea30ac1ebba94818995477da
SHA14c53efdb2cfbc660717690f4f89aa6eccd3148c1
SHA2562d294c9a5dfa798bc765c2f1e87fcb6ed68741a532281178b68179e8398b207f
SHA5120152aeaf1b946ec62281762b2fd9952bf1841358d0a1641f0396ee7c6e5a1a1b197b11ec49cf2fe4a1772a31b3086f67d1143927e5106f81fa79a23c171aa5da
-
Filesize
1.7MB
MD5192369ebd80fb01ccfc585d8043bf733
SHA13d77774e3159cd0c277e5bb6b68493df2eeaf038
SHA256b8828f657fe052ddce0db320d08e619e316eaf3853d09272f1a5c7bd850ac8f3
SHA512042c1710d8330449086e7e1ff952d2102e07985628cf4f1e96de25a62045038e6381d8ea1ce5ef43c31e265fc04a9553c67b1864f487d271e620c0c509d80ea2
-
Filesize
1.7MB
MD5192369ebd80fb01ccfc585d8043bf733
SHA13d77774e3159cd0c277e5bb6b68493df2eeaf038
SHA256b8828f657fe052ddce0db320d08e619e316eaf3853d09272f1a5c7bd850ac8f3
SHA512042c1710d8330449086e7e1ff952d2102e07985628cf4f1e96de25a62045038e6381d8ea1ce5ef43c31e265fc04a9553c67b1864f487d271e620c0c509d80ea2
-
Filesize
1.7MB
MD5192369ebd80fb01ccfc585d8043bf733
SHA13d77774e3159cd0c277e5bb6b68493df2eeaf038
SHA256b8828f657fe052ddce0db320d08e619e316eaf3853d09272f1a5c7bd850ac8f3
SHA512042c1710d8330449086e7e1ff952d2102e07985628cf4f1e96de25a62045038e6381d8ea1ce5ef43c31e265fc04a9553c67b1864f487d271e620c0c509d80ea2
-
Filesize
102KB
MD5482ffbac9483f0e49537026160beb28d
SHA1cf70b8e7982abf823a6792e14c4c49b4d7e20f95
SHA25698ddf774d0b890965410326670b1a9797bc85aeb24fb4ebfe0286ceca3ff8122
SHA512cf20a41e94281374a91bf92c281152a12234763a8cca01d94eac46a0c55c6a70416700a0108306a7d98a71808839918d5919bebd75620b526dddc73cdcd907dd
-
Filesize
10KB
MD550e2db9f1096b0c80873ee6341a4fbc2
SHA11d3d506314796d480bdf6a9de99246960cbc7b3f
SHA256708bc1ab44f30a8a96c769acbea936a9bd9758523252a6c71da0e3ed0c678390
SHA5121de5ddf3750fab23c9d026cb3b8b1fbe481da1d37f1bbb7ae9ed7cc724d8dfd728f16700529259a48fd5db6a1533615bd58d7034d856a09edea3082bcef541c7
-
Filesize
10KB
MD550e2db9f1096b0c80873ee6341a4fbc2
SHA11d3d506314796d480bdf6a9de99246960cbc7b3f
SHA256708bc1ab44f30a8a96c769acbea936a9bd9758523252a6c71da0e3ed0c678390
SHA5121de5ddf3750fab23c9d026cb3b8b1fbe481da1d37f1bbb7ae9ed7cc724d8dfd728f16700529259a48fd5db6a1533615bd58d7034d856a09edea3082bcef541c7
-
Filesize
580B
MD5aa08c8fa940b0850cd84af85278351d7
SHA100c117b369f86c9d4f18d54c4dda460c63d4c173
SHA256569218463823b1d489f51b76993cbe77aa61be7fe3b1e567f2bf1760af014bbe
SHA51284071521004cca1eca0a33739723a0210a11e08446f405b8215d4974d647abb7a5f25f4f6fdbcededa8515703aeda753eba995e37c2ca4094dba2eb334b0d2cf
-
Filesize
10KB
MD550e2db9f1096b0c80873ee6341a4fbc2
SHA11d3d506314796d480bdf6a9de99246960cbc7b3f
SHA256708bc1ab44f30a8a96c769acbea936a9bd9758523252a6c71da0e3ed0c678390
SHA5121de5ddf3750fab23c9d026cb3b8b1fbe481da1d37f1bbb7ae9ed7cc724d8dfd728f16700529259a48fd5db6a1533615bd58d7034d856a09edea3082bcef541c7
-
Filesize
677B
MD5f20d451ea717c2eeeeede4d8dc75be9a
SHA1bf6c92c4b637c2b298934885448082b66a26d318
SHA2562ac53665c862d4d77b31e4eedbfedd77cf37550be4bf56dc0ebd354a51f9b007
SHA512791e959235bb75278b97bd20648821efb66c0c52e7f7294523810cceec1063cfa1c213c2a2e1b8e0219453062e127fd447f7bb2d81f8617634fd1928ad769cd0
-
Filesize
4KB
MD5cef280f606574d1086a2d172896d05e5
SHA145d2b3917f630e0c94aa996b6faee17592306d7c
SHA256a76d5177134778e09492b4669f911c44dd1f7169321a48fe45643b529161336b
SHA512b78521787e25fd21d897efd044278f945d2110727102c61abb30f300ce37f372e9bb54348bd0d800b419ecc4afbfe88fc7d89a028de0bada0a35d62abbcb23ee
-
Filesize
5KB
MD5905a5562c6abe14344e0fd49d34f1d4a
SHA1829d32dcc7c702dfdd27d5cfe926d7a9153aa6dd
SHA256086cc81ca0f05520f0d9ca63c538a18b414c8b2377804e142b59feb22c4eb731
SHA5127c49608db50fa49a7438accf878530d578c19589ca360ea6bec03f236da022639874a7fb33628da23df9e185c32a281cfbb67e419225ac98d783db0687181505
-
Filesize
7KB
MD527cfb3990872caa5930fa69d57aefe7b
SHA15e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f
SHA25643881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146
SHA512a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a
-
Filesize
7KB
MD527cfb3990872caa5930fa69d57aefe7b
SHA15e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f
SHA25643881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146
SHA512a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a
-
Filesize
229B
MD5ad0967a0ab95aa7d71b3dc92b71b8f7a
SHA1ed63f517e32094c07a2c5b664ed1cab412233ab5
SHA2569c1212bc648a2533b53a2d0afcec518846d97630afb013742a9622f0df7b04fc
SHA51285766a907331f60044ec205cf345453fc3d44bfcac296ac93a12e8a752b84290dfd94f73b71de82f46f9503177d29602cbb87549f89dc61373d889b4ea26634b
-
Filesize
296.3MB
MD581305532cb0c94e23bc23cd8f7074861
SHA1f867ebdd38e12f217465df852af9d461a74256c6
SHA2562debe80b3688b2a2645b99b746688989eb2814f3aeaa0339d8706ac6f5a9d195
SHA512f3e5deb524d79b6bb237acefac3d1fbfe43a00abbc6aa4455a9c5b0002136379fa411b8851a3df2bfe9c2a6d358bdd4fed890823ab8c8b79412993b3e11d9ea0
-
Filesize
296.3MB
MD581305532cb0c94e23bc23cd8f7074861
SHA1f867ebdd38e12f217465df852af9d461a74256c6
SHA2562debe80b3688b2a2645b99b746688989eb2814f3aeaa0339d8706ac6f5a9d195
SHA512f3e5deb524d79b6bb237acefac3d1fbfe43a00abbc6aa4455a9c5b0002136379fa411b8851a3df2bfe9c2a6d358bdd4fed890823ab8c8b79412993b3e11d9ea0
-
Filesize
296.3MB
MD581305532cb0c94e23bc23cd8f7074861
SHA1f867ebdd38e12f217465df852af9d461a74256c6
SHA2562debe80b3688b2a2645b99b746688989eb2814f3aeaa0339d8706ac6f5a9d195
SHA512f3e5deb524d79b6bb237acefac3d1fbfe43a00abbc6aa4455a9c5b0002136379fa411b8851a3df2bfe9c2a6d358bdd4fed890823ab8c8b79412993b3e11d9ea0
-
Filesize
45KB
MD52aa5d7ac4c9fc121934dec64da362af0
SHA1b37ecc61d70d536779fec87d5c482a9fe4a71e3c
SHA2569c7b3dbd9dc03b59bdbeaf21649d9de7ccb909f50054244315e54f92e14f6612
SHA5123f366f2981d764ef7e19e2e99a1d8e80a2558c650573d4f5f9f633920d3726cae741892a01400e19e9d7716941c29fa51860cacbcbde6b359aecfb2ffe1d1f62
-
Filesize
45KB
MD52aa5d7ac4c9fc121934dec64da362af0
SHA1b37ecc61d70d536779fec87d5c482a9fe4a71e3c
SHA2569c7b3dbd9dc03b59bdbeaf21649d9de7ccb909f50054244315e54f92e14f6612
SHA5123f366f2981d764ef7e19e2e99a1d8e80a2558c650573d4f5f9f633920d3726cae741892a01400e19e9d7716941c29fa51860cacbcbde6b359aecfb2ffe1d1f62
-
Filesize
188KB
MD5a0cefe160f504402b5148580c5b912bf
SHA13b6c9641a7b2edff1b60bd55b8eeb7c34eab8aee
SHA2564333dae45b166e2ec59c49a46ff6abe3342d9191ebafda9b53803e639e33f1d1
SHA512a9e9fff977c3e365caf0a5351b07319502a22f6ddf34267e9d77b171dbdce82d6cfb6bb49b7ba4b5c6966d97c3630ff2944a96f32c26819e43ed85b4f15f862d
-
Filesize
32KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
56KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
1.7MB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
292KB
-
Filesize
3.1MB
-
Filesize
392KB
-
Filesize
64KB
-
Filesize
128KB
-
Filesize
96KB
-
Filesize
144KB
-
Filesize
32KB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
248KB