Overview

overview

7

Static

static

3

SETUP.exe

windows10-1703-x64

7

Resubmissions

23/10/2023, 17:38

231023-v7qzhsdd52 3

23/10/2023, 17:35

231023-v6bs7sdd33 7

Analysis

  • max time kernel
    47s
  • max time network
    58s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/10/2023, 17:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    SETUP.exe

  • Size

    4.0MB

  • MD5

    2e49c2766094036006d88be1d7421c46

  • SHA1

    f463c85fac004deff82f951fa1f1cac4cc7cb5e3

  • SHA256

    6c6f0a24ae2dfda6f443243551113b9db8a2421f68386d2855e887d8345f3cbb

  • SHA512

    c95d265d4f9e5629de6982abdce0daa66a51f631d04a61d737b74e00f70f9e9479db0b2d00b5e8f8c321b3873ed490b0da8c0039bd2f9ab42d61b6b29ca17c8f

  • SSDEEP

    98304:xXd2k33pPEQyoD68pLBu0Mlj90XnwlhFLOAkGkzdnEVomFHKnP:xXd1JWX0XnwjFLOyomFHKnP

Score
7/10
persistence

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SETUP.exe
    "C:\Users\Admin\AppData\Local\Temp\SETUP.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:640
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4492
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
      1⤵
      • Modifies system executable filetype association
      • Registers COM server for autorun
      • Checks processor information in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3396
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
        2⤵
          PID:2344
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservice -s fdPHost
        1⤵
          PID:3920

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                Filesize

                40.2MB

                MD5

                fb4aa59c92c9b3263eb07e07b91568b5

                SHA1

                6071a3e3c4338b90d892a8416b6a92fbfe25bb67

                SHA256

                e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

                SHA512

                60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                Filesize

                20.5MB

                MD5

                9830c86308d544b7b65058b70481c933

                SHA1

                6e7ef06104f1d6f4223eb753dbecbb383c9b2757

                SHA256

                05b1cd4711379533a7586abac68cb6eabfdc8436598b1e378849f4c4866c01d1

                SHA512

                d21bed1acd6d31c85720fadefdcf90b8131279d16f9cb474d69159586cb00f3b8369467bc7a9311d5dc8436116e8274c455318edccad5ec8ff9b7d6daa9fa870

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
                Filesize

                63KB

                MD5

                e516a60bc980095e8d156b1a99ab5eee

                SHA1

                238e243ffc12d4e012fd020c9822703109b987f6

                SHA256

                543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

                SHA512

                9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z1ELDZCP\update100[1].xml
                Filesize

                726B

                MD5

                53244e542ddf6d280a2b03e28f0646b7

                SHA1

                d9925f810a95880c92974549deead18d56f19c37

                SHA256

                36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d

                SHA512

                4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62

                Download Submit