9fa64c90a5f724bb282934ee693fac3b8f82a7a08039d52946904262f8d2ec6a

Analysis

max time kernel
96s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2024, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 10.0MB
Sample241115-ys9d4a1dnn
SHA256 9fa64c90a5f724bb282934ee693fac3b8f82a7a08039d52946904262f8d2ec6a
MD5 77bcd2eabcf03b6e9ba593115bd6167b
SHA1 16ff52950593940ec9f6ed8f18ebce616d0655ae
SHA512 4540c7e385e7e58e851278efec892d019ec857447351b48187c88484f4f703a8febecb160b35c8022c12bc4282631ddf84d97d65e1e383257a5cbc5c3f5f94b7
SSDEEP 24576:NvOz5y8OFnzG0rDevq0+wDLa7ThtbhEl9vAnqeG+P:9O9CFG0uy0+wn0H9AbwP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 1 IoCs

pid	Process
2036	Seeds.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2624	tasklist.exe
4604	tasklist.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\TreatVenue	Setup.exe
File opened for modification	C:\Windows\LeadsFatal	Setup.exe
File opened for modification	C:\Windows\CwDirector	Setup.exe
File opened for modification	C:\Windows\SysSalary	Setup.exe
File opened for modification	C:\Windows\NpTranscription	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Seeds.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2036	Seeds.com
2036	Seeds.com
2036	Seeds.com
2036	Seeds.com
2036	Seeds.com
2036	Seeds.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	tasklist.exe
Token: SeDebugPrivilege	4604	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2036	Seeds.com
2036	Seeds.com
2036	Seeds.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2036	Seeds.com
2036	Seeds.com
2036	Seeds.com

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2596	1848	Setup.exe	86
PID 1848 wrote to memory of 2596	1848	Setup.exe	86
PID 1848 wrote to memory of 2596	1848	Setup.exe	86
PID 2596 wrote to memory of 2624	2596	cmd.exe	93
PID 2596 wrote to memory of 2624	2596	cmd.exe	93
PID 2596 wrote to memory of 2624	2596	cmd.exe	93
PID 2596 wrote to memory of 1576	2596	cmd.exe	94
PID 2596 wrote to memory of 1576	2596	cmd.exe	94
PID 2596 wrote to memory of 1576	2596	cmd.exe	94
PID 2596 wrote to memory of 4604	2596	cmd.exe	95
PID 2596 wrote to memory of 4604	2596	cmd.exe	95
PID 2596 wrote to memory of 4604	2596	cmd.exe	95
PID 2596 wrote to memory of 3508	2596	cmd.exe	96
PID 2596 wrote to memory of 3508	2596	cmd.exe	96
PID 2596 wrote to memory of 3508	2596	cmd.exe	96
PID 2596 wrote to memory of 1020	2596	cmd.exe	97
PID 2596 wrote to memory of 1020	2596	cmd.exe	97
PID 2596 wrote to memory of 1020	2596	cmd.exe	97
PID 2596 wrote to memory of 4168	2596	cmd.exe	98
PID 2596 wrote to memory of 4168	2596	cmd.exe	98
PID 2596 wrote to memory of 4168	2596	cmd.exe	98
PID 2596 wrote to memory of 4728	2596	cmd.exe	101
PID 2596 wrote to memory of 4728	2596	cmd.exe	101
PID 2596 wrote to memory of 4728	2596	cmd.exe	101
PID 2596 wrote to memory of 2036	2596	cmd.exe	102
PID 2596 wrote to memory of 2036	2596	cmd.exe	102
PID 2596 wrote to memory of 2036	2596	cmd.exe	102
PID 2596 wrote to memory of 2992	2596	cmd.exe	103
PID 2596 wrote to memory of 2992	2596	cmd.exe	103
PID 2596 wrote to memory of 2992	2596	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Adaptation Adaptation.cmd & Adaptation.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1576
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 327359
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1020
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "TFTREGIMERESTRICTIONGALE" Cute
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4168
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Cape + ..\Preference + ..\Legend + ..\Deadline + ..\Zum + ..\Uploaded + ..\Burns t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\327359\Seeds.com
    Seeds.com t
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2036
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Seeds.com

Path C:\Users\Admin\AppData\Local\Temp\327359\Seeds.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\327359\t
Size 471KB
SHA256 704190d0960c7a1d2ef233c83fab34bd82596e1d135061eb603f11c4d7a42e73
MD5 172f410808b9229f4f9cba37ab8bc970
SHA1 35b9956077da3e16eea13c890ec571f9c35c752f
SHA512 3f2e664be336304777608c3f4d41bc63ad6fdf20cde95bd425a71134a69181e37efe6b033d936c0f256736c6bc8cef24da51d3ecab705061b8cedc02a97f3938
SSDEEP 12288:kRiQfqqhfyXrMw57vocEirTLny4bISDKI:U/dKMwV2wU+KI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Adaptation

Path C:\Users\Admin\AppData\Local\Temp\Adaptation
Size 28KB
SHA256 ec8fddc6cf6f7e16e444fe41388167577b335cec4169a4c05262d731e6b0f442
MD5 568018cb63038c362a83bce08b3fdc3c
SHA1 8804ef0e5a6261c1ccac1e358fdfed1e77175722
SHA512 38b402f69d5d5e5edb0651f228e42767b501b6439d9b8df46dcb7ca1b8a49869b76b050af33fe16569123ecf7d3c1fd93455508a189c3faea8e9a9cdb09920ab
SSDEEP 768:9Bi2RmWqpn0z4oue7oeNTRwLoXTOyMFq9mKKvD6:9BXZqVivRDhWK66
MD5 SHA1 SHA512 SSDEEP

Submit Download

Burns

Path C:\Users\Admin\AppData\Local\Temp\Burns
Size 14KB
SHA256 6667ffdd75c192fbd6d910e208e6b1d21961100ff856632e9deb45e23ad08973
MD5 ce83c675de0c45417c411ffc5a19fa13
SHA1 feb4edd59cc7ea92d4d3798ed47f7b1884e229d8
SHA512 7e21edccc67e261a559a73690fe3ce9585e9be941ba3ebfff8240d58213ee9f6c03c155a7228dff25b9c00154d725cda1112e441b8655868c14feeec0a77818f
SSDEEP 384:LB/dTZ6iVJO7AxHTpypRnmZ7e3aLWXsoukBlSHF2PACHdV:l5gczpERnmZi3buk7SHF2IO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cape

Path C:\Users\Admin\AppData\Local\Temp\Cape
Size 64KB
SHA256 b668e917d060edee0e26569691d731f673e617630e503aafbe315d1715fca416
MD5 7e905948cee6ec19ef4a68f0bec79183
SHA1 e49366b2c123e54a8a3f41b8bf0dab6c13222d30
SHA512 4be7fecbb3ae23acc122fd745b7b31a10a957908448d0c710d589895ab96067da077e1a922d0cd73a500d648f6ae3ac20c6c967eb89dd0dad21edb708ceb485f
SSDEEP 1536:aQoprvWBon8LUuZk1fQ9n0YX0y0v+FDsA/sZq:srvbV1fCEy0WFa8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cute

Path C:\Users\Admin\AppData\Local\Temp\Cute
Size 753B
SHA256 76b0cb0f79ae7859ec000ffe40f2c312ecebf4f6601f9e1dbd15c4a86b1e5e6d
MD5 03422121a7b7eb5f181b9f0ad1afc0f6
SHA1 30c128b0c3e965d434aa32fd183c44afc7f90699
SHA512 1e0954a381605cc3ee51148a3e57c0d2db53686cb17f15f6b8bd5f331012c069068e8d1ead7bfafbeb8028e5d5e34d3528333990b50ae3f8c94bced2e4afff0c
MD5 SHA1 SHA512

Submit Download

Deadline

Path C:\Users\Admin\AppData\Local\Temp\Deadline
Size 62KB
SHA256 b3683f3bc9504ad4bba3061974ae486dbe25fbe8622ebc4002b967c4c2659cb8
MD5 e8d2170f2a76580d5fe0d105fed4cdca
SHA1 f92462948b789f064f023b60a3999ed68542f38d
SHA512 0398bd6de9332673fa1850cd8028a370087cac484b9351ab7b0695c316073a3897ef4b47c35d80a5a192d7c54b240fe2b034efc3cd8f04297dd9a37e379f124b
SSDEEP 1536:I/A6JsXvd/QCnQFdW9sxxelybK8Sc5Hw6mbLL3:gzaNExqM5QZLj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Farmer

Path C:\Users\Admin\AppData\Local\Temp\Farmer
Size 920KB
SHA256 78fa29ad91de2b63990882ad779e9a24630dffa88e3d267fd36c12a6ab6057bc
MD5 d3c4d0408d6f6d3402acb60a9e69579f
SHA1 d05ca86c46b67f9eb7e44bc84bbac4cdba8be38b
SHA512 7948ece30c369abd0707caec85ad9c9b4afa836cf957eb752cd8146f16e4cd01c797f07831127984cdffeb93cf28525e98307a2e3049979ffba7f9dd5243b717
SSDEEP 24576:PJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:PC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Legend

Path C:\Users\Admin\AppData\Local\Temp\Legend
Size 83KB
SHA256 bb7077757b476e01ababd919319382ad8562c110e02781494fb72d9b87109038
MD5 a68645548c9fe1cfaeed20e30c2c1116
SHA1 5279bb55c011b296f43bda554e3c19f8591c7c16
SHA512 c5eff09a617ef68624f71d1c43ec084468429636b41b851066b014666c94f6c1efce4d1ce17b1c4b07987f186f6c7df8e7d5e48b243a11a5a39774c23a585952
SSDEEP 1536:D+0BKRn9+V+HNbfRRsdO0OpGAWLReCYaa3mmwPqozrtpJ/DdZn2:S0BKxAVIbfRys7pSha3F+qo1/Djn2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preference

Path C:\Users\Admin\AppData\Local\Temp\Preference
Size 98KB
SHA256 064e6d366ece00a40e86477385dfb997f3bd63f77c4b09eaa2b92d1a3a4b39e0
MD5 9fd551f0e086b6e68c9a88aee8b3d4d4
SHA1 2e50ae963432eee5cff45e606074583b299e039d
SHA512 ae9633ab109fe11cb216dc3f0ddbe86c7fe6aa665ceca502cee269c47094193e9f1e19b25155ed29323b9e3fed4a581eca369819028360ddba92362de9d22379
SSDEEP 3072:qzC4MgbnMc/qqpUufsiuoZyQyUbBR8vncgPN5nYGE:UM2qq+ufxfyMK0uLe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uploaded

Path C:\Users\Admin\AppData\Local\Temp\Uploaded
Size 91KB
SHA256 fda86813bf5c40d9142afc7995c76e6b01056e1ab0333c5a09db613865c2c790
MD5 db0d58c396f6b375505ea65497b0e910
SHA1 1fe090dcb92bdeafc2384008d8325cfbc7494681
SHA512 7661717d311893351e741fb7eb714bce14ea7e4d892dcbdddee2e3f08f7cfcde7b2b82157c60884b3d9b57b2dd8f1fe6d5fc7f2c4f4658c5ee6f257abcd1ea96
SSDEEP 1536:AYa1JxLnH2x9B0eaz+miBtX+RNdxQ3Iypsfn1vXNPfba4efh:RaNnHTeDmYY3d63Iypsf1vdX+h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zum

Path C:\Users\Admin\AppData\Local\Temp\Zum
Size 59KB
SHA256 e253748494f2fa47825e58a9fe2ac5dc118c480edf34bd4ad7094f6e8dd58da1
MD5 ab590ac1b2b1f0f691bff0879b61b14b
SHA1 b1f80984106b6660e6e4eac4dbfec3042e70e919
SHA512 5862b9c954d6d1ed850c82fe83094a7a849afc3209961d7e0108d33b785ad1182aeb0b97203b1d721baa8b79ae268d61a04ec661ad9151538a3658f5df1d49cb
SSDEEP 1536:ziAs+S5enXE1la2BJYp4ZP4UsI4MS7GE7N08vVYme:GsS0nXE1ups4fqWGUN02VYn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2036-662-0x00000000048D0000-0x0000000004927000-memory.dmp

Download

memory/2036-661-0x00000000048D0000-0x0000000004927000-memory.dmp

Download

memory/2036-663-0x00000000048D0000-0x0000000004927000-memory.dmp

Download

memory/2036-666-0x00000000048D0000-0x0000000004927000-memory.dmp

Download

memory/2036-665-0x00000000048D0000-0x0000000004927000-memory.dmp

Download

memory/2036-664-0x00000000048D0000-0x0000000004927000-memory.dmp

Download