8cd9b79f750139d935e4981e0968b0ca5a212f3d6e04471e7cbfcea2fa9b195c

General

Target

dfsetup30.exe
Size

994KB
MD5

a933a21a48b4972525a054b1d9e5fcdc
SHA1

6d4009b79987d516ea808049d399dd8fa194dbe2
SHA256

d4304c6ef944a682252a7694643f7297ebd46a0daf3b2ef2b106f36e907acab7
SHA512

78b6629c94e15107ce8d2e20586ac57e4bf913e41ba76d6577bb4de8f3e31c5ed0af734c637b8c7da9899a911cf67bf7e260af51f389705604db68a1bdb3c793
SSDEEP

24576:v2UpvKwZm9kvOfpYb8ZXNx98E5Y1bNUsk0o8YaXag:v2uiwMkvQk8l98Q4S1/aV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	dfsetup30.tmp

Executes dropped EXE 2 IoCs

pid	Process
3784	dfsetup30.tmp
3136	DupFiles.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DupFiles\is-4K2AD.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-ST8GL.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-K3NB8.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-IE2AQ.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\unins000.dat	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-6D1CP.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-ASS3Q.tmp	dfsetup30.tmp
File opened for modification	C:\Program Files (x86)\DupFiles\unins000.dat	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-V04PH.tmp	dfsetup30.tmp
File created	C:\Program Files (x86)\DupFiles\is-S1OOF.tmp	dfsetup30.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DupFiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfsetup30.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfsetup30.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	dfsetup30.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3136	DupFiles.exe
3136	DupFiles.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3784	2564	dfsetup30.exe	83
PID 2564 wrote to memory of 3784	2564	dfsetup30.exe	83
PID 2564 wrote to memory of 3784	2564	dfsetup30.exe	83
PID 3784 wrote to memory of 5104	3784	dfsetup30.tmp	96
PID 3784 wrote to memory of 5104	3784	dfsetup30.tmp	96
PID 3784 wrote to memory of 5104	3784	dfsetup30.tmp	96

C:\Users\Admin\AppData\Local\Temp\dfsetup30.exe
"C:\Users\Admin\AppData\Local\Temp\dfsetup30.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\is-FF3BT.tmp\dfsetup30.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FF3BT.tmp\dfsetup30.tmp" /SL5="$602C4,782314,53248,C:\Users\Admin\AppData\Local\Temp\dfsetup30.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\DupFiles\Readme.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5104

C:\Program Files (x86)\DupFiles\DupFiles.exe
"C:\Program Files (x86)\DupFiles\DupFiles.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DupFiles\DupFiles.exe

Filesize
1.6MB

MD5
2873287449b17947b6b7a1206db2085e

SHA1
8fc06793de948cebceda5e7a4a468539bd887b1f

SHA256
3697bfa6698c3b9a41744e6afebcb352f6cc948ad8d739ed6558573d8584a0e7

SHA512
84ddf2cc4207ceda54ad0b6beb561f5c22ab8b3d14138bc680b97da43aac87e3ad198f23a9397e5f5bdfb63e55ac6b68cf8cca609384c09981b033ce979af645

Download Submit
C:\Program Files (x86)\DupFiles\Readme.txt

Filesize
2KB

MD5
e14ed25400387e3372c4fe047e3344dd

SHA1
f1bb0155ce3f14c2196591abcb5ed494812f4827

SHA256
57cd4a54d5026eebcaf5f7b3bf148c0e81fc93021202e0a1f4fdf1defa2c8291

SHA512
f8deac7083846443fd61754c4741894470242872de928b8bcd4c240c327fb31126db5e7f354475f6bd8b7792b38e37d26a2ad05184022a1e19e9b7a5bf0ae5ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FF3BT.tmp\dfsetup30.tmp

Filesize
669KB

MD5
52950ac9e2b481453082f096120e355a

SHA1
159c09db1abcee9114b4f792ffba255c78a6e6c3

SHA256
25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

SHA512
5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

Download Submit
memory/2564-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2564-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2564-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2564-44-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3784-10-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/3784-15-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/3784-43-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download

Analysis

Sharing