4e459e942437ee7a6b767925f7cfaac795f9049c71b9211392061b2f4338dbfb

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setupres.exe
Size

2.0MB
MD5

e75b71aa66f4177b62485503809ec837
SHA1

8203e06f29d51c25b2af48c62fa6074c58958660
SHA256

f2ac71dbbc1ec524d93811dd4cd64edc5c836be379fa9cfd565af7ba45cfe80c
SHA512

2761d0880e60a87b9cca31cd533f626b218ddf9939dbd751cc468904500d19a59e63c09af0f44ede21bbf8a416ec05b08ac7f6629cf7de1072323b349d9df2f7
SSDEEP

49152:b82GHJEEqZj0HcfkfXhgW7Xvn0/55ScrQI+HKU/Z:b48foR370hFrzIZ

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setupres.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setupres.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setupres.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setupres.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setupres.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setupres.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Setupres.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Setupres.exe
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setupres.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Wine Setupres.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

32 bitbucket.org
67 bitbucket.org
31 bitbucket.org
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Setupres.exe

pid process

3648 Setupres.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setupres.exe

pid process

3648 Setupres.exe
3648 Setupres.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	Setupres.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Wine	Setupres.exe

flow	ioc
32	bitbucket.org
67	bitbucket.org
31	bitbucket.org

pid	process
3648	Setupres.exe

pid	process
3648	Setupres.exe
3648	Setupres.exe

C:\Users\Admin\AppData\Local\Temp\Setupres.exe
"C:\Users\Admin\AppData\Local\Temp\Setupres.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3648

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\tybgrfed.exe
Filesize
13KB

MD5
1a0c98a29303afbc07ae7a326aa6187e

SHA1
c1de9150e54fcb2747ea952356db2bceadd2474f

SHA256
4f568a62c3d42a91beb5b7c3466cd0ace60ea2706b94fba4f18fa704729eaa25

SHA512
db9006e761d53517abbe805c7a96b106b51daf164a9f105839f825f0ea7ef717155d81b841072cf7cc8ab02b91cf5de7e188a7fa2ea779fef9f5d2d8ac64b9f0

Download Submit
C:\Users\Admin\AppData\Roaming\yhtgrfecd.exe
Filesize
13KB

MD5
9b1fe7b98ad5dfe46d13615ed6a68cf7

SHA1
8d589ddd573193139f4b6e2e73e036de57fccd49

SHA256
dd840f00db40d82ce0b5bc048c7ad068e2cc142fdc3830818d7df562f1e8f741

SHA512
ba3ff1f024cb64bfcf8ab6863a253a06b84e84cb7215cc0d7ecbe0076dda849f03e7394ccff0126716bc3b463a8fd74952d956eb8ebb622572e6badc66f314fc

Download Submit
memory/3648-18-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-60-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-7-0x0000000009E50000-0x0000000009E51000-memory.dmp

Filesize
4KB

Download
memory/3648-20-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-5-0x0000000009E20000-0x0000000009E21000-memory.dmp

Filesize
4KB

Download
memory/3648-4-0x0000000009E70000-0x0000000009E71000-memory.dmp

Filesize
4KB

Download
memory/3648-3-0x0000000009DC0000-0x0000000009DC1000-memory.dmp

Filesize
4KB

Download
memory/3648-2-0x0000000009E40000-0x0000000009E41000-memory.dmp

Filesize
4KB

Download
memory/3648-10-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-11-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-12-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-13-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-14-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-15-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-16-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-17-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-0-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-19-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-6-0x0000000009E30000-0x0000000009E31000-memory.dmp

Filesize
4KB

Download
memory/3648-8-0x0000000009F80000-0x0000000009F81000-memory.dmp

Filesize
4KB

Download
memory/3648-27-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-26-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-28-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-9-0x0000000000401000-0x000000000045D000-memory.dmp

Filesize
368KB

Download
memory/3648-39-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-40-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-41-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-42-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-43-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-1-0x0000000077724000-0x0000000077726000-memory.dmp

Filesize
8KB

Download
memory/3648-55-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-56-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-57-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-58-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-59-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-21-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/3648-61-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download