b7683441e42f706642877d1a92c5307d223b1e6195d463f1ad9332e7e6ac5a91

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setupres.exe
Size

2.1MB
MD5

c9638374b6732d9756d9a6ae50061747
SHA1

7952f8225a6cf692ce226bfaf8112260e4ac2b71
SHA256

34d2e90229c1c3c41b931bb65ea015f023744543d915dcfeffe2328e32c27e8e
SHA512

428d4977300ba3f95905f655a93aaad89145e8c09a96491ad8142be18a6802294e735f9b3fe04845c5c80a3997275203d3a5861fc7e4cc185fb8eae19b2a0ffa
SSDEEP

49152:aVoRLzxlaVuzaroTCjia+Hii9UNbqL2JTVWAcuoli:aWR/aczaroeE9785WZzg

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setupres.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setupres.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setupres.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setupres.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setupres.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setupres.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Setupres.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation Setupres.exe
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setupres.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine Setupres.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

19 bitbucket.org
20 bitbucket.org
64 bitbucket.org
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Setupres.exe

pid process

700 Setupres.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setupres.exe

pid process

700 Setupres.exe
700 Setupres.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Setupres.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine	Setupres.exe

flow	ioc
19	bitbucket.org
20	bitbucket.org
64	bitbucket.org

pid	process
700	Setupres.exe

pid	process
700	Setupres.exe
700	Setupres.exe

C:\Users\Admin\AppData\Local\Temp\Setupres.exe
"C:\Users\Admin\AppData\Local\Temp\Setupres.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\tybgrfed.exe
Filesize
13KB

MD5
345cee92fc77bbb401bfefc788f7173b

SHA1
29ec845bbcc417946c51878f14e805847ca4a7d5

SHA256
c964a96f590a40c1303b66bd627251d67acab0f7447efaff89a26590a90e8847

SHA512
6de6bce02fd4b263cb1d9fe5cff829dfe7bac87ca81ed4f6614a8728e08031f7260765b6a14de05c486c45f55d7ff68b0923cde1e37c7358aa3186fa596c2969

Download Submit
C:\Users\Admin\AppData\Roaming\yhtgrfecd.exe
Filesize
13KB

MD5
6396344a2173e60eeaa66a1043c7fc4f

SHA1
bd52ed54bfa8cf305a14a5ac8dd30d14adb0480e

SHA256
77bddff6e87108a9c2ba81b02395f40d1c9cbb7ec08c18bd32d842e0c38f7c1b

SHA512
99158d6f7d6b637f1491cab359e9051c6eafc26b904ab98941e344a7ccf439c77034f6549d3ce23c7a7605a83f4288892ff3a3c84b1aedb9f459ea2e8271da96

Download Submit
memory/700-18-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-60-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-5-0x0000000009E30000-0x0000000009E31000-memory.dmp

Filesize
4KB

Download
memory/700-20-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-9-0x0000000000401000-0x000000000045D000-memory.dmp

Filesize
368KB

Download
memory/700-6-0x0000000009E50000-0x0000000009E51000-memory.dmp

Filesize
4KB

Download
memory/700-3-0x0000000009DD0000-0x0000000009DD1000-memory.dmp

Filesize
4KB

Download
memory/700-2-0x0000000009E40000-0x0000000009E41000-memory.dmp

Filesize
4KB

Download
memory/700-10-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-11-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-13-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-14-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-12-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-15-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-16-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-17-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-0-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-19-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-4-0x0000000009E70000-0x0000000009E71000-memory.dmp

Filesize
4KB

Download
memory/700-7-0x0000000009E20000-0x0000000009E21000-memory.dmp

Filesize
4KB

Download
memory/700-27-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-26-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-28-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-8-0x0000000009F80000-0x0000000009F81000-memory.dmp

Filesize
4KB

Download
memory/700-39-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-40-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-41-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-42-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-43-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-1-0x0000000077B44000-0x0000000077B46000-memory.dmp

Filesize
8KB

Download
memory/700-55-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-56-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-57-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-58-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-59-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-21-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download
memory/700-61-0x0000000000400000-0x000000000092D000-memory.dmp

Filesize
5.2MB

Download