Analysis
-
max time kernel
89s -
max time network
85s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01-07-2024 13:58
Static task
static1
General
-
Target
Setup.exe
-
Size
951KB
-
MD5
e86d9ad8b70cdb49b54bcd969b724d19
-
SHA1
966b40f9c5493d356bea4d16c5e90728c9e8cee2
-
SHA256
3bf3a7653abce050a672207777f823b5bfee766a18a597ae8a63184323980e85
-
SHA512
d096adbf6f6fe1d8bfd660509c1905a6c17be7bbb460058130db0e500ee617a7424b1cf101dc03a52dee2f9c0c8a52aadd256469d32f351d352f3715928044bc
-
SSDEEP
24576:C+qodQCtw8QEZWBiMUp736I5Zqiwul6teKj16ffJmyMW:jw8QEZWBTXSZqiwY6tD6n4yT
Malware Config
Extracted
lumma
https://groundsmooors.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 2804 set thread context of 1944 2804 Setup.exe RegAsm.exe -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4972 2804 WerFault.exe Setup.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
taskmgr.exepid process 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 212 taskmgr.exe Token: SeSystemProfilePrivilege 212 taskmgr.exe Token: SeCreateGlobalPrivilege 212 taskmgr.exe Token: 33 212 taskmgr.exe Token: SeIncBasePriorityPrivilege 212 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Setup.exedescription pid process target process PID 2804 wrote to memory of 352 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 352 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 352 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 4288 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 4288 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 4288 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 1944 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 1944 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 1944 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 1944 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 1944 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 1944 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 1944 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 1944 2804 Setup.exe RegAsm.exe PID 2804 wrote to memory of 1944 2804 Setup.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 6682⤵
- Program crash
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1944-1-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1944-3-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1944-4-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/2804-0-0x0000000001280000-0x0000000001281000-memory.dmpFilesize
4KB