Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 11:11
Static task
static1
Behavioral task
behavioral1
Sample
Alis sifarisi.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Alis sifarisi.exe
Resource
win10v2004-en-20220112
General
-
Target
Alis sifarisi.exe
-
Size
1.0MB
-
MD5
54c39236d174c27d217736cd049d8bbd
-
SHA1
832f5c5c4cbf2b4f888f319654cf002176bbb916
-
SHA256
2179647ebf96503deb5fae78827c5d99757f2926f0226cb5a6e4181e2f0c1a07
-
SHA512
1df01d52dc6965d5b42c3f03887b01c0fdd1593666e1733d8776d4a64f22253c062e6f1e29fc403f2217547f96962955fe7733b23b55b0f5fd3a5774acec5c7a
Malware Config
Extracted
xloader
2.5
pvxz
imt-token.club
abravewayocen.online
shcloudcar.com
mshoppingworld.online
ncgf08.xyz
stuinfo.xyz
wesavetheplanetofficial.com
tourbox.xyz
believeinyourselftraining.com
jsboyat.com
aaeconomy.info
9etmorea.info
purosepeti7.com
goticketly.com
pinkmemorypt.com
mylifewellnesscentre.com
iridina.online
petrestore.online
neema.xyz
novelfooditalia.com
enterprisedaas.computer
tzkaxh.com
brainfarter.com
youniquegal.com
piiqrio.com
mdaszb.com
boldmale.com
era636.com
castleinsuranceco.com
woodennickelmusicfortwayne.com
customer-servis-kredivo.com
high-clicks.com
greetwithgadgets.com
hfsd1.com
insureagainstearthquakes.net
ultimatejump.rest
parivartanyogeshstore.com
handmanagementblog.com
meishangtianhua.com
michaelscottinsurance.net
kershoes.com
atomiccharmworks.com
conciergecompare.com
zeal-hashima.com
coachianscott.com
hwkm.net
019skz.xyz
jardingenesis.com
sumikkoremon.com
tjpengyun.com
sectionpor.xyz
46t.xyz
sa-pontianak.com
localproperty.team
dotexposed.com
cis136-tgarza.com
eiestilo.com
youknowhowtolive.com
phalcosnusa.com
qaticv93iy.com
hbjngs.com
ocean-nettoyage.com
jenuwinclothes.net
anadoluatvoffroad.com
finetipster.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/432-62-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/432-64-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/1840-70-0x00000000000F0000-0x0000000000119000-memory.dmp xloader -
Executes dropped EXE 1 IoCs
Processes:
certmgr7nmd1n.exepid process 1216 certmgr7nmd1n.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
Alis sifarisi.exewuapp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cndjwdks = "C:\\Users\\Admin\\skdwjdnC.url" Alis sifarisi.exe Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wuapp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\K6ATHDZ8WL = "C:\\Program Files (x86)\\Anng4l\\certmgr7nmd1n.exe" wuapp.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
DpiScaling.exewuapp.exedescription pid process target process PID 432 set thread context of 1412 432 DpiScaling.exe Explorer.EXE PID 1840 set thread context of 1412 1840 wuapp.exe Explorer.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
Explorer.EXEwuapp.exedescription ioc process File created C:\Program Files (x86)\Anng4l\certmgr7nmd1n.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Anng4l\certmgr7nmd1n.exe wuapp.exe -
Processes:
Explorer.EXEwuapp.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" Explorer.EXE Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wuapp.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar Explorer.EXE -
Modifies registry class 3 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
DpiScaling.exewuapp.exepid process 432 DpiScaling.exe 432 DpiScaling.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
DpiScaling.exewuapp.exepid process 432 DpiScaling.exe 432 DpiScaling.exe 432 DpiScaling.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe 1840 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
DpiScaling.exewuapp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 432 DpiScaling.exe Token: SeDebugPrivilege 1840 wuapp.exe Token: SeShutdownPrivilege 1412 Explorer.EXE Token: SeShutdownPrivilege 1412 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
Alis sifarisi.exeExplorer.EXEwuapp.exedescription pid process target process PID 1740 wrote to memory of 432 1740 Alis sifarisi.exe DpiScaling.exe PID 1740 wrote to memory of 432 1740 Alis sifarisi.exe DpiScaling.exe PID 1740 wrote to memory of 432 1740 Alis sifarisi.exe DpiScaling.exe PID 1740 wrote to memory of 432 1740 Alis sifarisi.exe DpiScaling.exe PID 1740 wrote to memory of 432 1740 Alis sifarisi.exe DpiScaling.exe PID 1740 wrote to memory of 432 1740 Alis sifarisi.exe DpiScaling.exe PID 1740 wrote to memory of 432 1740 Alis sifarisi.exe DpiScaling.exe PID 1412 wrote to memory of 1840 1412 Explorer.EXE wuapp.exe PID 1412 wrote to memory of 1840 1412 Explorer.EXE wuapp.exe PID 1412 wrote to memory of 1840 1412 Explorer.EXE wuapp.exe PID 1412 wrote to memory of 1840 1412 Explorer.EXE wuapp.exe PID 1412 wrote to memory of 1840 1412 Explorer.EXE wuapp.exe PID 1412 wrote to memory of 1840 1412 Explorer.EXE wuapp.exe PID 1412 wrote to memory of 1840 1412 Explorer.EXE wuapp.exe PID 1840 wrote to memory of 2040 1840 wuapp.exe cmd.exe PID 1840 wrote to memory of 2040 1840 wuapp.exe cmd.exe PID 1840 wrote to memory of 2040 1840 wuapp.exe cmd.exe PID 1840 wrote to memory of 2040 1840 wuapp.exe cmd.exe PID 1840 wrote to memory of 1752 1840 wuapp.exe Firefox.exe PID 1840 wrote to memory of 1752 1840 wuapp.exe Firefox.exe PID 1840 wrote to memory of 1752 1840 wuapp.exe Firefox.exe PID 1840 wrote to memory of 1752 1840 wuapp.exe Firefox.exe PID 1412 wrote to memory of 1216 1412 Explorer.EXE certmgr7nmd1n.exe PID 1412 wrote to memory of 1216 1412 Explorer.EXE certmgr7nmd1n.exe PID 1412 wrote to memory of 1216 1412 Explorer.EXE certmgr7nmd1n.exe PID 1412 wrote to memory of 1216 1412 Explorer.EXE certmgr7nmd1n.exe PID 1840 wrote to memory of 1752 1840 wuapp.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Alis sifarisi.exe"C:\Users\Admin\AppData\Local\Temp\Alis sifarisi.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Anng4l\certmgr7nmd1n.exe"C:\Program Files (x86)\Anng4l\certmgr7nmd1n.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Anng4l\certmgr7nmd1n.exeMD5
8c9da2e414e713d3daff1f18223ae11b
SHA19ef90d73fa4d852be9b803a5e990cc908aab8a94
SHA25660b2a9d679f14f92e284ad21395da53652db137e45ec6473d9033e6c3fe6a37f
SHA512adc712d94e8226729b336a348e9376d68f1e006871e7a0151f312e125e96226e74bc75e87efd709e31c5cb322a9ed68e2912c9fd03bd6e6800f5900f712105d7
-
C:\Program Files (x86)\Anng4l\certmgr7nmd1n.exeMD5
8c9da2e414e713d3daff1f18223ae11b
SHA19ef90d73fa4d852be9b803a5e990cc908aab8a94
SHA25660b2a9d679f14f92e284ad21395da53652db137e45ec6473d9033e6c3fe6a37f
SHA512adc712d94e8226729b336a348e9376d68f1e006871e7a0151f312e125e96226e74bc75e87efd709e31c5cb322a9ed68e2912c9fd03bd6e6800f5900f712105d7
-
memory/432-67-0x0000000000210000-0x0000000000221000-memory.dmpFilesize
68KB
-
memory/432-58-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/432-59-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/432-62-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/432-63-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/432-64-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/432-66-0x000000007249D000-0x000000007249E000-memory.dmpFilesize
4KB
-
memory/432-65-0x0000000002190000-0x0000000002493000-memory.dmpFilesize
3.0MB
-
memory/1216-77-0x0000000072A71000-0x0000000072A73000-memory.dmpFilesize
8KB
-
memory/1412-68-0x0000000006A20000-0x0000000006B60000-memory.dmpFilesize
1.2MB
-
memory/1412-73-0x0000000008D80000-0x0000000008E9B000-memory.dmpFilesize
1.1MB
-
memory/1740-55-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1740-53-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1740-56-0x0000000000406000-0x0000000000407000-memory.dmpFilesize
4KB
-
memory/1840-69-0x00000000002F0000-0x00000000002FB000-memory.dmpFilesize
44KB
-
memory/1840-70-0x00000000000F0000-0x0000000000119000-memory.dmpFilesize
164KB
-
memory/1840-71-0x0000000001EE0000-0x00000000021E3000-memory.dmpFilesize
3.0MB
-
memory/1840-72-0x0000000001CC0000-0x0000000001D50000-memory.dmpFilesize
576KB