b9f03efb1bd75e69ea854f15bb0bffc77d8fd67af95daca3b4b7f709ea7441da

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
01/08/2022, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 28600.exe
Size 665KB
Sample220801-jttygaeca2
SHA256 b9f03efb1bd75e69ea854f15bb0bffc77d8fd67af95daca3b4b7f709ea7441da
MD5 22b73dfdf93db8f4750afbf151c28c3e
SHA1 5806d235710e6c55aefd3c64a5c163f9f8ed3580
SHA512 72289355366b30c738f3ba1fbf062f28ad6c00460dd6db6ea2b0261975d202ec737c249b65cd2cec56cb34cfc08980b8ba6ca85d03b549a3ea7b95ebef74ccbd
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Control Panel\International\Geo\Nation	PO 28600.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1564 set thread context of 852	1564	PO 28600.exe	27
PID 852 set thread context of 1208	852	PO 28600.exe	10
PID 1412 set thread context of 1208	1412	help.exe	10

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
852	PO 28600.exe
852	PO 28600.exe
852	PO 28600.exe
852	PO 28600.exe
1412	help.exe
1412	help.exe
1412	help.exe
1412	help.exe
1412	help.exe
1412	help.exe
1412	help.exe
1412	help.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
852	PO 28600.exe
852	PO 28600.exe
852	PO 28600.exe
1412	help.exe
1412	help.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	852	PO 28600.exe
Token: SeDebugPrivilege	1412	help.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 852	1564	PO 28600.exe	27
PID 1564 wrote to memory of 852	1564	PO 28600.exe	27
PID 1564 wrote to memory of 852	1564	PO 28600.exe	27
PID 1564 wrote to memory of 852	1564	PO 28600.exe	27
PID 1564 wrote to memory of 852	1564	PO 28600.exe	27
PID 1564 wrote to memory of 852	1564	PO 28600.exe	27
PID 1564 wrote to memory of 852	1564	PO 28600.exe	27
PID 1208 wrote to memory of 1412	1208	Explorer.EXE	28
PID 1208 wrote to memory of 1412	1208	Explorer.EXE	28
PID 1208 wrote to memory of 1412	1208	Explorer.EXE	28
PID 1208 wrote to memory of 1412	1208	Explorer.EXE	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\PO 28600.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 28600.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Users\Admin\AppData\Local\Temp\PO 28600.exe
    "C:\Users\Admin\AppData\Local\Temp\PO 28600.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:852
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-66-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/852-68-0x0000000000190000-0x00000000001A1000-memory.dmp

Download

memory/852-67-0x0000000000AE0000-0x0000000000DE3000-memory.dmp

Download

memory/852-60-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/852-61-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/852-63-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1208-77-0x0000000004CD0000-0x0000000004DB3000-memory.dmp

Download

memory/1208-75-0x0000000004CD0000-0x0000000004DB3000-memory.dmp

Download

memory/1208-69-0x0000000004A90000-0x0000000004BDB000-memory.dmp

Download

memory/1412-71-0x0000000000390000-0x0000000000396000-memory.dmp

Download

memory/1412-72-0x0000000000880000-0x0000000000B83000-memory.dmp

Download

memory/1412-73-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/1412-74-0x0000000000700000-0x0000000000790000-memory.dmp

Download

memory/1412-76-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/1564-59-0x0000000002070000-0x00000000020A4000-memory.dmp

Download

memory/1564-58-0x0000000005520000-0x00000000055A2000-memory.dmp

Download

memory/1564-57-0x0000000000410000-0x000000000041A000-memory.dmp

Download

memory/1564-54-0x0000000000A30000-0x0000000000ADC000-memory.dmp

Download

memory/1564-56-0x00000000003C0000-0x00000000003D6000-memory.dmp

Download

memory/1564-55-0x00000000763E1000-0x00000000763E3000-memory.dmp

Download