ee2ced66adeccfe45722c49efd8b99fd032d0426ff74cd10fc1e182521431404

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64b12ea2b1bfbf71cd0ab82dae4a2a2b.exe
Size 698KB
Sample220818-hdgsjadfe9
SHA256 ee2ced66adeccfe45722c49efd8b99fd032d0426ff74cd10fc1e182521431404
MD5 64b12ea2b1bfbf71cd0ab82dae4a2a2b
SHA1 3dd4c91bd3891a987bb14e553645be0dce769be3
SHA512 cf7fb33b960c5d44d42ac410ccc7ac5681d50fa1727f74263202ed9aaf8757937e2eeb2386148385bfd8bd147e67cf38101a13b4f92865765b8421c1024f42c6
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 524 set thread context of 424	524	calc.exe	27
PID 4464 set thread context of 424	4464	raserver.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	raserver.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
524	calc.exe
524	calc.exe
524	calc.exe
524	calc.exe
524	calc.exe
524	calc.exe
524	calc.exe
524	calc.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
424	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
524	calc.exe
524	calc.exe
524	calc.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	524	calc.exe
Token: SeDebugPrivilege	4464	raserver.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 524	772	64b12ea2b1bfbf71cd0ab82dae4a2a2b.exe	82
PID 772 wrote to memory of 524	772	64b12ea2b1bfbf71cd0ab82dae4a2a2b.exe	82
PID 772 wrote to memory of 524	772	64b12ea2b1bfbf71cd0ab82dae4a2a2b.exe	82
PID 772 wrote to memory of 524	772	64b12ea2b1bfbf71cd0ab82dae4a2a2b.exe	82
PID 772 wrote to memory of 524	772	64b12ea2b1bfbf71cd0ab82dae4a2a2b.exe	82
PID 772 wrote to memory of 524	772	64b12ea2b1bfbf71cd0ab82dae4a2a2b.exe	82
PID 424 wrote to memory of 4464	424	Explorer.EXE	90
PID 424 wrote to memory of 4464	424	Explorer.EXE	90
PID 424 wrote to memory of 4464	424	Explorer.EXE	90
PID 4464 wrote to memory of 1800	4464	raserver.exe	94
PID 4464 wrote to memory of 1800	4464	raserver.exe	94
PID 4464 wrote to memory of 1800	4464	raserver.exe	94

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:424
- C:\Users\Admin\AppData\Local\Temp\64b12ea2b1bfbf71cd0ab82dae4a2a2b.exe
  "C:\Users\Admin\AppData\Local\Temp\64b12ea2b1bfbf71cd0ab82dae4a2a2b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:524
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2580
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4404
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3848
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4812
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3808
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3656
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-231-0x0000000007730000-0x0000000007842000-memory.dmp

Download

memory/424-225-0x0000000007730000-0x0000000007842000-memory.dmp

Download

memory/424-234-0x0000000007920000-0x00000000079E1000-memory.dmp

Download

memory/424-232-0x0000000007920000-0x00000000079E1000-memory.dmp

Download

memory/524-222-0x0000000050410000-0x000000005043B000-memory.dmp

Download

memory/524-223-0x0000000002900000-0x0000000002C4A000-memory.dmp

Download

memory/524-224-0x0000000002530000-0x0000000002540000-memory.dmp

Download

memory/772-181-0x0000000050410000-0x000000005043B000-memory.dmp

Download

memory/4464-230-0x0000000002F10000-0x0000000002F9F000-memory.dmp

Download

memory/4464-229-0x0000000003080000-0x00000000033CA000-memory.dmp

Download

memory/4464-228-0x0000000001200000-0x000000000122B000-memory.dmp

Download

memory/4464-233-0x0000000001200000-0x000000000122B000-memory.dmp

Download

memory/4464-227-0x0000000000F10000-0x0000000000F2F000-memory.dmp

Download