Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2022 16:37
Static task
static1
Behavioral task
behavioral1
Sample
Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe
Resource
win7-20220812-en
General
-
Target
Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe
-
Size
1.0MB
-
MD5
c8bd2fd6e2e7fc24eada83b44336f570
-
SHA1
d5ed0e54b839a3fcea2a912461f71aa3069eefde
-
SHA256
e4e4b8f8990f7ff711e1a238445dedaf74f4d01a10afa0c774705ff4412cbc10
-
SHA512
dc893cfbdd76f6dd9743f0948903839e6b95a01b2da66ccb9f3493a4324bc6ffe9ecdad31d4949d5e16dc81fcc842a6c5587a4f193e81619e55dae4f6dfdf5d7
-
SSDEEP
24576:I1S9JZiaRy0nJoOT5g7QD147cdgvuSp4O1BfX+FJ2SIv:IIvKkzTq61GcmxpnQJ2S
Malware Config
Extracted
formbook
ruwn
MvG74HO0R0fdGfJ1BiyHgNcexfpDQlwZCA==
Dat+rkV462igk2LufHo/NSE=
3LZ+y3jZXQ==
lllq2KJ2gwVcW/QxzS+QJlYg/g==
IPYDRekc+4ny6A==
Hr2SxM0quEmQk0bKaqw9tAcW5kMF
HMTIBAtJcQ9dXRqbctU5RZ9LIpEBbQ==
cisnZn2OqJ1k0uZtPoNh
YDxFc1uGlKqtZbzEkOrtlinS6Q==
6YsTAbSR5IKsa3kAne1gFns9
849SZE7FafcEciNlOa3y3w==
dD9IgmqPmSBH+2ujSno/NSE=
oTnMzZlugA5mXPdG2xFa/iEtS2QL
FN/mUyVE6ud9z+JtPoNh
Cvcia+2HQaBy
dQfS3I9otsZTRnAqmw==
8sOHdCb+Coa/q2KySno/NSE=
EqcwLimUNlHX7XIJpPw=
4o6PAABl7uuAv5hHHpg0800k
hyQlbm+mh+3vqxn8
n2tspqoaxkpD8WGeq8vz1w==
b0EtJMzzfYQomtOfA0tMhdks5Q==
voljrscvqall4SEoA/sG3Q==
Ho9COfHeNl7yHb6ccuU=
VfK1ZBZr9nZ0LbXyuyc+tZBIAhFAQlwZCA==
HMf8cjRqCpKUEs/ojA==
qEH789U64h70WzrC0xjhwA==
5bOJz4V2nmZq9GOthA==
qz0AJjWDI1JYEs/ojA==
JL2HjjHJav4W4Vieq8vz1w==
YfB3ummdR1nnH76ccuU=
WUy/V9arr3VcEs/ojA==
fBPU4KmK3wBlDS30
hxunqnavTvlMSM3Uq8vz1w==
ghzf17HrEYpei2E=
78NgTrkY0Ipei2E=
0J+r4tEBE5nAdtHNq8vz1w==
BqSzKuQjcs6OxqAis+0=
gR3nFr2l0nb05v2Zc+c=
pEPX3NVN84mbEs/ojA==
/p9uOZnouL98
9pljcFfLF8FJoNVtPoNh
rEpNlYzZYN3vciNlOa3y3w==
Wy//+2nccPokJb6ccuU=
YvzI/vhPsYvHtE2phA==
iDkDMjyp6oDDK/BItOw=
d0tcoj93Hksx716eq8vz1w==
exHeGsrlh5FHupLDcPI=
Mf/U3k7AUPM1K76ccuU=
SO3rV3PRGYpei2E=
Vu3B/KKZ31tUB2dh9kxnVbJOIpEBbQ==
Qbe/PA36PlQgoaUhO7V4
jVFbrcQls7Nby+WrO2cZheSoUXQRQlwZCA==
qjMBLxE5SBVO/2WkTHo/NSE=
ylLXxJ38WSEz9A==
54uN6KXca2j4Jr6ccuU=
WvGpl3XSZm4Yk8PBq8vz1w==
cx8oa2nDUVXnH76ccuU=
OGcX1EgcOR8y7Q==
hFZVkpS9zc+aCB/EW8mdAdBOIpEBbQ==
vmM5aXHcfIkrk55cNKM0800k
bRPY25WH2wzgEVLqfHo/NSE=
fB7g5MMaslqWhQ3RddF2
bjv55Zh5xz/QrxAPeMUAPx4G5RY=
sideust.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exeDelay notice of M.V. KANWAY GLOBALV.2213S.scr.exemstsc.exedescription pid process target process PID 5048 set thread context of 5060 5048 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe PID 5060 set thread context of 2456 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe Explorer.EXE PID 532 set thread context of 2456 532 mstsc.exe Explorer.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3852 5048 WerFault.exe Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe -
Processes:
mstsc.exedescription ioc process Key created \Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exemstsc.exepid process 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2456 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exemstsc.exepid process 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe 532 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exeExplorer.EXEmstsc.exedescription pid process Token: SeDebugPrivilege 5060 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe Token: SeShutdownPrivilege 2456 Explorer.EXE Token: SeCreatePagefilePrivilege 2456 Explorer.EXE Token: SeShutdownPrivilege 2456 Explorer.EXE Token: SeCreatePagefilePrivilege 2456 Explorer.EXE Token: SeShutdownPrivilege 2456 Explorer.EXE Token: SeCreatePagefilePrivilege 2456 Explorer.EXE Token: SeDebugPrivilege 532 mstsc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exeExplorer.EXEmstsc.exedescription pid process target process PID 5048 wrote to memory of 5060 5048 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe PID 5048 wrote to memory of 5060 5048 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe PID 5048 wrote to memory of 5060 5048 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe PID 5048 wrote to memory of 5060 5048 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe PID 5048 wrote to memory of 5060 5048 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe PID 5048 wrote to memory of 5060 5048 Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe PID 2456 wrote to memory of 532 2456 Explorer.EXE mstsc.exe PID 2456 wrote to memory of 532 2456 Explorer.EXE mstsc.exe PID 2456 wrote to memory of 532 2456 Explorer.EXE mstsc.exe PID 532 wrote to memory of 3776 532 mstsc.exe Firefox.exe PID 532 wrote to memory of 3776 532 mstsc.exe Firefox.exe PID 532 wrote to memory of 3776 532 mstsc.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe"C:\Users\Admin\AppData\Local\Temp\Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe"C:\Users\Admin\AppData\Local\Temp\Delay notice of M.V. KANWAY GLOBALV.2213S.scr.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 12763⤵
- Program crash
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 50481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-151-0x00000000007A0000-0x00000000007CD000-memory.dmpFilesize
180KB
-
memory/532-150-0x0000000000160000-0x000000000029A000-memory.dmpFilesize
1.2MB
-
memory/532-147-0x0000000000000000-mapping.dmp
-
memory/532-152-0x0000000002AA0000-0x0000000002DEA000-memory.dmpFilesize
3.3MB
-
memory/532-153-0x00000000028F0000-0x000000000297F000-memory.dmpFilesize
572KB
-
memory/532-155-0x00000000007A0000-0x00000000007CD000-memory.dmpFilesize
180KB
-
memory/2456-156-0x0000000008470000-0x00000000085AD000-memory.dmpFilesize
1.2MB
-
memory/2456-154-0x0000000008470000-0x00000000085AD000-memory.dmpFilesize
1.2MB
-
memory/2456-146-0x00000000080E0000-0x0000000008219000-memory.dmpFilesize
1.2MB
-
memory/5048-137-0x00000000093D0000-0x0000000009436000-memory.dmpFilesize
408KB
-
memory/5048-136-0x0000000009330000-0x00000000093CC000-memory.dmpFilesize
624KB
-
memory/5048-132-0x0000000000A90000-0x0000000000BA2000-memory.dmpFilesize
1.1MB
-
memory/5048-135-0x00000000055E0000-0x00000000055EA000-memory.dmpFilesize
40KB
-
memory/5048-134-0x0000000005530000-0x00000000055C2000-memory.dmpFilesize
584KB
-
memory/5048-133-0x0000000005A40000-0x0000000005FE4000-memory.dmpFilesize
5.6MB
-
memory/5060-144-0x0000000001450000-0x000000000179A000-memory.dmpFilesize
3.3MB
-
memory/5060-149-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5060-148-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/5060-145-0x0000000000E30000-0x0000000000E40000-memory.dmpFilesize
64KB
-
memory/5060-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5060-142-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/5060-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5060-138-0x0000000000000000-mapping.dmp