Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21-11-2022 15:25
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
459KB
-
MD5
7a51e6b13d6568f50f2bbf7650b09403
-
SHA1
1f3f31636c54f1f021afc372fe7f97d74baaf942
-
SHA256
3a26dd85c2956529f42c1622a093f7b817cbd4af7a474d75198df9e455ac753f
-
SHA512
c0d4fbff3c1e31fa688a558340d850dcb637def55882dfe93620c8c92972757d10ffb1c9e99aa8c08a757d92989e898b4710550fbac7d8a14d777daf02c5c2db
-
SSDEEP
12288:i/4TZ+87mkPFUy0fxws0fkrzza48I5pFhjGdiLyo7Qz+Y2wjVMJ2p:iby05ws0izza486lj8Ol7TY2wBMJ+
Malware Config
Extracted
formbook
f4ca
omFHB5ajfJi1UEIEV9XcoRw=
UBjJkmQPyprdhcFF/bdCWQ==
evGKkBUj1je+otcfpw==
KgvGVeOATSt3nug0BIOm2JvOQycB
Lv6o3K0r9aSjI0lr9fg1txw=
LH1jJb/HieQpsEdqWCQTvX2PmsDVIeg=
99dte0XauJfk6Xv+uQxJFgA1gMktBA==
21FkkGB9gMniDQw2ffu6
r4lKBM/q6TZwVZfS
F+14qHeVWi56KdQ=
BgWXRsVoICMvvQ==
I+EozFl0Uy56KdQ=
xoXCgEllKEbWfjFCCLo=
qo9G1lXvvGt5GkxrLQWw
ORNlYic0PJ2ip4geEFSv
Yj+GFpvFxy0uVYx1fLI/XQ==
XL+veIKPjOTe4fjvFs+n
D2JKVAfuakXCAyoEvw==
voWJU81tH56wvt/vImbCcgVd
dVEcwFrmb8bZ4vXvFs+n
CMlcaOUF6cB+8Bnm2Kc=
NpYV3moXNE+ZQ4f9nVGCSA==
/GRkjGd1acLHyeLvImbCcgVd
R52MlF+Ag+LtFr1QKa7Zf/5a
kVD/mSO1YK75pA==
5q3IANfo/JHiDww2ffu6
4i8RFOH2ACRdhzja
VLWOSRe00XX6sNsijPzqiiWfFgf1J+g=
qnsgRFL46lWG
xo1QHOyKS9rj4fjvFs+n
mIHZlAqzS6ymmpMCU1uyZgE=
WCtjiGCFl/4JTiJ0R60=
c0vpAtZ3fY7TeLfdcnASQg==
Y87Xlic9/1+q3g/pUArVoB4=
kKOsRsf05wBOd67a
dDmgYgOZZ0aCMVwgDha4bgc=
ieXCbvcCyja+otcfpw==
Fd0XQwkTHHaBmNDvImbCcgVd
PK/M6eM8xOwqvw==
Pf0q8MdfICMvvQ==
EO8aPQwf7z2Du+XvImbCcgVd
BeUisSg/Ql6uJcg=
ay2v2pz4gomTESLosQ==
AGjX3ak2B+FyQ9ZKrQ==
Du0y0UXomyoxT4/arA8Du3FvpwE=
xhV7OrDTdonq4fjvFs+n
9+s2xTlaW66p2IAAnVkDQA==
AuS2UeN4Nsvl5vo8J67Zf/5a
B1vK2590RiUuuw==
/709BIUfMCIln8sus2u2aAM=
BMpYckjp699wVZfS
Pf2AqIscEhlpHlnV18IvVQk=
RKUTxUbz/zFroN/LLq+kIdZM
IuuiQ9pj7ZzciLVPiks4Rxc=
0KBn8XAV7NNm2xPxuA==
nv7yBtDj4UNE/ju8er1EZSanBXfyLv4=
sBgf41X1vKTwUspTsg==
5bk4+oQWD+X01tBEqQ==
c08KjxWnau8DDSsESMKNI+P5G/6/sYjU6g==
RJiyeEVj/N3rhNAW3qU=
v6O7hhQxA//+Oyq2ms9DWQ==
7MdHCYCb4OT5pg==
Je0NLgIfKIeFuyjxYD+i
68P+tIkhBdlwVZfS
inthecryptolane.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 8 1940 wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
wscript.exepid process 1940 wscript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
file.exeCasPol.exewscript.exedescription pid process target process PID 564 set thread context of 1820 564 file.exe CasPol.exe PID 1820 set thread context of 1236 1820 CasPol.exe Explorer.EXE PID 1940 set thread context of 1236 1940 wscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
wscript.exedescription ioc process Key created \Registry\User\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
CasPol.exewscript.exepid process 1820 CasPol.exe 1820 CasPol.exe 1820 CasPol.exe 1820 CasPol.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
CasPol.exewscript.exepid process 1820 CasPol.exe 1820 CasPol.exe 1820 CasPol.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe 1940 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
file.exeCasPol.exewscript.exedescription pid process Token: SeDebugPrivilege 564 file.exe Token: SeDebugPrivilege 1820 CasPol.exe Token: SeDebugPrivilege 1940 wscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
file.exeExplorer.EXEwscript.exedescription pid process target process PID 564 wrote to memory of 1820 564 file.exe CasPol.exe PID 564 wrote to memory of 1820 564 file.exe CasPol.exe PID 564 wrote to memory of 1820 564 file.exe CasPol.exe PID 564 wrote to memory of 1820 564 file.exe CasPol.exe PID 564 wrote to memory of 1820 564 file.exe CasPol.exe PID 564 wrote to memory of 1820 564 file.exe CasPol.exe PID 564 wrote to memory of 1820 564 file.exe CasPol.exe PID 1236 wrote to memory of 1940 1236 Explorer.EXE wscript.exe PID 1236 wrote to memory of 1940 1236 Explorer.EXE wscript.exe PID 1236 wrote to memory of 1940 1236 Explorer.EXE wscript.exe PID 1236 wrote to memory of 1940 1236 Explorer.EXE wscript.exe PID 1940 wrote to memory of 1480 1940 wscript.exe Firefox.exe PID 1940 wrote to memory of 1480 1940 wscript.exe Firefox.exe PID 1940 wrote to memory of 1480 1940 wscript.exe Firefox.exe PID 1940 wrote to memory of 1480 1940 wscript.exe Firefox.exe PID 1940 wrote to memory of 1480 1940 wscript.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
890KB
MD58402a6aa76d7787ff03943dd129e3d83
SHA1895338cb761d62930ca93918011fd2cd33d5b30c
SHA25649ff99d5b24f4f7d5a8ea175f35a6548c74b04e5c621c60121b5088dab19b4eb
SHA51239bbe90385be35492825929296aae771fb4afb00a1f6a48f0e4ec17bc1097c3a32cea3b22033116c82695e66acbd6c847483a8da21e7302240467b58e39169ea
-
memory/564-55-0x0000000000C40000-0x0000000000CB6000-memory.dmpFilesize
472KB
-
memory/564-56-0x00000000008A0000-0x0000000000914000-memory.dmpFilesize
464KB
-
memory/564-57-0x00000000024A0000-0x0000000002512000-memory.dmpFilesize
456KB
-
memory/564-54-0x0000000000D10000-0x0000000000D88000-memory.dmpFilesize
480KB
-
memory/1236-66-0x00000000074C0000-0x0000000007649000-memory.dmpFilesize
1.5MB
-
memory/1236-77-0x0000000004980000-0x0000000004A36000-memory.dmpFilesize
728KB
-
memory/1236-74-0x0000000004980000-0x0000000004A36000-memory.dmpFilesize
728KB
-
memory/1820-59-0x00000000004012B0-mapping.dmp
-
memory/1820-62-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1820-64-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/1820-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1820-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1820-69-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1820-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1820-65-0x00000000000B0000-0x00000000000C0000-memory.dmpFilesize
64KB
-
memory/1940-72-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/1940-73-0x0000000001ED0000-0x0000000001F5F000-memory.dmpFilesize
572KB
-
memory/1940-71-0x00000000020A0000-0x00000000023A3000-memory.dmpFilesize
3.0MB
-
memory/1940-75-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/1940-76-0x0000000074AD1000-0x0000000074AD3000-memory.dmpFilesize
8KB
-
memory/1940-70-0x00000000009A0000-0x00000000009C6000-memory.dmpFilesize
152KB
-
memory/1940-67-0x0000000000000000-mapping.dmp