Analysis
-
max time kernel
187s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:27
Static task
static1
Behavioral task
behavioral1
Sample
Order#6122-001.exe
Resource
win7-20221111-en
General
-
Target
Order#6122-001.exe
-
Size
1.1MB
-
MD5
dee22604ff5c70b766d186f787dc6bfb
-
SHA1
77c102d3dad8675d05666f0738e9afe251ef23a3
-
SHA256
3e3615ec6c5ef753c75fc1448d7e5a49136e3c7b5d2016e107107f17c4816aa6
-
SHA512
e5447732ac879ddd70d747c4c395dc5d1f91f302c198046f2b1ad4a8ddd70469b15f56aaa2eeda777a54e2f699a70d7f1ea5ff2afa003b263483569462fe6299
-
SSDEEP
24576:t33GJYDtv4SSrA/40YyxTLLd7qK/PGm24EYPF8h0B1bqdOp:tGupvv2AhYC/B2Wr24VF8h0vbqdO
Malware Config
Extracted
formbook
n2hm
XCeG4IxNKbAl
YzJWbnC+El84nA==
KAJcdmP8yEcO5LXPCFF42Wfb
I+J+xYO95GJQWVU=
GtgxPPv3FmQmhw==
Og9NYF4xEl+j7vGTR93xvg==
506Cg07bsT0G6yK+A96H0h35V+JLkwI=
wAYXFN+pSFIXgQ==
ijzLI/f+FmQmhw==
UfT2PweNm+w8
GQWVw5aZnfF/kS5e
30BKYjua9zcA7gAwsPUngLnjyrBNEgo=
AM65OrmyFmQmhw==
VSlTVxISZ4J/kS5e
GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==
B9H98cUUfX+AWOqiTA==
MxVffWOIoVnM37zrd2sTaOY=
z6bxCgG/mGhR7oDzQA==
pQgSLSRi6AK3M/PdArpX
6rRRsYuSnXx/kS5e
tJRNn0ias3Yw
7c4NEQLSp/R/kS5e
TJmwu5Aa/IuRHtoXXQ==
TLoRUygkiJQE5GoRji0aff0=
Y83qB/DsQFYeZzahj6pYqw==
Bup2q3PHFmQmhw==
cDTa78WEWaYMdoDdArpX
28Rw4MRMnjT52raaTR5KhtMJYa8=
WydpZS7v/4XubCZuhkdxP2OAKdyK68u6
B+osKudaL8yAV/K/VAH3T+Q=
qVz9Y0QD3TGeM/PdArpX
+r49VzlFXLpFegdyc4q5ow==
gsXk990afa1hl6ATTA==
XkblOQWRaet/kS5e
4TNPSf2OcfNk9cfPCFF42Wfb
NaIIUEoRdKYr
ITSqBfn5FmQmhw==
KPRUmWnqxVE0hERFtyo=
VLzd1qk6E5wNcQ49KnmhAoT3Ok5roMK4kQ==
65jM2pKJ8EIST04=
I3+JoYVgYgDiv3O15Ntvw0On/sJroMK4kQ==
C+YhNzH20aCpy8MqVw==
yBZRl4HdPn+RHtoXXQ==
pGQATg0mMfntSBR9c4q5ow==
YUKFixIRdKYr
Hv+C4cZTOMAKV+/dArpX
MVW+PJpyCVA=
FX2AJYBFYbgk
/cX1CsjSpvU+
fWoThWagDVhBHt4yMjWQifM=
/vCd69xrS8QwuCt/yD8=
GvAsSzbCRxplG582TKzVug==
S6zlGfJ6DFc4TBNUvig=
k0z/QwnTpfR/kS5e
KPofKfkPcoRqxowFuWWNhvM=
Xrj+JvENc3yBln4OUw==
ScTatpYj/IKRHtoXXQ==
vLRdwbLyTpzFn+dAR93xvg==
mLTJe/eFp2kxl69W
Cbr5/dRQbio2P/e8ay0aff0=
xooviWn51V7DI7mMOwWT4lCIJUlf
l0t7fTmLqSCAuIYIVA==
06xFejwYMSkbfETTiNT21O0=
bWzTF+1nS4kxlydW
madamkikkiey.net
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Order#6122-001.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Order#6122-001.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Order#6122-001.exeOrder#6122-001.execontrol.exedescription pid process target process PID 536 set thread context of 1908 536 Order#6122-001.exe Order#6122-001.exe PID 1908 set thread context of 2632 1908 Order#6122-001.exe Explorer.EXE PID 4508 set thread context of 2632 4508 control.exe Explorer.EXE -
Processes:
control.exedescription ioc process Key created \Registry\User\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
Order#6122-001.exeOrder#6122-001.execontrol.exepid process 536 Order#6122-001.exe 536 Order#6122-001.exe 1908 Order#6122-001.exe 1908 Order#6122-001.exe 1908 Order#6122-001.exe 1908 Order#6122-001.exe 1908 Order#6122-001.exe 1908 Order#6122-001.exe 1908 Order#6122-001.exe 1908 Order#6122-001.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2632 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Order#6122-001.execontrol.exepid process 1908 Order#6122-001.exe 1908 Order#6122-001.exe 1908 Order#6122-001.exe 4508 control.exe 4508 control.exe 4508 control.exe 4508 control.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
Order#6122-001.exeOrder#6122-001.execontrol.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 536 Order#6122-001.exe Token: SeDebugPrivilege 1908 Order#6122-001.exe Token: SeDebugPrivilege 4508 control.exe Token: SeShutdownPrivilege 2632 Explorer.EXE Token: SeCreatePagefilePrivilege 2632 Explorer.EXE Token: SeShutdownPrivilege 2632 Explorer.EXE Token: SeCreatePagefilePrivilege 2632 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 2632 Explorer.EXE 2632 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Order#6122-001.exeExplorer.EXEcontrol.exedescription pid process target process PID 536 wrote to memory of 4416 536 Order#6122-001.exe Order#6122-001.exe PID 536 wrote to memory of 4416 536 Order#6122-001.exe Order#6122-001.exe PID 536 wrote to memory of 4416 536 Order#6122-001.exe Order#6122-001.exe PID 536 wrote to memory of 1908 536 Order#6122-001.exe Order#6122-001.exe PID 536 wrote to memory of 1908 536 Order#6122-001.exe Order#6122-001.exe PID 536 wrote to memory of 1908 536 Order#6122-001.exe Order#6122-001.exe PID 536 wrote to memory of 1908 536 Order#6122-001.exe Order#6122-001.exe PID 536 wrote to memory of 1908 536 Order#6122-001.exe Order#6122-001.exe PID 536 wrote to memory of 1908 536 Order#6122-001.exe Order#6122-001.exe PID 2632 wrote to memory of 4508 2632 Explorer.EXE control.exe PID 2632 wrote to memory of 4508 2632 Explorer.EXE control.exe PID 2632 wrote to memory of 4508 2632 Explorer.EXE control.exe PID 4508 wrote to memory of 3608 4508 control.exe Firefox.exe PID 4508 wrote to memory of 3608 4508 control.exe Firefox.exe PID 4508 wrote to memory of 3608 4508 control.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order#6122-001.exe"C:\Users\Admin\AppData\Local\Temp\Order#6122-001.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order#6122-001.exe"C:\Users\Admin\AppData\Local\Temp\Order#6122-001.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Order#6122-001.exe"C:\Users\Admin\AppData\Local\Temp\Order#6122-001.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/536-132-0x0000000000940000-0x0000000000A68000-memory.dmpFilesize
1.2MB
-
memory/536-133-0x0000000005970000-0x0000000005F14000-memory.dmpFilesize
5.6MB
-
memory/536-134-0x0000000005460000-0x00000000054F2000-memory.dmpFilesize
584KB
-
memory/536-135-0x0000000005410000-0x000000000541A000-memory.dmpFilesize
40KB
-
memory/536-136-0x00000000093B0000-0x000000000944C000-memory.dmpFilesize
624KB
-
memory/1908-138-0x0000000000000000-mapping.dmp
-
memory/1908-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1908-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1908-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1908-143-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1908-144-0x0000000001400000-0x000000000174A000-memory.dmpFilesize
3.3MB
-
memory/1908-145-0x0000000001390000-0x00000000013A0000-memory.dmpFilesize
64KB
-
memory/2632-152-0x0000000002CD0000-0x0000000002D92000-memory.dmpFilesize
776KB
-
memory/2632-146-0x00000000029D0000-0x0000000002A8A000-memory.dmpFilesize
744KB
-
memory/2632-154-0x0000000002CD0000-0x0000000002D92000-memory.dmpFilesize
776KB
-
memory/4416-137-0x0000000000000000-mapping.dmp
-
memory/4508-148-0x0000000000C90000-0x0000000000CB7000-memory.dmpFilesize
156KB
-
memory/4508-150-0x0000000002640000-0x000000000298A000-memory.dmpFilesize
3.3MB
-
memory/4508-151-0x0000000002990000-0x0000000002A1F000-memory.dmpFilesize
572KB
-
memory/4508-149-0x0000000000590000-0x00000000005BD000-memory.dmpFilesize
180KB
-
memory/4508-153-0x0000000000590000-0x00000000005BD000-memory.dmpFilesize
180KB
-
memory/4508-147-0x0000000000000000-mapping.dmp