Analysis
-
max time kernel
212s -
max time network
283s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 15:01
Static task
static1
Behavioral task
behavioral1
Sample
MV ARM TBN - VESSEL PARTICULARS.exe
Resource
win7-20221111-en
General
-
Target
MV ARM TBN - VESSEL PARTICULARS.exe
-
Size
247KB
-
MD5
6d0fd8a2f7410163581e6013d06336bf
-
SHA1
28a2160869dce2cb8623877c6beafa82f019fe37
-
SHA256
3ab9378862ed7e3a174d4b022ed8b38eb0838d24ea2b6543be055552633e50b9
-
SHA512
636bbc44ac34ebe539c9b269d3ef285b99c9da1a47ba8a188da8c848c6f5473f58ec4689bd76cba09eee46104b1e3e323a876c01b392b0ec9ebc7e37a3138853
-
SSDEEP
6144:UYMY+RpZxFZ8Es0cDemuioWg4Dh9KUax4UK3se6Yt+vp57aXrQKBwH:yosUlN36EqkJ8
Malware Config
Extracted
formbook
ermr
ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=
qNSdDhu/PT/1fgafDagiCSZH1SY=
wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=
jSxRvptHkeTGl7PT0SEmaZmjqzanuA==
b91oL+2wCcpyhnd6yvF6Pg==
mr81yp1/qqZX
hy7Xsz/PU/LWHMcGL4UYJx9n3A==
KlwrHt1gouPaXaWhoQ==
ng8M320IRJL9Ptw=
8GQbOXuaWxvKnNM=
XndOL7E5sNpVUNty4d/a
rryPBBC8PybYb+2h2MF3FHGL
kEoeyERSVCYO0g==
5/P+SBDby5hO
1fYXc30/h9W7iO17
34X+YKR+wRFE
8ir/X2MlVByh5lQ1ow8=
u9ikm2UMZ7J7hpCYow==
FLI+c3clp1BNDjVAfvC2Dnw=
t21Erq8/r09wAzAJTAH3Ng==
VAg3gU1KH9uW3YIPAgc=
Gjlc09d6qurdLePSLZktDmGA1A==
MMraOD3ve5odaf+03cB3FHGL
mLRTTAycMcrHgomShQHVwfFKkGQaehvF
fpab65mlchvKnNM=
M6jUQU0omipqaUNXyvF6Pg==
S/XrNQGVvwUsSnKFyvF6Pg==
LeC0GeF2zvCosNtMx5RltjCD
Y+IGYC/XHS63wIus5n08ADN2qzanuA==
3tJus7Rc6OtWnx9y4d/a
4uSOYiXhGxumZcTLuA==
5PyP2thOiIucXaWhoQ==
6978Rw3FNTibYVQ1ow8=
3Ah90lcSVCYO0g==
V/UQWRsOOQjDye9m0cLQ
yRXcMfySzTmEhddhqljeGH8=
vWuKFZKZ48E=
8+UEda631IpZ
LUofBqVNdT/v+MXiEWm90Ape3g==
NCi29RHdDYd7hso=
i36jBdNko/HyUKg1eWYgJx9n3A==
vdblMhHYSkgDmBly4d/a
oQmZH6K31IpZ
fCBHqaFGx9OUMMuBr5GWDXXY5DAT
FDXweHcHVCYO0g==
qSQd9bd7BQavQ9NbcUT+O6e4OGsaehvF
vN98englU4HHzqi36ju/91SJ
prTUIBi6MhiXZFQ1ow8=
w008jVXdCYd7hso=
p1kghFnjD9iADog5cVDmvrDiTjk=
xLjHJFYDQL+ysdk=
6tiR9MZa9xSMXVQ1ow8=
WMzXJPGcyIrP2g==
SeI4PsQ+N/O0iMs=
+4o0lKRDsz+RUqpoBvt3FHGL
AHQG4ZsybzCo8ZlBs1jeGH8=
kIgR46ls4wiGUJZLtFjeGH8=
b/fmPTHIRhvKnNM=
lTL5XnA4eKLb4snpHXt2s/MaSVsHBrU=
psOQcAKjHxyFw0vIwrZ3FHGL
F806xNnby5hO
7t72ZXkhmSAc8xLYD4J2XXc=
Ihmk3OR96/2HSbdi
ea/NKy3VVcx7hpCYow==
ifair.ltd
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\J0HXNX2HU68 = "C:\\Program Files (x86)\\Obdd\\mscff.exe" msiexec.exe -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exeflow pid process 21 1716 msiexec.exe 23 1716 msiexec.exe 24 1716 msiexec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MV ARM TBN - VESSEL PARTICULARS.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation MV ARM TBN - VESSEL PARTICULARS.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 564 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MV ARM TBN - VESSEL PARTICULARS.exeMV ARM TBN - VESSEL PARTICULARS.exemsiexec.exedescription pid process target process PID 1404 set thread context of 1460 1404 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1460 set thread context of 1236 1460 MV ARM TBN - VESSEL PARTICULARS.exe Explorer.EXE PID 1716 set thread context of 1236 1716 msiexec.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Program Files (x86)\Obdd\mscff.exe msiexec.exe -
Processes:
msiexec.exedescription ioc process Key created \Registry\User\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
MV ARM TBN - VESSEL PARTICULARS.exemsiexec.exepid process 1460 MV ARM TBN - VESSEL PARTICULARS.exe 1460 MV ARM TBN - VESSEL PARTICULARS.exe 1460 MV ARM TBN - VESSEL PARTICULARS.exe 1460 MV ARM TBN - VESSEL PARTICULARS.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
MV ARM TBN - VESSEL PARTICULARS.exemsiexec.exepid process 1460 MV ARM TBN - VESSEL PARTICULARS.exe 1460 MV ARM TBN - VESSEL PARTICULARS.exe 1460 MV ARM TBN - VESSEL PARTICULARS.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe 1716 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
MV ARM TBN - VESSEL PARTICULARS.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1460 MV ARM TBN - VESSEL PARTICULARS.exe Token: SeDebugPrivilege 1716 msiexec.exe Token: SeShutdownPrivilege 1236 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
MV ARM TBN - VESSEL PARTICULARS.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1404 wrote to memory of 1460 1404 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1404 wrote to memory of 1460 1404 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1404 wrote to memory of 1460 1404 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1404 wrote to memory of 1460 1404 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1404 wrote to memory of 1460 1404 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1404 wrote to memory of 1460 1404 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1404 wrote to memory of 1460 1404 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1236 wrote to memory of 1716 1236 Explorer.EXE msiexec.exe PID 1236 wrote to memory of 1716 1236 Explorer.EXE msiexec.exe PID 1236 wrote to memory of 1716 1236 Explorer.EXE msiexec.exe PID 1236 wrote to memory of 1716 1236 Explorer.EXE msiexec.exe PID 1236 wrote to memory of 1716 1236 Explorer.EXE msiexec.exe PID 1236 wrote to memory of 1716 1236 Explorer.EXE msiexec.exe PID 1236 wrote to memory of 1716 1236 Explorer.EXE msiexec.exe PID 1716 wrote to memory of 564 1716 msiexec.exe cmd.exe PID 1716 wrote to memory of 564 1716 msiexec.exe cmd.exe PID 1716 wrote to memory of 564 1716 msiexec.exe cmd.exe PID 1716 wrote to memory of 564 1716 msiexec.exe cmd.exe PID 1716 wrote to memory of 388 1716 msiexec.exe Firefox.exe PID 1716 wrote to memory of 388 1716 msiexec.exe Firefox.exe PID 1716 wrote to memory of 388 1716 msiexec.exe Firefox.exe PID 1716 wrote to memory of 388 1716 msiexec.exe Firefox.exe PID 1716 wrote to memory of 388 1716 msiexec.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MV ARM TBN - VESSEL PARTICULARS.exe"C:\Users\Admin\AppData\Local\Temp\MV ARM TBN - VESSEL PARTICULARS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MV ARM TBN - VESSEL PARTICULARS.exe"C:\Users\Admin\AppData\Local\Temp\MV ARM TBN - VESSEL PARTICULARS.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Adds policy Run key to start application
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MV ARM TBN - VESSEL PARTICULARS.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-68-0x0000000000000000-mapping.dmp
-
memory/1236-65-0x0000000007290000-0x000000000742E000-memory.dmpFilesize
1.6MB
-
memory/1236-75-0x0000000007540000-0x0000000007670000-memory.dmpFilesize
1.2MB
-
memory/1236-73-0x0000000007540000-0x0000000007670000-memory.dmpFilesize
1.2MB
-
memory/1404-55-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1404-54-0x00000000001B0000-0x00000000001F4000-memory.dmpFilesize
272KB
-
memory/1460-60-0x0000000000420330-mapping.dmp
-
memory/1460-64-0x0000000000170000-0x0000000000181000-memory.dmpFilesize
68KB
-
memory/1460-63-0x0000000000A10000-0x0000000000D13000-memory.dmpFilesize
3.0MB
-
memory/1460-61-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1460-57-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1460-56-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1716-66-0x0000000000000000-mapping.dmp
-
memory/1716-69-0x00000000007D0000-0x00000000007E4000-memory.dmpFilesize
80KB
-
memory/1716-70-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1716-71-0x00000000021A0000-0x00000000024A3000-memory.dmpFilesize
3.0MB
-
memory/1716-72-0x0000000001F40000-0x0000000001FD0000-memory.dmpFilesize
576KB
-
memory/1716-74-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB