Analysis
-
max time kernel
152s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:52
Static task
static1
Behavioral task
behavioral1
Sample
9YPS0Z3E3FXg0EB.exe
Resource
win7-20221111-en
General
-
Target
9YPS0Z3E3FXg0EB.exe
-
Size
690KB
-
MD5
c697ea68b7fbd24afb372ca479d48031
-
SHA1
aa26ceae317672587df112a62771d46a03fdf8c1
-
SHA256
69aa2e3cac902f024d6bb90201fc3703bc8c0501a2c7885b56ac4767e5f41c3c
-
SHA512
84e787006ac0698034ae1d8e6e0ea2b2e71f5ccb20fe0fddc27522c7c0a2a943e228b90e0a9c28e9cb59d26bcee4589efbce5d1922ef60260ec8d6309ae3a988
-
SSDEEP
12288:UcYA6GhOWYx/M+4ZUO5GVr/CSh8oJFKNIayQofjSCYmZJbxpDF:vYpKN5qrKI8o/3aI+CY
Malware Config
Extracted
formbook
bmr1
q05YNsJC4MpYLGAf4A==
6KUzKCvwX0fwzrFQXvlucw==
KA4ZibW1w+hWN5Q=
TfgNq18tIWtsM7h+DexncQ==
zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==
hopQr+b8KzPIbMWvw0Yxir6cyw==
2thmt+17FR/MVsakbM/+w3xGOhopJw==
5gO5gfA6jwna/4FNSPqrvvHyr2A=
kqtr0wr9KaOXVMyDDexncQ==
PNldyz0Boa5cLGAf4A==
Gysor7fqabd0UzTwWp3Zir6cyw==
pMRgV18gtLorB21prX4=
ukpf+vu2u+hWN5Q=
pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==
4fWGzv347bFNDYJeeIHKG5co
WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1
ZPoM+2U1cwMzteOBsHY=
o8jQoNron4sT3A/KomE=
7QX8tTpv/A+YKw==
wFvmV8SY/A+YKw==
95ZJuruBovPziXkgyca4
DMhVqQXTdWLZcWM3IVNtZg==
Fya6G31VF/eHQ+OBsHY=
Q1AMfbPC2yU1IZV9q4C8vvHyr2A=
fRtdZZssSsG3s6Z7
bxBFLS8FnGv/bdOdDdjmfHz9ww==
0YG+jc1b/A+YKw==
lRliT3IEEDJ4ZoZ8a+7meQ==
dI7SuWbu40M=
Z4oXeMBk6sdDMow=
h5BX2BodM4ChJyEJXWhZEIlmBBTw
cYNHnMHSDHNoFn5XDexncQ==
U4uXeMXGel/Yo5F7JWy7ir6cyw==
w30JX9IHAfmEUkjMfJSh
nyYeAHdAO4ibDfK6+QoHkxDjQ0L/
kRNHMSv9qT1YAOi+/YTEubWayQ==
K84SAQbaiIE2JhEBwkI87fHyr2A=
/TfyyBrkRXG3s6Z7
Xm4DxD9z/A+YKw==
Iiod8GDRqTNm
UQavJOBL1PauNg==
5gHqohpY/A+YKw==
p9NjrOfd7y00suOBsHY=
+QwD0hEcmOH9FrqKOoip
t1ynrb95ITDbVcCcYLbyyYAhz/aC86DP
nsJ4j550C9tdGUvpa9jieQ==
2UyPicBXYsG3s6Z7
JcXRsh7oFKPHNx7+VFi2w/Hyr2A=
3AT+4Rqw0TI3s+OBsHY=
0m73TYSQvcdyP7Khu0w87fHyr2A=
0tyaI3KOu9UtnY5MWuNVKWo=
SXV//PAYkeL6tJB6LnC7ir6cyw==
BZ3ZnFfRqTNm
DIiVdbFCcAQd/3FWhBPOSNDjQ0L/
PzqDVoWG2r6rM5N9histir6cyw==
QFxDG5iTNsm3s6Z7
K07iK1LZc1POTrmDDexncQ==
1WJ3D0tnnQICtizlgdNO55Ii
Y3YBWZCixOhWN5Q=
N1AaNH32m3YaLGAf4A==
2wYTDEnS7XWxVTvMfJSh
Um9jMnNrA+BtRUDMfJSh
8eqyDgzQxuhWN5Q=
JbnNV71HXsW3s6Z7
escortsforme.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 7 1116 msiexec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9YPS0Z3E3FXg0EB.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation 9YPS0Z3E3FXg0EB.exe -
Loads dropped DLL 1 IoCs
Processes:
msiexec.exepid process 1116 msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9YPS0Z3E3FXg0EB.exe9YPS0Z3E3FXg0EB.exemsiexec.exedescription pid process target process PID 1324 set thread context of 540 1324 9YPS0Z3E3FXg0EB.exe 9YPS0Z3E3FXg0EB.exe PID 540 set thread context of 1276 540 9YPS0Z3E3FXg0EB.exe Explorer.EXE PID 1116 set thread context of 1276 1116 msiexec.exe Explorer.EXE -
Processes:
msiexec.exedescription ioc process Key created \Registry\User\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
9YPS0Z3E3FXg0EB.exemsiexec.exepid process 540 9YPS0Z3E3FXg0EB.exe 540 9YPS0Z3E3FXg0EB.exe 540 9YPS0Z3E3FXg0EB.exe 540 9YPS0Z3E3FXg0EB.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
9YPS0Z3E3FXg0EB.exemsiexec.exepid process 540 9YPS0Z3E3FXg0EB.exe 540 9YPS0Z3E3FXg0EB.exe 540 9YPS0Z3E3FXg0EB.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe 1116 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
9YPS0Z3E3FXg0EB.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 540 9YPS0Z3E3FXg0EB.exe Token: SeDebugPrivilege 1116 msiexec.exe Token: SeShutdownPrivilege 1276 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
9YPS0Z3E3FXg0EB.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1324 wrote to memory of 540 1324 9YPS0Z3E3FXg0EB.exe 9YPS0Z3E3FXg0EB.exe PID 1324 wrote to memory of 540 1324 9YPS0Z3E3FXg0EB.exe 9YPS0Z3E3FXg0EB.exe PID 1324 wrote to memory of 540 1324 9YPS0Z3E3FXg0EB.exe 9YPS0Z3E3FXg0EB.exe PID 1324 wrote to memory of 540 1324 9YPS0Z3E3FXg0EB.exe 9YPS0Z3E3FXg0EB.exe PID 1324 wrote to memory of 540 1324 9YPS0Z3E3FXg0EB.exe 9YPS0Z3E3FXg0EB.exe PID 1324 wrote to memory of 540 1324 9YPS0Z3E3FXg0EB.exe 9YPS0Z3E3FXg0EB.exe PID 1324 wrote to memory of 540 1324 9YPS0Z3E3FXg0EB.exe 9YPS0Z3E3FXg0EB.exe PID 1276 wrote to memory of 1116 1276 Explorer.EXE msiexec.exe PID 1276 wrote to memory of 1116 1276 Explorer.EXE msiexec.exe PID 1276 wrote to memory of 1116 1276 Explorer.EXE msiexec.exe PID 1276 wrote to memory of 1116 1276 Explorer.EXE msiexec.exe PID 1276 wrote to memory of 1116 1276 Explorer.EXE msiexec.exe PID 1276 wrote to memory of 1116 1276 Explorer.EXE msiexec.exe PID 1276 wrote to memory of 1116 1276 Explorer.EXE msiexec.exe PID 1116 wrote to memory of 1864 1116 msiexec.exe Firefox.exe PID 1116 wrote to memory of 1864 1116 msiexec.exe Firefox.exe PID 1116 wrote to memory of 1864 1116 msiexec.exe Firefox.exe PID 1116 wrote to memory of 1864 1116 msiexec.exe Firefox.exe PID 1116 wrote to memory of 1864 1116 msiexec.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9YPS0Z3E3FXg0EB.exe"C:\Users\Admin\AppData\Local\Temp\9YPS0Z3E3FXg0EB.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9YPS0Z3E3FXg0EB.exe"C:\Users\Admin\AppData\Local\Temp\9YPS0Z3E3FXg0EB.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
949KB
MD538a3e021eb32c9976adaf0b3372080fc
SHA168e02803c646be21007d90bec841c176b82211fd
SHA2568cde0275d60da0d11954f73c7c8862cfc4b306f61bb8b1ce14abe4a193af2652
SHA512b886cc112f2750e7300b66f7242850659fa49fdc97f75aed376cb9f5440875f303a143bf8b51068ec42674f1ebe1dfcc40534f3a7aed3cc4d20f9274b9a66d18
-
memory/540-68-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/540-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/540-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/540-69-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/540-70-0x0000000000170000-0x0000000000180000-memory.dmpFilesize
64KB
-
memory/540-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/540-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/540-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/540-64-0x00000000004012B0-mapping.dmp
-
memory/1116-79-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1116-72-0x0000000000000000-mapping.dmp
-
memory/1116-77-0x0000000001EF0000-0x0000000001F7F000-memory.dmpFilesize
572KB
-
memory/1116-76-0x0000000002160000-0x0000000002463000-memory.dmpFilesize
3.0MB
-
memory/1116-75-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1116-74-0x0000000000A70000-0x0000000000A84000-memory.dmpFilesize
80KB
-
memory/1276-78-0x0000000004D00000-0x0000000004DD1000-memory.dmpFilesize
836KB
-
memory/1276-71-0x0000000004440000-0x0000000004523000-memory.dmpFilesize
908KB
-
memory/1276-80-0x0000000004D00000-0x0000000004DD1000-memory.dmpFilesize
836KB
-
memory/1324-58-0x0000000004E10000-0x0000000004E80000-memory.dmpFilesize
448KB
-
memory/1324-59-0x0000000005C00000-0x0000000005C34000-memory.dmpFilesize
208KB
-
memory/1324-55-0x0000000075F51000-0x0000000075F53000-memory.dmpFilesize
8KB
-
memory/1324-56-0x0000000000880000-0x0000000000898000-memory.dmpFilesize
96KB
-
memory/1324-54-0x0000000000E80000-0x0000000000F32000-memory.dmpFilesize
712KB
-
memory/1324-57-0x00000000003B0000-0x00000000003BC000-memory.dmpFilesize
48KB