Analysis
-
max time kernel
164s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 07:57
Static task
static1
Behavioral task
behavioral1
Sample
H5156PJz1rv4wmz.exe
Resource
win7-20221111-en
General
-
Target
H5156PJz1rv4wmz.exe
-
Size
815KB
-
MD5
d0c93e0d31223227c2fc2c0fcaaedc55
-
SHA1
da95e18dc3d6e7ac2cf4cd5d5921f26b4a5ee7f2
-
SHA256
01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7
-
SHA512
6578f8268f52b8aee586db59e1000b4ded52fb84f8c9b45e44112306469217c9467a8abc3002124f4e1ea6f02ba220276b90972f953fcb0883c771dde1ab8376
-
SSDEEP
12288:rSWjCds6ggCGMqJPdmqnHaGg2R31UQjTYTSIg95lvTHRyoY:Hugf+VnHadk1Uu0TSIgvpjRpY
Malware Config
Extracted
formbook
bmr1
q05YNsJC4MpYLGAf4A==
6KUzKCvwX0fwzrFQXvlucw==
KA4ZibW1w+hWN5Q=
TfgNq18tIWtsM7h+DexncQ==
zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==
hopQr+b8KzPIbMWvw0Yxir6cyw==
2thmt+17FR/MVsakbM/+w3xGOhopJw==
5gO5gfA6jwna/4FNSPqrvvHyr2A=
kqtr0wr9KaOXVMyDDexncQ==
PNldyz0Boa5cLGAf4A==
Gysor7fqabd0UzTwWp3Zir6cyw==
pMRgV18gtLorB21prX4=
ukpf+vu2u+hWN5Q=
pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==
4fWGzv347bFNDYJeeIHKG5co
WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1
ZPoM+2U1cwMzteOBsHY=
o8jQoNron4sT3A/KomE=
7QX8tTpv/A+YKw==
wFvmV8SY/A+YKw==
95ZJuruBovPziXkgyca4
DMhVqQXTdWLZcWM3IVNtZg==
Fya6G31VF/eHQ+OBsHY=
Q1AMfbPC2yU1IZV9q4C8vvHyr2A=
fRtdZZssSsG3s6Z7
bxBFLS8FnGv/bdOdDdjmfHz9ww==
0YG+jc1b/A+YKw==
lRliT3IEEDJ4ZoZ8a+7meQ==
dI7SuWbu40M=
Z4oXeMBk6sdDMow=
h5BX2BodM4ChJyEJXWhZEIlmBBTw
cYNHnMHSDHNoFn5XDexncQ==
U4uXeMXGel/Yo5F7JWy7ir6cyw==
w30JX9IHAfmEUkjMfJSh
nyYeAHdAO4ibDfK6+QoHkxDjQ0L/
kRNHMSv9qT1YAOi+/YTEubWayQ==
K84SAQbaiIE2JhEBwkI87fHyr2A=
/TfyyBrkRXG3s6Z7
Xm4DxD9z/A+YKw==
Iiod8GDRqTNm
UQavJOBL1PauNg==
5gHqohpY/A+YKw==
p9NjrOfd7y00suOBsHY=
+QwD0hEcmOH9FrqKOoip
t1ynrb95ITDbVcCcYLbyyYAhz/aC86DP
nsJ4j550C9tdGUvpa9jieQ==
2UyPicBXYsG3s6Z7
JcXRsh7oFKPHNx7+VFi2w/Hyr2A=
3AT+4Rqw0TI3s+OBsHY=
0m73TYSQvcdyP7Khu0w87fHyr2A=
0tyaI3KOu9UtnY5MWuNVKWo=
SXV//PAYkeL6tJB6LnC7ir6cyw==
BZ3ZnFfRqTNm
DIiVdbFCcAQd/3FWhBPOSNDjQ0L/
PzqDVoWG2r6rM5N9histir6cyw==
QFxDG5iTNsm3s6Z7
K07iK1LZc1POTrmDDexncQ==
1WJ3D0tnnQICtizlgdNO55Ii
Y3YBWZCixOhWN5Q=
N1AaNH32m3YaLGAf4A==
2wYTDEnS7XWxVTvMfJSh
Um9jMnNrA+BtRUDMfJSh
8eqyDgzQxuhWN5Q=
JbnNV71HXsW3s6Z7
escortsforme.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
H5156PJz1rv4wmz.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation H5156PJz1rv4wmz.exe -
Loads dropped DLL 1 IoCs
Processes:
help.exepid process 776 help.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
H5156PJz1rv4wmz.exeH5156PJz1rv4wmz.exehelp.exedescription pid process target process PID 1416 set thread context of 1644 1416 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1644 set thread context of 1264 1644 H5156PJz1rv4wmz.exe Explorer.EXE PID 776 set thread context of 1264 776 help.exe Explorer.EXE -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
H5156PJz1rv4wmz.exehelp.exepid process 1644 H5156PJz1rv4wmz.exe 1644 H5156PJz1rv4wmz.exe 1644 H5156PJz1rv4wmz.exe 1644 H5156PJz1rv4wmz.exe 776 help.exe 776 help.exe 776 help.exe 776 help.exe 776 help.exe 776 help.exe 776 help.exe 776 help.exe 776 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
H5156PJz1rv4wmz.exehelp.exepid process 1644 H5156PJz1rv4wmz.exe 1644 H5156PJz1rv4wmz.exe 1644 H5156PJz1rv4wmz.exe 776 help.exe 776 help.exe 776 help.exe 776 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
H5156PJz1rv4wmz.exehelp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1644 H5156PJz1rv4wmz.exe Token: SeDebugPrivilege 776 help.exe Token: SeShutdownPrivilege 1264 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
H5156PJz1rv4wmz.exeExplorer.EXEhelp.exedescription pid process target process PID 1416 wrote to memory of 1644 1416 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1416 wrote to memory of 1644 1416 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1416 wrote to memory of 1644 1416 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1416 wrote to memory of 1644 1416 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1416 wrote to memory of 1644 1416 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1416 wrote to memory of 1644 1416 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1416 wrote to memory of 1644 1416 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1264 wrote to memory of 776 1264 Explorer.EXE help.exe PID 1264 wrote to memory of 776 1264 Explorer.EXE help.exe PID 1264 wrote to memory of 776 1264 Explorer.EXE help.exe PID 1264 wrote to memory of 776 1264 Explorer.EXE help.exe PID 776 wrote to memory of 1868 776 help.exe Firefox.exe PID 776 wrote to memory of 1868 776 help.exe Firefox.exe PID 776 wrote to memory of 1868 776 help.exe Firefox.exe PID 776 wrote to memory of 1868 776 help.exe Firefox.exe PID 776 wrote to memory of 1868 776 help.exe Firefox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\H5156PJz1rv4wmz.exe"C:\Users\Admin\AppData\Local\Temp\H5156PJz1rv4wmz.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\H5156PJz1rv4wmz.exe"C:\Users\Admin\AppData\Local\Temp\H5156PJz1rv4wmz.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1868
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
922KB
MD5dda1b03a5cd2ca37c96b7daf5e3a8ed7
SHA1c70e5f58e61980d39608f0795879bf012dbbbca2
SHA25679f86c1edbbc69652a03a0f5667b3985bcf1e19f16fa3b8c7934e5b97ab8586d
SHA512bf83648c9b5d6d65b2c8409d262a1b7421d2cb13d6c759ec5f352c2d1c5adff3ee2395250fbdfe3590f25fe96bf6b40c2d82a8e7eecaab03be2e6a398e83981f
-
memory/776-73-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB
-
memory/776-74-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/776-75-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/776-76-0x0000000000620000-0x00000000006AF000-memory.dmpFilesize
572KB
-
memory/776-78-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/776-72-0x0000000000000000-mapping.dmp
-
memory/1264-80-0x00000000067E0000-0x0000000006918000-memory.dmpFilesize
1.2MB
-
memory/1264-77-0x00000000067E0000-0x0000000006918000-memory.dmpFilesize
1.2MB
-
memory/1264-71-0x0000000004890000-0x0000000004964000-memory.dmpFilesize
848KB
-
memory/1416-54-0x00000000000F0000-0x00000000001C2000-memory.dmpFilesize
840KB
-
memory/1416-59-0x0000000001FC0000-0x0000000001FF4000-memory.dmpFilesize
208KB
-
memory/1416-58-0x0000000004460000-0x00000000044D0000-memory.dmpFilesize
448KB
-
memory/1416-57-0x0000000000410000-0x000000000041E000-memory.dmpFilesize
56KB
-
memory/1416-56-0x00000000003F0000-0x0000000000406000-memory.dmpFilesize
88KB
-
memory/1416-55-0x0000000075F01000-0x0000000075F03000-memory.dmpFilesize
8KB
-
memory/1644-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1644-70-0x0000000000200000-0x0000000000210000-memory.dmpFilesize
64KB
-
memory/1644-69-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/1644-68-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1644-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1644-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1644-64-0x00000000004012B0-mapping.dmp
-
memory/1644-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1644-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB