Analysis
-
max time kernel
153s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 07:57
Static task
static1
Behavioral task
behavioral1
Sample
H5156PJz1rv4wmz.exe
Resource
win7-20221111-en
General
-
Target
H5156PJz1rv4wmz.exe
-
Size
815KB
-
MD5
d0c93e0d31223227c2fc2c0fcaaedc55
-
SHA1
da95e18dc3d6e7ac2cf4cd5d5921f26b4a5ee7f2
-
SHA256
01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7
-
SHA512
6578f8268f52b8aee586db59e1000b4ded52fb84f8c9b45e44112306469217c9467a8abc3002124f4e1ea6f02ba220276b90972f953fcb0883c771dde1ab8376
-
SSDEEP
12288:rSWjCds6ggCGMqJPdmqnHaGg2R31UQjTYTSIg95lvTHRyoY:Hugf+VnHadk1Uu0TSIgvpjRpY
Malware Config
Extracted
formbook
bmr1
q05YNsJC4MpYLGAf4A==
6KUzKCvwX0fwzrFQXvlucw==
KA4ZibW1w+hWN5Q=
TfgNq18tIWtsM7h+DexncQ==
zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==
hopQr+b8KzPIbMWvw0Yxir6cyw==
2thmt+17FR/MVsakbM/+w3xGOhopJw==
5gO5gfA6jwna/4FNSPqrvvHyr2A=
kqtr0wr9KaOXVMyDDexncQ==
PNldyz0Boa5cLGAf4A==
Gysor7fqabd0UzTwWp3Zir6cyw==
pMRgV18gtLorB21prX4=
ukpf+vu2u+hWN5Q=
pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==
4fWGzv347bFNDYJeeIHKG5co
WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1
ZPoM+2U1cwMzteOBsHY=
o8jQoNron4sT3A/KomE=
7QX8tTpv/A+YKw==
wFvmV8SY/A+YKw==
95ZJuruBovPziXkgyca4
DMhVqQXTdWLZcWM3IVNtZg==
Fya6G31VF/eHQ+OBsHY=
Q1AMfbPC2yU1IZV9q4C8vvHyr2A=
fRtdZZssSsG3s6Z7
bxBFLS8FnGv/bdOdDdjmfHz9ww==
0YG+jc1b/A+YKw==
lRliT3IEEDJ4ZoZ8a+7meQ==
dI7SuWbu40M=
Z4oXeMBk6sdDMow=
h5BX2BodM4ChJyEJXWhZEIlmBBTw
cYNHnMHSDHNoFn5XDexncQ==
U4uXeMXGel/Yo5F7JWy7ir6cyw==
w30JX9IHAfmEUkjMfJSh
nyYeAHdAO4ibDfK6+QoHkxDjQ0L/
kRNHMSv9qT1YAOi+/YTEubWayQ==
K84SAQbaiIE2JhEBwkI87fHyr2A=
/TfyyBrkRXG3s6Z7
Xm4DxD9z/A+YKw==
Iiod8GDRqTNm
UQavJOBL1PauNg==
5gHqohpY/A+YKw==
p9NjrOfd7y00suOBsHY=
+QwD0hEcmOH9FrqKOoip
t1ynrb95ITDbVcCcYLbyyYAhz/aC86DP
nsJ4j550C9tdGUvpa9jieQ==
2UyPicBXYsG3s6Z7
JcXRsh7oFKPHNx7+VFi2w/Hyr2A=
3AT+4Rqw0TI3s+OBsHY=
0m73TYSQvcdyP7Khu0w87fHyr2A=
0tyaI3KOu9UtnY5MWuNVKWo=
SXV//PAYkeL6tJB6LnC7ir6cyw==
BZ3ZnFfRqTNm
DIiVdbFCcAQd/3FWhBPOSNDjQ0L/
PzqDVoWG2r6rM5N9histir6cyw==
QFxDG5iTNsm3s6Z7
K07iK1LZc1POTrmDDexncQ==
1WJ3D0tnnQICtizlgdNO55Ii
Y3YBWZCixOhWN5Q=
N1AaNH32m3YaLGAf4A==
2wYTDEnS7XWxVTvMfJSh
Um9jMnNrA+BtRUDMfJSh
8eqyDgzQxuhWN5Q=
JbnNV71HXsW3s6Z7
escortsforme.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
H5156PJz1rv4wmz.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation H5156PJz1rv4wmz.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
H5156PJz1rv4wmz.exeH5156PJz1rv4wmz.exechkdsk.exedescription pid process target process PID 1648 set thread context of 2100 1648 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 2100 set thread context of 2616 2100 H5156PJz1rv4wmz.exe Explorer.EXE PID 4652 set thread context of 2616 4652 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
H5156PJz1rv4wmz.exechkdsk.exepid process 2100 H5156PJz1rv4wmz.exe 2100 H5156PJz1rv4wmz.exe 2100 H5156PJz1rv4wmz.exe 2100 H5156PJz1rv4wmz.exe 2100 H5156PJz1rv4wmz.exe 2100 H5156PJz1rv4wmz.exe 2100 H5156PJz1rv4wmz.exe 2100 H5156PJz1rv4wmz.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2616 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
H5156PJz1rv4wmz.exechkdsk.exepid process 2100 H5156PJz1rv4wmz.exe 2100 H5156PJz1rv4wmz.exe 2100 H5156PJz1rv4wmz.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe 4652 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
H5156PJz1rv4wmz.exechkdsk.exedescription pid process Token: SeDebugPrivilege 2100 H5156PJz1rv4wmz.exe Token: SeDebugPrivilege 4652 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
H5156PJz1rv4wmz.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1648 wrote to memory of 2100 1648 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1648 wrote to memory of 2100 1648 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1648 wrote to memory of 2100 1648 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1648 wrote to memory of 2100 1648 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1648 wrote to memory of 2100 1648 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 1648 wrote to memory of 2100 1648 H5156PJz1rv4wmz.exe H5156PJz1rv4wmz.exe PID 2616 wrote to memory of 4652 2616 Explorer.EXE chkdsk.exe PID 2616 wrote to memory of 4652 2616 Explorer.EXE chkdsk.exe PID 2616 wrote to memory of 4652 2616 Explorer.EXE chkdsk.exe PID 4652 wrote to memory of 872 4652 chkdsk.exe Firefox.exe PID 4652 wrote to memory of 872 4652 chkdsk.exe Firefox.exe PID 4652 wrote to memory of 872 4652 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\H5156PJz1rv4wmz.exe"C:\Users\Admin\AppData\Local\Temp\H5156PJz1rv4wmz.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\H5156PJz1rv4wmz.exe"C:\Users\Admin\AppData\Local\Temp\H5156PJz1rv4wmz.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2100 -
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:872
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1648-132-0x0000000000950000-0x0000000000A22000-memory.dmpFilesize
840KB
-
memory/1648-133-0x0000000005930000-0x0000000005ED4000-memory.dmpFilesize
5.6MB
-
memory/1648-134-0x00000000052C0000-0x0000000005352000-memory.dmpFilesize
584KB
-
memory/1648-135-0x0000000005360000-0x000000000536A000-memory.dmpFilesize
40KB
-
memory/1648-136-0x0000000008FE0000-0x000000000907C000-memory.dmpFilesize
624KB
-
memory/2100-144-0x0000000000980000-0x0000000000990000-memory.dmpFilesize
64KB
-
memory/2100-148-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2100-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2100-141-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2100-142-0x0000000000F40000-0x000000000128A000-memory.dmpFilesize
3.3MB
-
memory/2100-137-0x0000000000000000-mapping.dmp
-
memory/2100-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2100-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2616-145-0x0000000007C00000-0x0000000007CD9000-memory.dmpFilesize
868KB
-
memory/2616-153-0x0000000008BD0000-0x0000000008D39000-memory.dmpFilesize
1.4MB
-
memory/2616-155-0x0000000008BD0000-0x0000000008D39000-memory.dmpFilesize
1.4MB
-
memory/4652-146-0x0000000000000000-mapping.dmp
-
memory/4652-149-0x0000000000E10000-0x0000000000E1A000-memory.dmpFilesize
40KB
-
memory/4652-150-0x0000000000CA0000-0x0000000000CCD000-memory.dmpFilesize
180KB
-
memory/4652-151-0x0000000001430000-0x000000000177A000-memory.dmpFilesize
3.3MB
-
memory/4652-152-0x0000000001370000-0x00000000013FF000-memory.dmpFilesize
572KB
-
memory/4652-154-0x0000000000CA0000-0x0000000000CCD000-memory.dmpFilesize
180KB