Analysis
-
max time kernel
175s -
max time network
217s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 16:24
Static task
static1
Behavioral task
behavioral1
Sample
Advice Ref SCA1Sv2.exe
Resource
win7-20220812-en
General
-
Target
Advice Ref SCA1Sv2.exe
-
Size
1.0MB
-
MD5
36cffbbe00ff9dd2a5c813d43dc2749b
-
SHA1
80a003e052f3cdc9bd10803882c198684bff8574
-
SHA256
97a6db96fa0467a8cbe068fe3b09b0c03c2be85e2902503464e3af90e4e80af1
-
SHA512
b417c23df1a8c0fa2860d59d6886230b4648f66eb4ba269cc2514570a0f8b3bbee4cd653b0543ef3b07a02b6c52c657665303add260b6c1093e277a990ba089e
-
SSDEEP
12288:WU2EIn2uWBQmER9Ai2flfLO/caYVT/XG4Vcfe+y/qv2q7KqRmZ4dUpkD0bxMMJPc:WRWBQLKNkcfvHcfe+y/qvjG7xMMJ1q
Malware Config
Extracted
formbook
8ch8
EpMcJgRhXLgnbGVS1w==
PT1CWj241lPTuYLqz4cMQug=
iW5zo5XTlCyvPyc0hZ+/Ww==
3TiaoYnZM2R/2Jxzj/YY/wSb
gmIzUUXL9Y9CJH1OhZ+/Ww==
TdhX816H2NfWDDA8zg==
hrO4y8wSaEd20IZmhZ+/Ww==
hpV3JYmIC104sSI=
OO5xgWfn6pzCBp3kOas=
wJJtjXKWWuN0B4D/Zq+h+MJnVA==
cG5OST1xygeTEXTwN+gtU+o=
DEkjtjWwSl04sSI=
4jIoyEKj+0h76T8=
CBgIFRBAneBly2N666Yv0uI=
q7/M5ri8J104sSI=
X3FOWUW6vIeYk2QMLPV/GR/KuJlO71Nn
Pk5Xbmm7K2oM390ILKE=
AJLzkApAgKHYDDA8zg==
Z1BN4jzHtGx8ZiKO2DMnznIiArHLh6E=
1WnEWMU1nd7aSQ==
JqQyQBihE0zUPqkQM+gtU+o=
s/PS78pFNpY4EmA7hZ+/Ww==
SWiErouLCl04sSI=
Mb4bry5wsMXSsmfNII+Z+MJnVA==
Yvtl/FGH0abFKd0ILKE=
dR2Vr3XriJPALd0ILKE=
u4n2keJV8yhGLdVY3KMY/wSb
FMwUvyqN+9nyb08olHiY+MJnVA==
kvjd9oUCJY7HQw==
rUKqP6ctwBS/p30ZHN8t
O3xge7O+fuZ1
IEkfinlEnd7aSQ==
Y/BsBlfJd3Bvr/xe4OgtU+o=
6SgCGfYs8JlGwIJmhZ+/Ww==
pWyqV841nd7aSQ==
S6KwUMIz3/MMfkovSqSf+MJnVA==
jgh3FnS8KnYEbin+VDDfBZVCDLHLh6E=
VfRR0ze4kzzeSQPuOOgtU+o=
MQjV8e4WwSqaI90ILKE=
4qIWxDppoJKdJfbYw3WKQdCT
NqDoGxVNtLF4RP9u7ak=
sCuAK6wTf3E4tCg=
7n4HEvEjB9O9a0lFzA==
h3xYc0iHaAD+HCwBY1keUw==
Mvzcddwf4ocDPyuO
BUEaqyBq379i4z0=
FXB8J5gEfKc4uydkmGAbvpq0OBSJ
m9LA5+Mo+njxx4LwR5Z/r7qoRSaQ
Sxr7i/ZkuBDJ9NI52Q==
nqCPmLkBGt/6amJEdb8=
qqaMnYu3Tvf49mtalYqRQg==
q7yisJERcJzJJxX6NegtU+o=
0VHGbdpItPKtpH0ZHN8t
6TUiRhZeWb/sUA==
QYRAUmAgY6iu8To=
2hjc+NQzSdBr9oqM
D3ozRUKuSF04sSI=
Ati37d9hggmhklnOUhmpR3ISv03gucNi
ljzEYeUpE9zwN+nROOgtU+o=
BFKnQbHnJjpFjko5hZ+/Ww==
1VDU28sN9cTpRfToIdkv0oUzArHLh6E=
t+zsd/s/h6zeDDA8zg==
7ko/WzOy1mckGW06V7Cl+MJnVA==
nAdIaz8bUVCC/Ms22Q==
poricityhotel.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Advice Ref SCA1Sv2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Advice Ref SCA1Sv2.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Advice Ref SCA1Sv2.exeAdvice Ref SCA1Sv2.exechkdsk.exedescription pid process target process PID 3552 set thread context of 4336 3552 Advice Ref SCA1Sv2.exe Advice Ref SCA1Sv2.exe PID 4336 set thread context of 512 4336 Advice Ref SCA1Sv2.exe Explorer.EXE PID 3756 set thread context of 512 3756 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
Advice Ref SCA1Sv2.exechkdsk.exepid process 4336 Advice Ref SCA1Sv2.exe 4336 Advice Ref SCA1Sv2.exe 4336 Advice Ref SCA1Sv2.exe 4336 Advice Ref SCA1Sv2.exe 4336 Advice Ref SCA1Sv2.exe 4336 Advice Ref SCA1Sv2.exe 4336 Advice Ref SCA1Sv2.exe 4336 Advice Ref SCA1Sv2.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 512 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Advice Ref SCA1Sv2.exechkdsk.exepid process 4336 Advice Ref SCA1Sv2.exe 4336 Advice Ref SCA1Sv2.exe 4336 Advice Ref SCA1Sv2.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe 3756 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Advice Ref SCA1Sv2.exechkdsk.exedescription pid process Token: SeDebugPrivilege 4336 Advice Ref SCA1Sv2.exe Token: SeDebugPrivilege 3756 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Advice Ref SCA1Sv2.exeExplorer.EXEchkdsk.exedescription pid process target process PID 3552 wrote to memory of 4336 3552 Advice Ref SCA1Sv2.exe Advice Ref SCA1Sv2.exe PID 3552 wrote to memory of 4336 3552 Advice Ref SCA1Sv2.exe Advice Ref SCA1Sv2.exe PID 3552 wrote to memory of 4336 3552 Advice Ref SCA1Sv2.exe Advice Ref SCA1Sv2.exe PID 3552 wrote to memory of 4336 3552 Advice Ref SCA1Sv2.exe Advice Ref SCA1Sv2.exe PID 3552 wrote to memory of 4336 3552 Advice Ref SCA1Sv2.exe Advice Ref SCA1Sv2.exe PID 3552 wrote to memory of 4336 3552 Advice Ref SCA1Sv2.exe Advice Ref SCA1Sv2.exe PID 512 wrote to memory of 3756 512 Explorer.EXE chkdsk.exe PID 512 wrote to memory of 3756 512 Explorer.EXE chkdsk.exe PID 512 wrote to memory of 3756 512 Explorer.EXE chkdsk.exe PID 3756 wrote to memory of 1088 3756 chkdsk.exe Firefox.exe PID 3756 wrote to memory of 1088 3756 chkdsk.exe Firefox.exe PID 3756 wrote to memory of 1088 3756 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\Advice Ref SCA1Sv2.exe"C:\Users\Admin\AppData\Local\Temp\Advice Ref SCA1Sv2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\Advice Ref SCA1Sv2.exe"C:\Users\Admin\AppData\Local\Temp\Advice Ref SCA1Sv2.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4336 -
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1088
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/512-155-0x0000000003240000-0x00000000032DD000-memory.dmpFilesize
628KB
-
memory/512-145-0x0000000008BF0000-0x0000000008D48000-memory.dmpFilesize
1.3MB
-
memory/512-153-0x0000000003240000-0x00000000032DD000-memory.dmpFilesize
628KB
-
memory/3552-135-0x0000000005920000-0x000000000592A000-memory.dmpFilesize
40KB
-
memory/3552-136-0x0000000009500000-0x000000000959C000-memory.dmpFilesize
624KB
-
memory/3552-132-0x0000000000DE0000-0x0000000000EEE000-memory.dmpFilesize
1.1MB
-
memory/3552-134-0x0000000005870000-0x0000000005902000-memory.dmpFilesize
584KB
-
memory/3552-133-0x0000000005D20000-0x00000000062C4000-memory.dmpFilesize
5.6MB
-
memory/3756-149-0x0000000000E20000-0x0000000000E2A000-memory.dmpFilesize
40KB
-
memory/3756-154-0x00000000009C0000-0x00000000009ED000-memory.dmpFilesize
180KB
-
memory/3756-152-0x0000000001330000-0x00000000013BF000-memory.dmpFilesize
572KB
-
memory/3756-151-0x00000000013F0000-0x000000000173A000-memory.dmpFilesize
3.3MB
-
memory/3756-146-0x0000000000000000-mapping.dmp
-
memory/3756-150-0x00000000009C0000-0x00000000009ED000-memory.dmpFilesize
180KB
-
memory/4336-137-0x0000000000000000-mapping.dmp
-
memory/4336-148-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4336-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4336-144-0x0000000000DA0000-0x0000000000DB0000-memory.dmpFilesize
64KB
-
memory/4336-143-0x00000000013D0000-0x000000000171A000-memory.dmpFilesize
3.3MB
-
memory/4336-141-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4336-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4336-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB