Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 02:39
Static task
static1
Behavioral task
behavioral1
Sample
0x0007000000013a3b-63.exe
Resource
win7-20220812-en
General
-
Target
0x0007000000013a3b-63.exe
-
Size
1.0MB
-
MD5
4960f9773333e5239226ca3a86e974e9
-
SHA1
a5eefef24d0586abd0457acb6cb8246057574d67
-
SHA256
6d62d493cae6daf08828e14fc36c0dba18e7eb7f75ca390ec5d21ae0b3d2c9a3
-
SHA512
4292c12fb5ac12e2d70c0849fc0697319faeea35123d435a597753de4cf801b4ef219940080d5484dca16a1a1c2ec771b73d030b37b5b93e79610dafec51ac2c
-
SSDEEP
12288:SvE7XguFSxqtLAWaDjb9fyxZqZKa5aRW4+QlpYidxDF/3gKavwI0iVWErqsM1pnU:H5KjZwZNxRL9dPPgrYI0Iomd+zrE
Malware Config
Extracted
formbook
h9nc
b6D0eLl/P/Ry1A==
KnXQBVoh1YK69G/dNR0pblRJIg==
WnXFkXyACqjtAumHng==
G0eU+2nD4Hul/C12
7TSYGZRY3obqxfiSusm2GLKO7zs=
rKv1H4dXCeB4dIWkDod0
kJHsAWgJMtQx2XbWOE50pGw=
9glV052OFiKdAumHng==
xiWAGAArojjC4Qlwk7dsq4N+0GTOyTQ=
1dUgKYkXDs1c54VvhAC4IL0a4DY=
//E2NG867Y/MH8x206eKnQ==
BQd1aNJsP/Ry1A==
kOMaJH4YPB4903g=
zOhJx2nSgFXV
3OUrp42pL88bb/+B06eKnQ==
bM5EoP21XTZ7psNQgQ==
BWG/kYrHtD9dmyigBbFamA==
BRlnZVmlrU14Zo/6Nmr9dVxHIg==
4fdR0rjKc0t78Ww/Z0DQAMWm9Ts=
Lh9p82obtozdHSNv
lNUaqpSrXwMdUc1TdaSKxa0WdIB7xyo=
Jfv1aOt2P/Ry1A==
9RFxryn/s1m33fwfVvurC+BQ
c6L/NfnfcmQVBidy
IwZr6WUt6Yzm5fp3k7nR79C7Gpt1L+zu
PzJ1aa8VApHYcxe85PoANdsEZbJIiDw=
Cj6P3zqt7I+qY2uNsFNp2GO9MA==
PjyOHAAowmy88JFehDPO1XOodDM=
m64VV89EYgSDqbm157g8gWQ=
Iyp0+47zDd0i3PXkQnINEeFY
sQ6JpCC47MQX197j/3kvVuc7Us7Y
goHTa19x9WPaVerf+aOOznOodDM=
AwVjGBYO0m+QUcqc2ujb42+ceTk=
wQts8Hg5w2bsFthdhw==
pAhh4cYTNVJMqWE=
eHyIyYoPP9c/UoDP9x6sHbrc67uARQ==
bagIBQZOdFJMqWE=
dscX0dXIONgaAiiL0G9DTyx9VKNY4tSZaw==
HTSGGBIgliRWO2fO8w3EwppxzmTOyTQ=
jh8daSkx3w5V33w=
7h1hP0gR2Ge/jfNge7HB1nOodDM=
JmPQVL489nyeZWc=
Ig9cltmVsVfX
i9A0MyFpMg42W+zR8bg8gWQ=
6xdyifmhZpStPkKBiQ==
EkGI/uT/kClyYYWkDod0
OH/jVUJmj5PHc24=
X4ToZ0Cj1YC8cJSkDod0
opvvM75CckmLqJequuJ8
DyKGSUE5rTdnS3He8yQ+vE7IKg==
oqsSU7yA6PeOk5akDod0
lbsZ/eIvKOQkWtlgiLaFKaUPLnI3tS3m
RG7b5kf0yIzdHSNv
MUeqMu81K6+PLdh+nA==
0f5g9W0Snjd+vEf9Kd2ltXzbxk67fUDr
iOY0RqASON32xvtLgP6rC+BQ
r5r8Tno79xZP2Xw=
C2feL3Ydu47dHSNv
P4vDZVoRl190ww==
JTGFJBhFy2OG75+q5Lg8gWQ=
4CuLhc5LfVCoepFs342Lig==
9NY7E/dLeUfLVP/c8Lg8gWQ=
Dymc5lrH9wog8idy
ARZkUEKJvZogxH9HZVCtt30=
joewhitepsychology.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0x0007000000013a3b-63.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation 0x0007000000013a3b-63.exe -
Loads dropped DLL 1 IoCs
Processes:
explorer.exepid process 1808 explorer.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
0x0007000000013a3b-63.exe0x0007000000013a3b-63.exeexplorer.exedescription pid process target process PID 1976 set thread context of 2032 1976 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 2032 set thread context of 1232 2032 0x0007000000013a3b-63.exe Explorer.EXE PID 1808 set thread context of 1232 1808 explorer.exe Explorer.EXE -
Processes:
explorer.exedescription ioc process Key created \Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
0x0007000000013a3b-63.exeexplorer.exepid process 2032 0x0007000000013a3b-63.exe 2032 0x0007000000013a3b-63.exe 2032 0x0007000000013a3b-63.exe 2032 0x0007000000013a3b-63.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
0x0007000000013a3b-63.exeexplorer.exepid process 2032 0x0007000000013a3b-63.exe 2032 0x0007000000013a3b-63.exe 2032 0x0007000000013a3b-63.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0x0007000000013a3b-63.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2032 0x0007000000013a3b-63.exe Token: SeDebugPrivilege 1808 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
0x0007000000013a3b-63.exeExplorer.EXEexplorer.exedescription pid process target process PID 1976 wrote to memory of 2032 1976 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 1976 wrote to memory of 2032 1976 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 1976 wrote to memory of 2032 1976 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 1976 wrote to memory of 2032 1976 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 1976 wrote to memory of 2032 1976 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 1976 wrote to memory of 2032 1976 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 1976 wrote to memory of 2032 1976 0x0007000000013a3b-63.exe 0x0007000000013a3b-63.exe PID 1232 wrote to memory of 1808 1232 Explorer.EXE explorer.exe PID 1232 wrote to memory of 1808 1232 Explorer.EXE explorer.exe PID 1232 wrote to memory of 1808 1232 Explorer.EXE explorer.exe PID 1232 wrote to memory of 1808 1232 Explorer.EXE explorer.exe PID 1808 wrote to memory of 1940 1808 explorer.exe Firefox.exe PID 1808 wrote to memory of 1940 1808 explorer.exe Firefox.exe PID 1808 wrote to memory of 1940 1808 explorer.exe Firefox.exe PID 1808 wrote to memory of 1940 1808 explorer.exe Firefox.exe PID 1808 wrote to memory of 1940 1808 explorer.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\0x0007000000013a3b-63.exe"C:\Users\Admin\AppData\Local\Temp\0x0007000000013a3b-63.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\0x0007000000013a3b-63.exe"C:\Users\Admin\AppData\Local\Temp\0x0007000000013a3b-63.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1940
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
1.0MB
MD5ce5c15b5092877974d5b6476ad1cb2d7
SHA176a6fc307d1524081cba1886d312df97c9dd658f
SHA2561f1a186ea26bd2462ea2a9cf35a816b92caf0897fdf332af3a61569e0ba97b24
SHA512bb9ced38c63d2a29e18c38f60020cfdf0161384cd4ad6328352626643becdf49f6b4bef47012391720344fdd8ad520aa802dcbbed15b5026d27eb93b0a839c90
-
memory/1232-72-0x0000000006280000-0x00000000063EF000-memory.dmpFilesize
1.4MB
-
memory/1232-80-0x0000000007380000-0x00000000074D0000-memory.dmpFilesize
1.3MB
-
memory/1232-81-0x0000000006280000-0x00000000063EF000-memory.dmpFilesize
1.4MB
-
memory/1232-83-0x0000000007380000-0x00000000074D0000-memory.dmpFilesize
1.3MB
-
memory/1808-79-0x00000000025B0000-0x000000000263F000-memory.dmpFilesize
572KB
-
memory/1808-77-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/1808-75-0x00000000748A1000-0x00000000748A3000-memory.dmpFilesize
8KB
-
memory/1808-73-0x0000000000000000-mapping.dmp
-
memory/1808-78-0x00000000022A0000-0x00000000025A3000-memory.dmpFilesize
3.0MB
-
memory/1808-82-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/1808-76-0x00000000007B0000-0x0000000000A31000-memory.dmpFilesize
2.5MB
-
memory/1976-57-0x0000000000390000-0x00000000003A8000-memory.dmpFilesize
96KB
-
memory/1976-56-0x0000000002210000-0x00000000022AA000-memory.dmpFilesize
616KB
-
memory/1976-58-0x00000000003B0000-0x00000000003BC000-memory.dmpFilesize
48KB
-
memory/1976-60-0x00000000004A0000-0x00000000004E2000-memory.dmpFilesize
264KB
-
memory/1976-55-0x00000000754E1000-0x00000000754E3000-memory.dmpFilesize
8KB
-
memory/1976-59-0x00000000057F0000-0x000000000586C000-memory.dmpFilesize
496KB
-
memory/1976-54-0x0000000000C40000-0x0000000000D4A000-memory.dmpFilesize
1.0MB
-
memory/2032-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-71-0x00000000001A0000-0x00000000001B0000-memory.dmpFilesize
64KB
-
memory/2032-70-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/2032-69-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2032-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-65-0x00000000004012B0-mapping.dmp
-
memory/2032-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB