Analysis
-
max time kernel
148s -
max time network
185s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 05:18
Static task
static1
Behavioral task
behavioral1
Sample
kCGCNKYCnqgQSEJ.exe
Resource
win7-20221111-en
General
-
Target
kCGCNKYCnqgQSEJ.exe
-
Size
552KB
-
MD5
e823afd1e909b794b2f2602ecadd15cc
-
SHA1
4c6d24c796faebc2b54f981e2f8127187b08aa4b
-
SHA256
33709e54333a4b6cc832c1cfbc3eae6d7c256642931f2fb6e47d26bb2d191cfa
-
SHA512
8a45b1d0910ad632a73f3d23d5c3dc63f745ffb3e318c91f4826a80666c983d5308abec58f708749124a84e101c97f6302ad3c2320016cbc18bfe8092a9e20b1
-
SSDEEP
6144:KoLEvklriDeOCH0IG0ocHtIgzH7R4u8pHrjstXlTna84yMDFqrnHKzYPrAV3+go4:FGqGNoC4P8Lj87QyMUjHZi3+U49jq
Malware Config
Extracted
formbook
rjwn
03o7kR/VYOT8r06ry8Ku
nhzRGt5dmI+rX14=
fxLQJLh1IdH3jGuZ1KBvy/sK4Q==
GAU9GqrQnwWRKMfS7KTmrg==
xyidkidiZ/CAIrOchLc38Ckd
qpaUZjfKUOAKBI+C1Q==
tn919W/lRcHaoraZK53frA==
zEQOdA3OY/EHnYvF7KTmrg==
MJALDhT0sw68hUTcnNMUVI/EiWY=
FwpKMs0PRYvGVxbSy3mxZtw=
9IBBwo1zU45kK0M=
baAZGqfBu1HmiS0OWuM38Ckd
+fUxM/QxXJmvPfzwdUI=
WZYOXSolDIEOz9lzR0c4UAA71p19tw==
n6Hftzs+TYbFBI+C1Q==
UdyBA9GXFou2hZJ1/W9ihcM=
jrgyH63jDVl3Rg3KVAhYg8M=
74f/sGdLgw0RrxLszsOs
rivUOgDVVdIGBI+C1Q==
eZ0hfm//kK/IgQ==
cOyWB9nBcLJgIe6MJJvysw==
uuQW3nDB5zE515iu7KTmrg==
kFZItj/PTXLXvV/8
SdWV6XEb4CxVA9IKhEeUMtU=
ZA7+YCScoo5kK0M=
xxqaB+Xv22QHm3sV5tiojr32e5kr
we10urhAkK/IgQ==
xHIjiT/6dZAk5qwj/e66jNIRzmJfb+4=
tpqPy81EkK/IgQ==
H/oAAuNh2mF6Ee0gmT6EHyc21p19tw==
DhpG0lPF+kwtG+IoGEo=
rkbubjj5dfvXvV/8
MhD5hGFD1uWFOUCE+nhi4kjTm2c=
28ayIatEvUVU/vmry8Ku
44uffAYW0BW/e0qry8Ku
+oQ4mmlmUY5kK0M=
9z2xkR1bUs1K3oWu7KTmrg==
m2db2VOl9S+XaWJdMWOm
73QkNsjpCEltIvzwdUI=
sW9l0ms9+T7Wk2Pxyr0ESkjTm2c=
dQm1EeTrtAeTJQO1n6oFSkjTm2c=
MMqG+Lp7YV/khkury8Ku
caIijU4NhQUdwBwjf1U=
DenkusP7awDXvV/8
rd9aXuDl1m4GqU5/Cr4sLQEL6Q==
j+BfT9DNkYp7KVQ=
imNRxEzwW8rcoVSry8Ku
UwClcUVdKmf8
2Uz8cjgFrA2TJcXS7KTmrg==
6WYjegWsL8PUjJGv3FOjIUjTm2c=
t0L8aveKFCI216+je6z3sA==
iroxmGIq0Rm3d0ury8Ku
YHi4soTzVY65ziSry8Ku
neFeYuPHd7n+v7uxi80sLQEL6Q==
jfm1IeWzNK22a2qCfLwqLQEL6Q==
LF/Hwz0h2Su9cGUbBgT1BFFqRl8ug/iX
pZvZ78UYM3U+0H4B0xRqVR0S5H/8vw==
rcQA7r4oVYmULtrS7KTmrg==
RX73/YB1XulzJPzwdUI=
EZ5jwEvwdgkluZiw1KBvy/sK4Q==
+5ytLx8LkZDGBI+C1Q==
N+/jWNuSgsXZhw==
6dXR+ICNgA2vR/xdkd0lMsgV
Qsh6jhYVA5YvtYwqAQk38Ckd
volpiventure.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
kCGCNKYCnqgQSEJ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation kCGCNKYCnqgQSEJ.exe -
Loads dropped DLL 1 IoCs
Processes:
colorcpl.exepid process 1960 colorcpl.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
kCGCNKYCnqgQSEJ.exekCGCNKYCnqgQSEJ.execolorcpl.exedescription pid process target process PID 952 set thread context of 584 952 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 584 set thread context of 1204 584 kCGCNKYCnqgQSEJ.exe Explorer.EXE PID 1960 set thread context of 1204 1960 colorcpl.exe Explorer.EXE -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
kCGCNKYCnqgQSEJ.execolorcpl.exepid process 584 kCGCNKYCnqgQSEJ.exe 584 kCGCNKYCnqgQSEJ.exe 584 kCGCNKYCnqgQSEJ.exe 584 kCGCNKYCnqgQSEJ.exe 1960 colorcpl.exe 1960 colorcpl.exe 1960 colorcpl.exe 1960 colorcpl.exe 1960 colorcpl.exe 1960 colorcpl.exe 1960 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
kCGCNKYCnqgQSEJ.execolorcpl.exepid process 584 kCGCNKYCnqgQSEJ.exe 584 kCGCNKYCnqgQSEJ.exe 584 kCGCNKYCnqgQSEJ.exe 1960 colorcpl.exe 1960 colorcpl.exe 1960 colorcpl.exe 1960 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
kCGCNKYCnqgQSEJ.execolorcpl.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 584 kCGCNKYCnqgQSEJ.exe Token: SeDebugPrivilege 1960 colorcpl.exe Token: SeShutdownPrivilege 1204 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
kCGCNKYCnqgQSEJ.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 952 wrote to memory of 584 952 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 952 wrote to memory of 584 952 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 952 wrote to memory of 584 952 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 952 wrote to memory of 584 952 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 952 wrote to memory of 584 952 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 952 wrote to memory of 584 952 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 952 wrote to memory of 584 952 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 1204 wrote to memory of 1960 1204 Explorer.EXE colorcpl.exe PID 1204 wrote to memory of 1960 1204 Explorer.EXE colorcpl.exe PID 1204 wrote to memory of 1960 1204 Explorer.EXE colorcpl.exe PID 1204 wrote to memory of 1960 1204 Explorer.EXE colorcpl.exe PID 1960 wrote to memory of 2040 1960 colorcpl.exe Firefox.exe PID 1960 wrote to memory of 2040 1960 colorcpl.exe Firefox.exe PID 1960 wrote to memory of 2040 1960 colorcpl.exe Firefox.exe PID 1960 wrote to memory of 2040 1960 colorcpl.exe Firefox.exe PID 1960 wrote to memory of 2040 1960 colorcpl.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\kCGCNKYCnqgQSEJ.exe"C:\Users\Admin\AppData\Local\Temp\kCGCNKYCnqgQSEJ.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\kCGCNKYCnqgQSEJ.exe"C:\Users\Admin\AppData\Local\Temp\kCGCNKYCnqgQSEJ.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:584 -
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2040
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
820KB
MD5317ba2f8e624ec0c7d3714e2bde4f346
SHA112734675cfad66d78252515644a624964f69f94d
SHA2560c2093493424e885c297d613e0cf343d8a084253ca3b044415e14c6e94696877
SHA512ecc4a6f951cd7958288b7de35b253475fcc0910f5385b0b38db872a412b547ef5d8e7056865d26ae46b3b027d8b0bb37aa25ec6cb1a67abd342799795bfd3b08
-
memory/584-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/584-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/584-68-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/584-69-0x0000000000940000-0x0000000000C43000-memory.dmpFilesize
3.0MB
-
memory/584-70-0x0000000000120000-0x0000000000130000-memory.dmpFilesize
64KB
-
memory/584-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/584-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/584-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/584-64-0x00000000004012B0-mapping.dmp
-
memory/952-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB
-
memory/952-56-0x0000000000360000-0x0000000000376000-memory.dmpFilesize
88KB
-
memory/952-59-0x0000000000910000-0x0000000000944000-memory.dmpFilesize
208KB
-
memory/952-58-0x00000000050A0000-0x0000000005110000-memory.dmpFilesize
448KB
-
memory/952-57-0x0000000000390000-0x000000000039E000-memory.dmpFilesize
56KB
-
memory/952-54-0x00000000013B0000-0x000000000143A000-memory.dmpFilesize
552KB
-
memory/1204-78-0x00000000063D0000-0x0000000006511000-memory.dmpFilesize
1.3MB
-
memory/1204-71-0x0000000006240000-0x00000000063C5000-memory.dmpFilesize
1.5MB
-
memory/1204-80-0x00000000063D0000-0x0000000006511000-memory.dmpFilesize
1.3MB
-
memory/1960-79-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1960-77-0x0000000001E80000-0x0000000001F0F000-memory.dmpFilesize
572KB
-
memory/1960-76-0x0000000002180000-0x0000000002483000-memory.dmpFilesize
3.0MB
-
memory/1960-75-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1960-74-0x0000000000A60000-0x0000000000A78000-memory.dmpFilesize
96KB
-
memory/1960-72-0x0000000000000000-mapping.dmp