Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 12:47
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe
-
Size
446KB
-
MD5
26810d567e2c0bdcba316e23db1e94fe
-
SHA1
85b7121630abf4ce123cb9356af84919b4131a5e
-
SHA256
268b4b1d198ff77105bd88629138c10e89449a0c405af87e00bbdb039643acb0
-
SHA512
5ffa18334b5e59231a141f91e6d8ad2e946d1e06694a99ed26e8b259fef8a87eefdf84783c9b5572cb53b8110b86e37f8d221c467233310c149b9ed78b156ae4
-
SSDEEP
12288:EGEaxyIEHBzQE3u9AavxuAA39anZYuo7t:3WBOAuxA9aZYuc
Malware Config
Extracted
formbook
t5ez
v+YaDdg/udazyV4Iyw==
MXDNPIhw1/8BP0Ud2fguBRZ/8nF6wQ==
WsTRjsGfK1Wt+wjFRn9mBQ==
TrAv42rPyfBfhpI=
2FrznhJCG6bpCgm9+n/Xq0cr
phy0dqeRgaeZzcuciHGgrkeVQw==
DIYHd2O24QEB
wVbxr0eqbQZMc4xwQF1W3NdmR2Xc
ncsN3VitpSp18jvXswKeJeQKA1DW
n/FT0RVVULr7fMV0Ykb8ztU=
OET6wvfsbaGp6O2/Rn9mBQ==
2Rb8gNoGR5GEwAeUhcs=
wR8Fc7imd8/3cQeUhcs=
rMZ/VOtX0kR/yV4Iyw==
9YIUqO7RR4iL5Cffi994
03AHmeAX+2F85Cnfi994
9QbOseAK0/c4SGJW
S1EDywDiYofETA==
ivZm1wDWR2hgAEFURn9mBQ==
D2pe4DygKUJKoLidIuwJo4PiKGhyZLPc
lsi2K1iDFzR6/DpQRn9mBQ==
/zCo4+eL8kJ1yV4Iyw==
1kfBY+RBCT1m+VwZZPOVI6t8wA1HczHT
81hmC3Ca42HdKTbfi994
W4xRYXEE9PBfhpI=
siA43PTcU3xs1CPfi994
0zsdmgMSG3XVIzrfi994
pTbHWY63jr+yAhPiTwr+pWz7O4yIxw==
40Q5rOnbvvBfhpI=
WETydKdfads=
8pAcmjWaC3rtLzTfi994
FaZOEEM/hoOxRg==
4ULAPIZ512Gu5W8a0g==
jwQOo/zas9opMUVQRn9mBQ==
2TKVUoL4B4fpHjbNRn9mBQ==
2kDERo173/XeEB/Li2SKGA==
SpL+hsz60RpBxwX+i0w2wElmR2Xc
OnrLSbomEWWTvQeUhcs=
pLp4Yq2dAYU4SGJW
UXs9ZFSNhN44SGJW
1z6sHLQho6+a9ENQ47HKrkeVQw==
70IFzFKAzleiHG0ahqvDjEkUSw==
TaSBagBq5UJ8+kgFvdcFz9MeTUNHczHT
ib2enpa24QEB
81C0oAh7BHmvLoI8+QP2cjeC8nF6wQ==
8/ixkr/ovvM4SGJW
drytJ25jZp2m6PrDMyhACg==
zUjbhwt3cPFmuweUhcs=
pPZe9mWJWb/EGGHHEXX+jEw1
pP7jRswuOb8ovC3tZcZw
DEicjM21q/t27kYRBxL6y9U=
i9Ez3NII0vc4SGJW
YZ9vOVxK0R1KhR7nJ8Q=
7nXra6S24QEB
9oa3ksDptus4SGJW
e95lEZlG8jEc
Y9XSXM1DwRtMeoBA9+QBnyXt8nF6wQ==
QWOEKI3lBrQ4SGJW
qdRvL0cmBrU4SGJW
beRsKEx5zCVxyV4Iyw==
8F5azgPlvh9iXm1NxX5w
HVEX5Gqc8xUJPVJVmoepYTCDQQ==
gA4r3GvUO5ejyV4Iyw==
tfBCGkQZ42OmwsWUis1zGK49eYk=
darkchocolatebliss.com
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
wlanext.exepid process 2044 wlanext.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exeCasPol.exewlanext.exedescription pid process target process PID 900 set thread context of 1684 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 1684 set thread context of 1192 1684 CasPol.exe Explorer.EXE PID 1684 set thread context of 1192 1684 CasPol.exe Explorer.EXE PID 2044 set thread context of 1192 2044 wlanext.exe Explorer.EXE -
Processes:
wlanext.exedescription ioc process Key created \Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wlanext.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exeCasPol.exewlanext.exepid process 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe 1684 CasPol.exe 1684 CasPol.exe 1684 CasPol.exe 1684 CasPol.exe 1684 CasPol.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
CasPol.exewlanext.exepid process 1684 CasPol.exe 1684 CasPol.exe 1684 CasPol.exe 1684 CasPol.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exeCasPol.exewlanext.exedescription pid process Token: SeDebugPrivilege 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe Token: SeDebugPrivilege 1684 CasPol.exe Token: SeDebugPrivilege 2044 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exeExplorer.EXEwlanext.exedescription pid process target process PID 900 wrote to memory of 1852 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 900 wrote to memory of 1852 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 900 wrote to memory of 1852 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 900 wrote to memory of 1852 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 900 wrote to memory of 1684 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 900 wrote to memory of 1684 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 900 wrote to memory of 1684 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 900 wrote to memory of 1684 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 900 wrote to memory of 1684 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 900 wrote to memory of 1684 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 900 wrote to memory of 1684 900 SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe CasPol.exe PID 1192 wrote to memory of 2044 1192 Explorer.EXE wlanext.exe PID 1192 wrote to memory of 2044 1192 Explorer.EXE wlanext.exe PID 1192 wrote to memory of 2044 1192 Explorer.EXE wlanext.exe PID 1192 wrote to memory of 2044 1192 Explorer.EXE wlanext.exe PID 2044 wrote to memory of 1008 2044 wlanext.exe Firefox.exe PID 2044 wrote to memory of 1008 2044 wlanext.exe Firefox.exe PID 2044 wrote to memory of 1008 2044 wlanext.exe Firefox.exe PID 2044 wrote to memory of 1008 2044 wlanext.exe Firefox.exe PID 2044 wrote to memory of 1008 2044 wlanext.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.18962.7585.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
841KB
MD55fc6cd5d5ca1489d2a3c361717359a95
SHA15c630e232cd5761e7a611e41515be4afa3e7a141
SHA25685c8b8a648c56cf5f063912e0e26ecebb90e0caf2f442fd5cdd8287301fe7e81
SHA5125f9124a721f6b463d4f980920e87925098aa753b0fa2a59a3ff48b48d2b1a45d760fd46445414d84fb66321181cd2c82a4194361811114c15e35b42f838ab792
-
memory/900-55-0x0000000000630000-0x00000000006A2000-memory.dmpFilesize
456KB
-
memory/900-54-0x0000000000F20000-0x0000000000F94000-memory.dmpFilesize
464KB
-
memory/1192-67-0x0000000004C90000-0x0000000004DDA000-memory.dmpFilesize
1.3MB
-
memory/1192-76-0x0000000004C90000-0x0000000004DDA000-memory.dmpFilesize
1.3MB
-
memory/1192-79-0x0000000004EA0000-0x0000000004FD1000-memory.dmpFilesize
1.2MB
-
memory/1192-75-0x0000000004EA0000-0x0000000004FD1000-memory.dmpFilesize
1.2MB
-
memory/1192-64-0x0000000004BC0000-0x0000000004C83000-memory.dmpFilesize
780KB
-
memory/1684-60-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1684-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1684-66-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/1684-63-0x00000000000B0000-0x00000000000C0000-memory.dmpFilesize
64KB
-
memory/1684-62-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/1684-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1684-70-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1684-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1684-57-0x00000000004012B0-mapping.dmp
-
memory/1684-56-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2044-68-0x0000000000000000-mapping.dmp
-
memory/2044-74-0x0000000000800000-0x000000000088F000-memory.dmpFilesize
572KB
-
memory/2044-73-0x0000000000A40000-0x0000000000D43000-memory.dmpFilesize
3.0MB
-
memory/2044-77-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/2044-78-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/2044-72-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/2044-71-0x0000000000F50000-0x0000000000F66000-memory.dmpFilesize
88KB