Analysis
-
max time kernel
602s -
max time network
605s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 13:34
Static task
static1
Behavioral task
behavioral1
Sample
c03dca4.exe
Resource
win7-20220812-en
General
-
Target
c03dca4.exe
-
Size
445KB
-
MD5
7d88844c0ef5b442116161e9bc245ccf
-
SHA1
3a30a642d7ea1c0f5144cd5c416c7ea3c251e2e8
-
SHA256
530e856fb2f5665cc8862cf1db3ec2e6cfa8493c1497cf42e1e12121d147eadc
-
SHA512
b489268f1a60371460042730b51e94c4c44c8b4a304b10b7cb229ab043cfff16e09a71d0da5e899229f2bcea7423a5db5990d0dbad39d7a5d382d768fbb791eb
-
SSDEEP
12288:0CrXgPjJwADIOyBnKDUEo14cDnfmCyY4It1:Z7k9wAkAUEo1XnfSI
Malware Config
Extracted
formbook
t5ez
v+YaDdg/udazyV4Iyw==
MXDNPIhw1/8BP0Ud2fguBRZ/8nF6wQ==
WsTRjsGfK1Wt+wjFRn9mBQ==
TrAv42rPyfBfhpI=
2FrznhJCG6bpCgm9+n/Xq0cr
phy0dqeRgaeZzcuciHGgrkeVQw==
DIYHd2O24QEB
wVbxr0eqbQZMc4xwQF1W3NdmR2Xc
ncsN3VitpSp18jvXswKeJeQKA1DW
n/FT0RVVULr7fMV0Ykb8ztU=
OET6wvfsbaGp6O2/Rn9mBQ==
2Rb8gNoGR5GEwAeUhcs=
wR8Fc7imd8/3cQeUhcs=
rMZ/VOtX0kR/yV4Iyw==
9YIUqO7RR4iL5Cffi994
03AHmeAX+2F85Cnfi994
9QbOseAK0/c4SGJW
S1EDywDiYofETA==
ivZm1wDWR2hgAEFURn9mBQ==
D2pe4DygKUJKoLidIuwJo4PiKGhyZLPc
lsi2K1iDFzR6/DpQRn9mBQ==
/zCo4+eL8kJ1yV4Iyw==
1kfBY+RBCT1m+VwZZPOVI6t8wA1HczHT
81hmC3Ca42HdKTbfi994
W4xRYXEE9PBfhpI=
siA43PTcU3xs1CPfi994
0zsdmgMSG3XVIzrfi994
pTbHWY63jr+yAhPiTwr+pWz7O4yIxw==
40Q5rOnbvvBfhpI=
WETydKdfads=
8pAcmjWaC3rtLzTfi994
FaZOEEM/hoOxRg==
4ULAPIZ512Gu5W8a0g==
jwQOo/zas9opMUVQRn9mBQ==
2TKVUoL4B4fpHjbNRn9mBQ==
2kDERo173/XeEB/Li2SKGA==
SpL+hsz60RpBxwX+i0w2wElmR2Xc
OnrLSbomEWWTvQeUhcs=
pLp4Yq2dAYU4SGJW
UXs9ZFSNhN44SGJW
1z6sHLQho6+a9ENQ47HKrkeVQw==
70IFzFKAzleiHG0ahqvDjEkUSw==
TaSBagBq5UJ8+kgFvdcFz9MeTUNHczHT
ib2enpa24QEB
81C0oAh7BHmvLoI8+QP2cjeC8nF6wQ==
8/ixkr/ovvM4SGJW
drytJ25jZp2m6PrDMyhACg==
zUjbhwt3cPFmuweUhcs=
pPZe9mWJWb/EGGHHEXX+jEw1
pP7jRswuOb8ovC3tZcZw
DEicjM21q/t27kYRBxL6y9U=
i9Ez3NII0vc4SGJW
YZ9vOVxK0R1KhR7nJ8Q=
7nXra6S24QEB
9oa3ksDptus4SGJW
e95lEZlG8jEc
Y9XSXM1DwRtMeoBA9+QBnyXt8nF6wQ==
QWOEKI3lBrQ4SGJW
qdRvL0cmBrU4SGJW
beRsKEx5zCVxyV4Iyw==
8F5azgPlvh9iXm1NxX5w
HVEX5Gqc8xUJPVJVmoepYTCDQQ==
gA4r3GvUO5ejyV4Iyw==
tfBCGkQZ42OmwsWUis1zGK49eYk=
darkchocolatebliss.com
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
chkdsk.exepid process 1452 chkdsk.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
c03dca4.exeCasPol.exechkdsk.exedescription pid process target process PID 1980 set thread context of 1944 1980 c03dca4.exe CasPol.exe PID 1944 set thread context of 1284 1944 CasPol.exe Explorer.EXE PID 1944 set thread context of 1284 1944 CasPol.exe Explorer.EXE PID 1452 set thread context of 1284 1452 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
CasPol.exechkdsk.exepid process 1944 CasPol.exe 1944 CasPol.exe 1944 CasPol.exe 1944 CasPol.exe 1944 CasPol.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
CasPol.exechkdsk.exepid process 1944 CasPol.exe 1944 CasPol.exe 1944 CasPol.exe 1944 CasPol.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe 1452 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
CasPol.exechkdsk.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1944 CasPol.exe Token: SeDebugPrivilege 1452 chkdsk.exe Token: SeShutdownPrivilege 1284 Explorer.EXE Token: SeShutdownPrivilege 1284 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
c03dca4.exeCasPol.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1980 wrote to memory of 1944 1980 c03dca4.exe CasPol.exe PID 1980 wrote to memory of 1944 1980 c03dca4.exe CasPol.exe PID 1980 wrote to memory of 1944 1980 c03dca4.exe CasPol.exe PID 1980 wrote to memory of 1944 1980 c03dca4.exe CasPol.exe PID 1980 wrote to memory of 1944 1980 c03dca4.exe CasPol.exe PID 1980 wrote to memory of 1944 1980 c03dca4.exe CasPol.exe PID 1980 wrote to memory of 1944 1980 c03dca4.exe CasPol.exe PID 1944 wrote to memory of 1452 1944 CasPol.exe chkdsk.exe PID 1944 wrote to memory of 1452 1944 CasPol.exe chkdsk.exe PID 1944 wrote to memory of 1452 1944 CasPol.exe chkdsk.exe PID 1944 wrote to memory of 1452 1944 CasPol.exe chkdsk.exe PID 1284 wrote to memory of 1664 1284 Explorer.EXE raserver.exe PID 1284 wrote to memory of 1664 1284 Explorer.EXE raserver.exe PID 1284 wrote to memory of 1664 1284 Explorer.EXE raserver.exe PID 1284 wrote to memory of 1664 1284 Explorer.EXE raserver.exe PID 1452 wrote to memory of 548 1452 chkdsk.exe Firefox.exe PID 1452 wrote to memory of 548 1452 chkdsk.exe Firefox.exe PID 1452 wrote to memory of 548 1452 chkdsk.exe Firefox.exe PID 1452 wrote to memory of 548 1452 chkdsk.exe Firefox.exe PID 1452 wrote to memory of 548 1452 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c03dca4.exe"C:\Users\Admin\AppData\Local\Temp\c03dca4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"4⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
810KB
MD5c6ec991471d42128268ea10236d9cdb8
SHA1d569350d02db6a118136220da8de40a9973084f1
SHA2561b755cc3093dd45a0df857854aedfeb3c8f3622cff5bc491f2d492ebfa3ef8e0
SHA512a67ed46547b9270c8a5a7a947b375cb6baf3211072f90170aae2bb6ce9c4fe9d7be3e9d782420dcfdbc19a1f232b3be561ca503b80e8dc3e036a62c54cad5b57
-
memory/1284-74-0x00000000041C0000-0x0000000004291000-memory.dmpFilesize
836KB
-
memory/1284-79-0x00000000071A0000-0x0000000007273000-memory.dmpFilesize
844KB
-
memory/1284-67-0x00000000041C0000-0x0000000004291000-memory.dmpFilesize
836KB
-
memory/1284-64-0x0000000006B70000-0x0000000006CB6000-memory.dmpFilesize
1.3MB
-
memory/1284-76-0x00000000071A0000-0x0000000007273000-memory.dmpFilesize
844KB
-
memory/1452-75-0x0000000000520000-0x00000000005AF000-memory.dmpFilesize
572KB
-
memory/1452-70-0x0000000000000000-mapping.dmp
-
memory/1452-77-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1452-73-0x0000000002220000-0x0000000002523000-memory.dmpFilesize
3.0MB
-
memory/1452-72-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1452-78-0x0000000076031000-0x0000000076033000-memory.dmpFilesize
8KB
-
memory/1452-71-0x0000000000E10000-0x0000000000E17000-memory.dmpFilesize
28KB
-
memory/1944-62-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB
-
memory/1944-69-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1944-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1944-66-0x0000000000110000-0x0000000000120000-memory.dmpFilesize
64KB
-
memory/1944-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1944-63-0x00000000000D0000-0x00000000000E0000-memory.dmpFilesize
64KB
-
memory/1944-60-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1944-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1944-57-0x00000000004012B0-mapping.dmp
-
memory/1944-56-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1980-54-0x0000000000940000-0x00000000009B4000-memory.dmpFilesize
464KB
-
memory/1980-55-0x0000000000580000-0x00000000005F2000-memory.dmpFilesize
456KB