Analysis
-
max time kernel
165s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 13:33
Static task
static1
Behavioral task
behavioral1
Sample
PRODUCTS LIST INQUIRY.exe
Resource
win7-20221111-en
General
-
Target
PRODUCTS LIST INQUIRY.exe
-
Size
833KB
-
MD5
62dbf29de2b765943525b45e080c168a
-
SHA1
cd40c7a3ae6d2c6e2c7436eb5da2407d84f6cc7b
-
SHA256
52b739a0edc9a1a008131eedb6b9385e6aa99ea46e15ab65fa7e1045ec6908e2
-
SHA512
4059ebb5665670ba140a14aad5996407fe843bb19491b9f10a00e423c5e1332a8a325dd8fa4e438418d5ef1a451d749b19506c18cae4218161b140346d780a54
-
SSDEEP
12288:IckyiUw4N8guVN4P9OCEqrK40DafmmiVR2mqrYy6FjmaZgKZ/nXt7virmWhlGLak:bkyiN4GPVN4P9OFqu40DRRmY
Malware Config
Extracted
formbook
0vh9
kT0Usm0+fHGF7CkiArMh/tpf8d/XmQE=
0fmX7QILD44W+4BvafbZzOs=
cu0K8dW1ampaxA==
mMUbaeih2AfncJFGQQ==
hbUGHyjFfvGHWhfdzKFAKACZFug=
yjwyDLSAuuQScZpTEt/p0g==
QVOuL9rCqaSZBDn18NM=
80J9zt627lL0
dRXhSLjVSYyE2g==
QuSd7Qu7JmkOkqOTf9gC4P5d322R+Ak=
TGmyjSzk7VR50A==
Per96I1KSYyE2g==
smg9xW2N/NH8O5xPQw==
epfEwPC7ggR37cX39cc=
s2tPNeqhoGyRpCQevaVh
0HJrO9mYxtjW0m+nEfbZzOs=
9ppmyuPh6JiKX+17X/bZzOs=
wrxE0u6FSNp5RtFYT83Yj+s2sz4kyg==
y4FnMsyMjUo7DqoovqLXyw==
tWNC35fFQyZe1Mt7fAQyHuycNOs=
LkPEYuLzgcxDq6xSEt/p0g==
tEDkQVEFc0g1O5xPQw==
vlt3HHDbR5p0YdGSWw==
K+UO41DfEQ0uiXOxBijXTeM=
s2E+EhJEePRzYuXWlqNKnEBD
vz9jPdr4zPvSuGvl
NqVtAraE0NHCu2TYDqrjzw==
VfTgwXZASYyE2g==
HjRiL86Mm9LzeZZOSw==
rssRFz8DZJ8MW1+gX2jvYO0=
0I6jmUt8MjYyncmDfgExHQCZFug=
rcXrnEZ6KTBh3MX39cc=
fUttTKBXziC5iiEevaVh
TxIQwdTsqDNFpOU=
dNXmsxuuoGQTMrDt
/rvUu2QjXV1Svfi2efbZzOs=
9xE76Fj8OyhSyMiGZ9ANAtpf8d/XmQE=
RD/CYgjEB+7nDXo4MMHo2g==
koCfhYxWFHNi4vI=
xJJsA69spND5SF4LA6HRpb8ldXT782mUnA==
0HeKeChZ4cn9O5xPQw==
Nq28w6+v8d7RICXs6aQvIQCZFug=
B3M0y2l579uD0Os=
yYNnTAKs49b9O5xPQw==
5xVy2f2HQtR3R+wevaVh
msCc7w95hfVgAO4tl7AZtkXCd4i4AB95
Hbpe75G5NWsTlbix/PWUCpIcVmPP
ncD1rI16DFM=
mC5kGMz7fHNi4vI=
1PWl+Q04QKlQOu1hx6hvG3Jhew==
Rv80QxE+tumULFtRPYt28IBrbH64AB95
Aquuv19j7dYAyHp8D0ZKskRD
GAUzAzL7RWVeMddgEt/p0g==
7Q91FGcibh8F0HHl
M6Nu7VXxLC2IgMX39cc=
p77o5UiO2RTj
sdRCmQIh2hJBm7RxXPbZzOs=
rgCmKFcTOlqTIEIE2YwqIgCZFug=
+zfRX4EZymzuUX160sso2W9S
kZLyfPyR0QArO5xPQw==
cB05Gb3UXFB23tkXCM0=
aMRW3f8KDLabWpZUSw==
hCQoN85YnJuUj/ohm6ph7z8zYg==
U2jgS3eeWUtkxw==
8499162.xyz
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PRODUCTS LIST INQUIRY.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation PRODUCTS LIST INQUIRY.exe -
Loads dropped DLL 1 IoCs
Processes:
chkdsk.exepid process 1692 chkdsk.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PRODUCTS LIST INQUIRY.exePRODUCTS LIST INQUIRY.exechkdsk.exedescription pid process target process PID 1256 set thread context of 568 1256 PRODUCTS LIST INQUIRY.exe PRODUCTS LIST INQUIRY.exe PID 568 set thread context of 1204 568 PRODUCTS LIST INQUIRY.exe Explorer.EXE PID 1692 set thread context of 1204 1692 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
PRODUCTS LIST INQUIRY.exechkdsk.exepid process 568 PRODUCTS LIST INQUIRY.exe 568 PRODUCTS LIST INQUIRY.exe 568 PRODUCTS LIST INQUIRY.exe 568 PRODUCTS LIST INQUIRY.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
PRODUCTS LIST INQUIRY.exechkdsk.exepid process 568 PRODUCTS LIST INQUIRY.exe 568 PRODUCTS LIST INQUIRY.exe 568 PRODUCTS LIST INQUIRY.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe 1692 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PRODUCTS LIST INQUIRY.exechkdsk.exedescription pid process Token: SeDebugPrivilege 568 PRODUCTS LIST INQUIRY.exe Token: SeDebugPrivilege 1692 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
PRODUCTS LIST INQUIRY.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1256 wrote to memory of 568 1256 PRODUCTS LIST INQUIRY.exe PRODUCTS LIST INQUIRY.exe PID 1256 wrote to memory of 568 1256 PRODUCTS LIST INQUIRY.exe PRODUCTS LIST INQUIRY.exe PID 1256 wrote to memory of 568 1256 PRODUCTS LIST INQUIRY.exe PRODUCTS LIST INQUIRY.exe PID 1256 wrote to memory of 568 1256 PRODUCTS LIST INQUIRY.exe PRODUCTS LIST INQUIRY.exe PID 1256 wrote to memory of 568 1256 PRODUCTS LIST INQUIRY.exe PRODUCTS LIST INQUIRY.exe PID 1256 wrote to memory of 568 1256 PRODUCTS LIST INQUIRY.exe PRODUCTS LIST INQUIRY.exe PID 1256 wrote to memory of 568 1256 PRODUCTS LIST INQUIRY.exe PRODUCTS LIST INQUIRY.exe PID 1204 wrote to memory of 1692 1204 Explorer.EXE chkdsk.exe PID 1204 wrote to memory of 1692 1204 Explorer.EXE chkdsk.exe PID 1204 wrote to memory of 1692 1204 Explorer.EXE chkdsk.exe PID 1204 wrote to memory of 1692 1204 Explorer.EXE chkdsk.exe PID 1692 wrote to memory of 812 1692 chkdsk.exe Firefox.exe PID 1692 wrote to memory of 812 1692 chkdsk.exe Firefox.exe PID 1692 wrote to memory of 812 1692 chkdsk.exe Firefox.exe PID 1692 wrote to memory of 812 1692 chkdsk.exe Firefox.exe PID 1692 wrote to memory of 812 1692 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
832KB
MD507fb6d31f37fb1b4164bef301306c288
SHA14cb41af6d63a07324ef6b18b1a1f43ce94e25626
SHA25606ddf0a370af00d994824605a8e1307ba138f89b2d864539f0d19e8804edac02
SHA512cab4a7c5805b80851aba5f2c9b001fabc1416f6648d891f49eacc81fe79287c5baa01306a42298da722750b812a4ea85388ffae9200dcf656dd1d5b5b9323353
-
memory/568-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/568-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/568-68-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/568-69-0x0000000000A80000-0x0000000000D83000-memory.dmpFilesize
3.0MB
-
memory/568-70-0x00000000000A0000-0x00000000000B0000-memory.dmpFilesize
64KB
-
memory/568-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/568-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/568-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/568-64-0x00000000004012B0-mapping.dmp
-
memory/1204-77-0x0000000006AE0000-0x0000000006C25000-memory.dmpFilesize
1.3MB
-
memory/1204-71-0x0000000006CC0000-0x0000000006E53000-memory.dmpFilesize
1.6MB
-
memory/1204-80-0x0000000006AE0000-0x0000000006C25000-memory.dmpFilesize
1.3MB
-
memory/1256-55-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB
-
memory/1256-56-0x0000000000500000-0x0000000000516000-memory.dmpFilesize
88KB
-
memory/1256-59-0x00000000007A0000-0x00000000007E2000-memory.dmpFilesize
264KB
-
memory/1256-58-0x0000000005400000-0x000000000547C000-memory.dmpFilesize
496KB
-
memory/1256-57-0x0000000000690000-0x000000000069E000-memory.dmpFilesize
56KB
-
memory/1256-54-0x00000000001A0000-0x0000000000276000-memory.dmpFilesize
856KB
-
memory/1692-78-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1692-76-0x0000000001EE0000-0x0000000001F6F000-memory.dmpFilesize
572KB
-
memory/1692-75-0x0000000002040000-0x0000000002343000-memory.dmpFilesize
3.0MB
-
memory/1692-74-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1692-73-0x00000000001B0000-0x00000000001B7000-memory.dmpFilesize
28KB
-
memory/1692-72-0x0000000000000000-mapping.dmp