Analysis
-
max time kernel
188s -
max time network
194s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 05:40
Static task
static1
Behavioral task
behavioral1
Sample
fifth.exe
Resource
win7-20221111-en
General
-
Target
fifth.exe
-
Size
736KB
-
MD5
f4937a3e14c770221de47df00885285b
-
SHA1
dc22ac92d802f7339691082330dc36a236e86644
-
SHA256
1235cd108420d0531298421c807f494e09133bdab337a0d13c6e1bb7ebf239c4
-
SHA512
f06d1eaf53b7027a768f24d15f8b9cf099145f77765c8ef6a8577f37633ccb147f6d3038a46bce5c21de65b6bd78ab14636d6d233497210af07b2923a0b0c4c7
-
SSDEEP
12288:JwlQbmomPZefXPtqvyuQwYvCYDAD9AxDZCCjM+9MQJQv8vgUycEn/z:iomxiXQFwv1M9KDZCIMpQDgUDyz
Malware Config
Extracted
formbook
06eh
LFsv6dX2ii6R8OphWwptZ9Uy+geJcQ==
F2g1Ra3riiwsEeceZ+kPoyzVyQ==
m7+bOE66nh10jg==
Dyb/VMcRh6yNuvVNwJjlrzs=
3yNAvKD3bmuj1Q4=
K7hi/htWsKfW6xc=
sqpSY7/gcvvY0tm0tWucCg==
LnSqfZJAUour0Qo=
Il4dO5W4JE9OlQYNbHc=
LUYTY9QKZHZPe74hTaa/ljM=
Qg6iySJSuuTgNcboVm4=
SJkvGoebIdDEsJn9AI7yPbNK
DKBLqQM7m6oaUKM84/sIFQ==
GOOzpszYDX9lkuZQ5pmdrDDeyg==
V5064wgZl0G1DxNTv5jlrzs=
Onlr5MMHSXuH/91V
oddlSLzpBTyiCAtcvmSS
ITsUV4Gw/mkWaGLjCHs=
HqWBQYO4SQBinnio6GmL
tDrGMY3MC5e1KdgFRw==
0i7Kht0BT9Uwf3Ko6GmL
xc1PYMXwRFdCmgWBBfCEgSI=
1iL/F3SSIKR9Z0OjqWO8QWOK+geJcQ==
Fe+L7lSACifHUJJA
auaHGYTIEaL5HsXyND+MOPMV1w==
WrJQBzNHX3BklQYNbHc=
WoFQ0Lg1eX8=
B2gExP0hRVpFeeP+KEKPDOMo3Q==
r/aKP5/0IlJilwYNbHc=
0BOhje7xbg8CAxJozFyB
LXwZ/dJ9VjmChA==
Y24VOZabw6fW6xc=
6XouwClDudWapQYNbHc=
qTHLXe0VcoJalQYNbHc=
vZt8lnINMtBF
AznPhp06WnORzwo=
Xu64frjiYw0ZXvkcUg==
7b5GpRApq71GlHeo6GmL
Mz4AZ8LFOzi6ZCtLCX8=
klPZKFddlA78DUiPWZjlrzs=
JW9CU629Mc8rZ0q9FgxH3Ge3bdBUN1/N
I505o8nnTe06YRxKfJvBEIeq4Kk=
iUw9iq/LL9NQ
SJVxiR15a/ZY
HYomnwlNVjmChA==
VjoMvzFu22NSUWaTVpjlrzs=
0yjIh+lpo0W0Fx8=
sIwbbLLu/AnqCSRNAYyZGEyA+geJcQ==
4bVHlMPvb+VD6I40j6+c
zxgNrXkB6j6umQ==
+MRimMbkcIVhsRKZQYjd3KZwO6E=
CQrJDnWnBxqFsPclWg==
Vi3XMZKj17PSzMVI
cJUoO3SNAxaEsPclWg==
CVL+tx5SpkSp8/ol7pPyPbNK
4TjYf2axMdZB
rfS/0mKR5oTIrzBONZnpHQ==
/caSDTR5a/ZY
gM032EJYpDdl/MX+RQ==
ePi5nAlFhWuj1Q4=
UVkKDHu1RdGpocgJz0liMPTlu56J
2DbXgd0DC9Q2g26o6GmL
mQ3huhs7ke6byIHj5iBKdSw=
WW8bQboxS1k4lg==
taplan-ms.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fifth.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation fifth.exe -
Loads dropped DLL 1 IoCs
Processes:
help.exepid process 548 help.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
fifth.exefifth.exehelp.exedescription pid process target process PID 1420 set thread context of 880 1420 fifth.exe fifth.exe PID 880 set thread context of 1224 880 fifth.exe Explorer.EXE PID 548 set thread context of 1224 548 help.exe Explorer.EXE -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
fifth.exehelp.exepid process 880 fifth.exe 880 fifth.exe 880 fifth.exe 880 fifth.exe 548 help.exe 548 help.exe 548 help.exe 548 help.exe 548 help.exe 548 help.exe 548 help.exe 548 help.exe 548 help.exe 548 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
fifth.exehelp.exepid process 880 fifth.exe 880 fifth.exe 880 fifth.exe 548 help.exe 548 help.exe 548 help.exe 548 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
fifth.exehelp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 880 fifth.exe Token: SeDebugPrivilege 548 help.exe Token: SeShutdownPrivilege 1224 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
fifth.exeExplorer.EXEhelp.exedescription pid process target process PID 1420 wrote to memory of 880 1420 fifth.exe fifth.exe PID 1420 wrote to memory of 880 1420 fifth.exe fifth.exe PID 1420 wrote to memory of 880 1420 fifth.exe fifth.exe PID 1420 wrote to memory of 880 1420 fifth.exe fifth.exe PID 1420 wrote to memory of 880 1420 fifth.exe fifth.exe PID 1420 wrote to memory of 880 1420 fifth.exe fifth.exe PID 1420 wrote to memory of 880 1420 fifth.exe fifth.exe PID 1224 wrote to memory of 548 1224 Explorer.EXE help.exe PID 1224 wrote to memory of 548 1224 Explorer.EXE help.exe PID 1224 wrote to memory of 548 1224 Explorer.EXE help.exe PID 1224 wrote to memory of 548 1224 Explorer.EXE help.exe PID 548 wrote to memory of 1644 548 help.exe Firefox.exe PID 548 wrote to memory of 1644 548 help.exe Firefox.exe PID 548 wrote to memory of 1644 548 help.exe Firefox.exe PID 548 wrote to memory of 1644 548 help.exe Firefox.exe PID 548 wrote to memory of 1644 548 help.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fifth.exe"C:\Users\Admin\AppData\Local\Temp\fifth.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fifth.exe"C:\Users\Admin\AppData\Local\Temp\fifth.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
949KB
MD538a3e021eb32c9976adaf0b3372080fc
SHA168e02803c646be21007d90bec841c176b82211fd
SHA2568cde0275d60da0d11954f73c7c8862cfc4b306f61bb8b1ce14abe4a193af2652
SHA512b886cc112f2750e7300b66f7242850659fa49fdc97f75aed376cb9f5440875f303a143bf8b51068ec42674f1ebe1dfcc40534f3a7aed3cc4d20f9274b9a66d18
-
memory/548-72-0x0000000000000000-mapping.dmp
-
memory/548-78-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/548-76-0x00000000004A0000-0x000000000052F000-memory.dmpFilesize
572KB
-
memory/548-75-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/548-74-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/548-73-0x0000000000620000-0x0000000000626000-memory.dmpFilesize
24KB
-
memory/880-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/880-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/880-64-0x00000000004012B0-mapping.dmp
-
memory/880-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/880-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/880-68-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/880-69-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/880-70-0x00000000001A0000-0x00000000001B0000-memory.dmpFilesize
64KB
-
memory/880-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1224-71-0x0000000007460000-0x00000000075E7000-memory.dmpFilesize
1.5MB
-
memory/1224-77-0x0000000004AB0000-0x0000000004B61000-memory.dmpFilesize
708KB
-
memory/1224-80-0x0000000004AB0000-0x0000000004B61000-memory.dmpFilesize
708KB
-
memory/1420-54-0x0000000000010000-0x00000000000CE000-memory.dmpFilesize
760KB
-
memory/1420-59-0x0000000004140000-0x0000000004182000-memory.dmpFilesize
264KB
-
memory/1420-58-0x0000000004720000-0x000000000479A000-memory.dmpFilesize
488KB
-
memory/1420-57-0x0000000000440000-0x000000000044E000-memory.dmpFilesize
56KB
-
memory/1420-56-0x00000000008C0000-0x00000000008DA000-memory.dmpFilesize
104KB
-
memory/1420-55-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB