Analysis
-
max time kernel
204s -
max time network
211s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 12:04
Static task
static1
Behavioral task
behavioral1
Sample
06492c1cc7f4b4014d8d870cbef4cc7e.exe
Resource
win7-20221111-en
General
-
Target
06492c1cc7f4b4014d8d870cbef4cc7e.exe
-
Size
855KB
-
MD5
06492c1cc7f4b4014d8d870cbef4cc7e
-
SHA1
72bd56591a036f1543d7a3dbb874bd756155d79a
-
SHA256
6c2ccca3064d2d2f17e9cd5222df4efbd2b21dc5bd7acf5b0fe57edeccd037d3
-
SHA512
5f4fe2bf826b6cb1f4b57de43ca5f907c3c537a6a5e648eb7867040a5c6047261ef12c2ef81c6a6faf91e8e6c08ce5f77e9c5080f9380df4a4ef213a18720f14
-
SSDEEP
12288:6jjm/7QG8h3WX9GPlqmTG/HVuYSk2/YEZA3zzu0YzYzLJqTX:Ek7QTmYy/EYSZRZADz7pA
Malware Config
Extracted
formbook
pgnt
0WG18LbM4lR9iqMRa4nlBzTb
jcfGYzPgZTqFZVO9FV2yIw==
laIfrdSC8/4CNg==
Q73ilev5GIWuOrAAFV2yIw==
Q2u/pMw7pv4sPA==
TbqvIUHwlQscPo0HFV2yIw==
8PNWfGPyE8n0IQ==
WtgROxXzvY2L
PryaRBNjm4eP
Y9Hdi06Cry1um9Sj68YAu1o=
3Gulyp7CMQtR78jvLkk=
JJ3GasTVTCRQT6Tfz6S6GlI=
RnS42bhb9tI0R6UpD6wOxriNxw==
he1mi2sOGfzTRGHnuA==
eaYjCtjxVjdU5XLRtBMBLKk9quA=
k9rTeEqYzzw8WaTfz6S6GlI=
5luVQwe2vJWKEAiMdF4=
MGW14L9OVk5Y5TaR6w/DqdhYxXVY
mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==
y5klhuMbE8n0IQ==
u/NKcEKARatNn/dT
ZJaHJQCvzDWRuPPmMsEVxriNxw==
nRhddlcPOegWrv5R
/njA0TJ1U+osPA==
pi8az6AySKlNn/dT
e/k+YjN+U+osPA==
kMAZ36lMWa3gRGHnuA==
wfX0nGsGE1yUJb1Jq33LoDdDWLSgFQ==
wfk35UJcfeHoRGHnuA==
dbzljekZ3ka2QYCYOP1I
Nq3kDeMNNJWDMnWYOP1I
Sa0SN/04cNje8xbaJLgUxriNxw==
yDejyZiQ/X/BQYiYOP1I
UIPN7ckznp2W
s/HtqJNKdmtv88jvLkk=
KanG2bhM0CsdiNrNF0E=
QLrtp3svzjcsTaJ9y5kPopyQzQ==
syhbC2iJZ8obK2Y7nHSa7CmdUuA=
HZXK676zo5OV
5WFoCWeuxqekcHx5YkE=
PbX1H/gmE8n0IQ==
3HTB6Asznp2W
9HGhWLLyrJXPcq4FRecyGU247XBS
/oW437jofmJ8DQiMdF4=
sh415lJ8q3cL3XJvaEA=
XucfBGWzVEg=
PKWeQgpB1cUHprue4sYAu1o=
MXFzDmuO/nBtmjc6g5elIVMbQeWFjyMN
q+v2lgI9Vb0rC2juug==
WYvkDdX8kEjU73U=
6BJjmWGiizGT
fLHageH29Ex1m8jvLkk=
3D+hsVkFtIyr5WI=
ntIbRgolp0jU73U=
GGGJMpC3pJPdQ8ZGkpxA
8FtjHvNDiICP
L63yFOor5uMdLqnrNNblBzTb
Gav/MgU4AByfuddW
xek7Tm3lhlY=
n2sDng5BBdtNn/dT
LZsINfoQH6dNn/dT
Io+SQh7ak0Ti7Gg=
T8Xci1oCP63aRGHnuA==
bZX0DnWMqxcyQ39hzOH+7U0BvmhP
hf9blwwuwpx7j8k.live
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
colorcpl.exepid process 1652 colorcpl.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
06492c1cc7f4b4014d8d870cbef4cc7e.exeRegsvcs.execolorcpl.exedescription pid process target process PID 1744 set thread context of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1320 set thread context of 1256 1320 Regsvcs.exe Explorer.EXE PID 1320 set thread context of 1256 1320 Regsvcs.exe Explorer.EXE PID 1652 set thread context of 1256 1652 colorcpl.exe Explorer.EXE -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
Regsvcs.execolorcpl.exepid process 1320 Regsvcs.exe 1320 Regsvcs.exe 1320 Regsvcs.exe 1320 Regsvcs.exe 1320 Regsvcs.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
Regsvcs.execolorcpl.exepid process 1320 Regsvcs.exe 1320 Regsvcs.exe 1320 Regsvcs.exe 1320 Regsvcs.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Regsvcs.execolorcpl.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1320 Regsvcs.exe Token: SeDebugPrivilege 1652 colorcpl.exe Token: SeShutdownPrivilege 1256 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
06492c1cc7f4b4014d8d870cbef4cc7e.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1744 wrote to memory of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1744 wrote to memory of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1744 wrote to memory of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1744 wrote to memory of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1744 wrote to memory of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1744 wrote to memory of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1744 wrote to memory of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1744 wrote to memory of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1744 wrote to memory of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1744 wrote to memory of 1320 1744 06492c1cc7f4b4014d8d870cbef4cc7e.exe Regsvcs.exe PID 1256 wrote to memory of 1652 1256 Explorer.EXE colorcpl.exe PID 1256 wrote to memory of 1652 1256 Explorer.EXE colorcpl.exe PID 1256 wrote to memory of 1652 1256 Explorer.EXE colorcpl.exe PID 1256 wrote to memory of 1652 1256 Explorer.EXE colorcpl.exe PID 1652 wrote to memory of 240 1652 colorcpl.exe Firefox.exe PID 1652 wrote to memory of 240 1652 colorcpl.exe Firefox.exe PID 1652 wrote to memory of 240 1652 colorcpl.exe Firefox.exe PID 1652 wrote to memory of 240 1652 colorcpl.exe Firefox.exe PID 1652 wrote to memory of 240 1652 colorcpl.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\06492c1cc7f4b4014d8d870cbef4cc7e.exe"C:\Users\Admin\AppData\Local\Temp\06492c1cc7f4b4014d8d870cbef4cc7e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
1.1MB
MD5f55e5766477de5997da50f12c9c74c91
SHA14dc98900a887be95411f07b9e597c57bdc7dbab3
SHA25690be88984ee60864256378c952d44b13d55ac032ab6a7b8c698885176bcece69
SHA512983417a297e68b58fbd1c07fed7a1697d249110a2c10644b2dc96e3facedd3fbfbcac6a7809631ffd62894f02cadd4d3e62022b9e5e026e5bf434f1eb1878f05
-
memory/1256-68-0x0000000004CC0000-0x0000000004DA1000-memory.dmpFilesize
900KB
-
memory/1256-83-0x0000000007B70000-0x0000000007CD9000-memory.dmpFilesize
1.4MB
-
memory/1256-82-0x0000000007B70000-0x0000000007CD9000-memory.dmpFilesize
1.4MB
-
memory/1256-80-0x0000000004DB0000-0x0000000004E89000-memory.dmpFilesize
868KB
-
memory/1256-72-0x0000000004DB0000-0x0000000004E89000-memory.dmpFilesize
868KB
-
memory/1320-70-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/1320-75-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1320-64-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1320-65-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1320-66-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/1320-67-0x0000000000100000-0x0000000000110000-memory.dmpFilesize
64KB
-
memory/1320-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1320-71-0x00000000001C0000-0x00000000001D0000-memory.dmpFilesize
64KB
-
memory/1320-56-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1320-60-0x00000000004012B0-mapping.dmp
-
memory/1320-57-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1320-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1320-74-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1320-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1652-78-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1652-79-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/1652-77-0x0000000000810000-0x0000000000828000-memory.dmpFilesize
96KB
-
memory/1652-76-0x0000000075A31000-0x0000000075A33000-memory.dmpFilesize
8KB
-
memory/1652-81-0x0000000000760000-0x00000000007EF000-memory.dmpFilesize
572KB
-
memory/1652-73-0x0000000000000000-mapping.dmp
-
memory/1744-54-0x0000000001230000-0x000000000130C000-memory.dmpFilesize
880KB
-
memory/1744-55-0x0000000000350000-0x000000000035A000-memory.dmpFilesize
40KB