Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
07-12-2022 11:32
Static task
static1
General
-
Target
1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe
-
Size
328KB
-
MD5
31d0788e3cd2c03d23d92b8b2b8d6b99
-
SHA1
1d8d40796fbeb7b11494d9a170e9075ca57cc877
-
SHA256
1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075
-
SHA512
224c01004cd008866cc2995e2d80d749982e62bb4fc058736bee80190b49e9a2935a033f4d376d8d6f73f7da7061e11a29c191d5ad4d9599006ac59c7eca1605
-
SSDEEP
6144:tNB+sYuZZRk0az7XGZBgc4BLbNBmR03HivnMR7xHcn5a:tv+jcAT32HR0n7xHcn5a
Malware Config
Extracted
formbook
qsqm
gYI8BO7T7BQOBw==
5kKpX8NHT4cITCAOEkMYvi5HiMZ5
oq5lCVwFY9KNJipM
OiTOjWhDMXBf8H9o79k=
rSDHx5jqNn3Sz/LND/0G
ob6FSUE4NYUi5Iqg1YGfMg==
fI5oMbAC5EAeerSKKRM2PjF7TYJh
lmWieqE8QHg=
yLxwFWm+rbCJXqE=
MyY9R8VCSaAtEJY2MdHAXKY=
WYA53Ezjh808
EPu6bfMPNJUh
upyUkeqQ6B/FJyq2PCiwnZf/
RvN3e2hDLJQmo9qtZTVoRmPi
hZhWEObjh808
K1gowrFsO5p0UchTUEVoRmPi
7hXPaZ6i+F7o2L8OCCyhNA==
bIp+E/xrSG9QHA==
+EPrJAdvSG9QHA==
METFhoRGH1sBBWhAbA==
pr3l7VLjh808
cYZjKJ0EDWvmulzpQjMf
qii6s7mxA2g=
Ym4qvyLePK+e9grpQjMf
0J0TAuKfdd29mRGlxCIXqBwOIeQ=
+P4L9T2Wj9+NJipM
4xsZCg5v7FU8HJUkJBn9FTV7TYJh
sIJ8FgmASG9QHA==
ReyRnphfRIwsFhPpQjMf
DGZugWVIHE/6BWhAbA==
hAxO/V1KqRgWobhL1IQLjLs=
3Kj+sI95ns28hK4=
SN1bhR3XHWsDVmYElpDzhMKsAK3uJ/SLXw==
q5KFa+63Ko1qQsBbie/6qBwOIeQ=
Y5JjKAO+qPV+dzD05dX/av6KjQvPRuo=
zwcQGaKfE1XsTdDreuzypzwwRP0=
GI8jFvtiqR0Fca7NwrPU9xwOIeQ=
kcKnVjiV/SAmpLY=
ypw0NBTWvwrMxWc6V0NoRmPi
LGRqVa+M9l9/qLM=
trr3sce9OJc054wk7aDpiaw=
5SkqKIwB6FoaDAkaIszoiqw=
67ge1GRDpRLjkEEXRLIX
l+2uhu7ldbtBth1s6tE=
1CN1N7KXFW40t/7pQjMf
5hrSTWdCSrGNJipM
I2dlU1i0FHlBxh1s6tE=
SGpABeLIrQiOFK3WfvLxrdlZUfk=
Cvy6Y7pIJgsABWhAbA==
93ISFvBLsRzAIZEp3Mg=
2sjOvi4Hdrlgv/IL//MiNnzad69vVHvh
JlhaXsQwEn0j+JH3aMabybM=
QzP4vTGQk92LKLtQcQ==
i3SGeeqqFIeV2EpUuzN5Jg==
DYAmHaUEBzn3e5Qsqp8eqCmZFsjxVg==
Lz0V3VHjh808
WeF2bVoB0j32DUkozoQLjLs=
ublvHJZZlf/RzlTv1YGfMg==
i6rX4kfSateimHwRJhH9HDx7TYJh
zYrw3cyuuh8xzmgzULPAOg==
yIvXnpZRJ2XQmjT/JB85XUF0hgvPRuo=
uqjBwhzWImrUzPa/XztoRmPi
ariPQDGQ/CAmpLY=
IOp0hWHEM55x4h1s6tE=
cabinetie.com
Extracted
xloader
3.Æ…
qsqm
gYI8BO7T7BQOBw==
5kKpX8NHT4cITCAOEkMYvi5HiMZ5
oq5lCVwFY9KNJipM
OiTOjWhDMXBf8H9o79k=
rSDHx5jqNn3Sz/LND/0G
ob6FSUE4NYUi5Iqg1YGfMg==
fI5oMbAC5EAeerSKKRM2PjF7TYJh
lmWieqE8QHg=
yLxwFWm+rbCJXqE=
MyY9R8VCSaAtEJY2MdHAXKY=
WYA53Ezjh808
EPu6bfMPNJUh
upyUkeqQ6B/FJyq2PCiwnZf/
RvN3e2hDLJQmo9qtZTVoRmPi
hZhWEObjh808
K1gowrFsO5p0UchTUEVoRmPi
7hXPaZ6i+F7o2L8OCCyhNA==
bIp+E/xrSG9QHA==
+EPrJAdvSG9QHA==
METFhoRGH1sBBWhAbA==
pr3l7VLjh808
cYZjKJ0EDWvmulzpQjMf
qii6s7mxA2g=
Ym4qvyLePK+e9grpQjMf
0J0TAuKfdd29mRGlxCIXqBwOIeQ=
+P4L9T2Wj9+NJipM
4xsZCg5v7FU8HJUkJBn9FTV7TYJh
sIJ8FgmASG9QHA==
ReyRnphfRIwsFhPpQjMf
DGZugWVIHE/6BWhAbA==
hAxO/V1KqRgWobhL1IQLjLs=
3Kj+sI95ns28hK4=
SN1bhR3XHWsDVmYElpDzhMKsAK3uJ/SLXw==
q5KFa+63Ko1qQsBbie/6qBwOIeQ=
Y5JjKAO+qPV+dzD05dX/av6KjQvPRuo=
zwcQGaKfE1XsTdDreuzypzwwRP0=
GI8jFvtiqR0Fca7NwrPU9xwOIeQ=
kcKnVjiV/SAmpLY=
ypw0NBTWvwrMxWc6V0NoRmPi
LGRqVa+M9l9/qLM=
trr3sce9OJc054wk7aDpiaw=
5SkqKIwB6FoaDAkaIszoiqw=
67ge1GRDpRLjkEEXRLIX
l+2uhu7ldbtBth1s6tE=
1CN1N7KXFW40t/7pQjMf
5hrSTWdCSrGNJipM
I2dlU1i0FHlBxh1s6tE=
SGpABeLIrQiOFK3WfvLxrdlZUfk=
Cvy6Y7pIJgsABWhAbA==
93ISFvBLsRzAIZEp3Mg=
2sjOvi4Hdrlgv/IL//MiNnzad69vVHvh
JlhaXsQwEn0j+JH3aMabybM=
QzP4vTGQk92LKLtQcQ==
i3SGeeqqFIeV2EpUuzN5Jg==
DYAmHaUEBzn3e5Qsqp8eqCmZFsjxVg==
Lz0V3VHjh808
WeF2bVoB0j32DUkozoQLjLs=
ublvHJZZlf/RzlTv1YGfMg==
i6rX4kfSateimHwRJhH9HDx7TYJh
zYrw3cyuuh8xzmgzULPAOg==
yIvXnpZRJ2XQmjT/JB85XUF0hgvPRuo=
uqjBwhzWImrUzPa/XztoRmPi
ariPQDGQ/CAmpLY=
IOp0hWHEM55x4h1s6tE=
cabinetie.com
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exeRegSvcs.exemsiexec.exedescription pid process target process PID 2684 set thread context of 5084 2684 1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe RegSvcs.exe PID 5084 set thread context of 3000 5084 RegSvcs.exe Explorer.EXE PID 4124 set thread context of 3000 4124 msiexec.exe Explorer.EXE -
Processes:
msiexec.exedescription ioc process Key created \Registry\User\S-1-5-21-2368682536-4045190062-1465778271-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 5084 RegSvcs.exe 5084 RegSvcs.exe 5084 RegSvcs.exe 5084 RegSvcs.exe 5084 RegSvcs.exe 5084 RegSvcs.exe 5084 RegSvcs.exe 5084 RegSvcs.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3000 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 5084 RegSvcs.exe 5084 RegSvcs.exe 5084 RegSvcs.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe 4124 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exeRegSvcs.exemsiexec.exedescription pid process Token: SeDebugPrivilege 2684 1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe Token: SeDebugPrivilege 5084 RegSvcs.exe Token: SeDebugPrivilege 4124 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exeExplorer.EXEmsiexec.exedescription pid process target process PID 2684 wrote to memory of 5084 2684 1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe RegSvcs.exe PID 2684 wrote to memory of 5084 2684 1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe RegSvcs.exe PID 2684 wrote to memory of 5084 2684 1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe RegSvcs.exe PID 2684 wrote to memory of 5084 2684 1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe RegSvcs.exe PID 2684 wrote to memory of 5084 2684 1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe RegSvcs.exe PID 2684 wrote to memory of 5084 2684 1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe RegSvcs.exe PID 3000 wrote to memory of 4124 3000 Explorer.EXE msiexec.exe PID 3000 wrote to memory of 4124 3000 Explorer.EXE msiexec.exe PID 3000 wrote to memory of 4124 3000 Explorer.EXE msiexec.exe PID 4124 wrote to memory of 4748 4124 msiexec.exe Firefox.exe PID 4124 wrote to memory of 4748 4124 msiexec.exe Firefox.exe PID 4124 wrote to memory of 4748 4124 msiexec.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe"C:\Users\Admin\AppData\Local\Temp\1d504613d93ba714b247d0b35b1182cebf4a7b3bd33261f0aed1b7fdcd2e3075.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2684-160-0x0000000004F50000-0x0000000004F98000-memory.dmpFilesize
288KB
-
memory/2684-125-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-123-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-122-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-124-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-162-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-126-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-127-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-128-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-129-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-131-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-130-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-132-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-133-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-134-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-135-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-136-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-137-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-138-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-139-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-140-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-141-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-142-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-143-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-144-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-145-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-146-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-147-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-148-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-149-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-161-0x00000000095E0000-0x000000000967C000-memory.dmpFilesize
624KB
-
memory/2684-151-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-152-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-153-0x0000000000650000-0x00000000006AA000-memory.dmpFilesize
360KB
-
memory/2684-154-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-155-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-156-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-157-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-158-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-159-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-120-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-150-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-121-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-163-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-164-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-165-0x0000000004E20000-0x0000000004E3C000-memory.dmpFilesize
112KB
-
memory/2684-166-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-167-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-168-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/2684-173-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/3000-274-0x0000000009540000-0x00000000096C6000-memory.dmpFilesize
1.5MB
-
memory/3000-249-0x0000000009540000-0x00000000096C6000-memory.dmpFilesize
1.5MB
-
memory/3000-197-0x0000000002DD0000-0x0000000002EA4000-memory.dmpFilesize
848KB
-
memory/4124-244-0x00000000003C0000-0x00000000003D2000-memory.dmpFilesize
72KB
-
memory/4124-198-0x0000000000000000-mapping.dmp
-
memory/4124-245-0x0000000000200000-0x000000000022D000-memory.dmpFilesize
180KB
-
memory/4124-251-0x0000000004050000-0x00000000041E0000-memory.dmpFilesize
1.6MB
-
memory/4124-250-0x0000000000200000-0x000000000022D000-memory.dmpFilesize
180KB
-
memory/4124-248-0x0000000004050000-0x00000000041E0000-memory.dmpFilesize
1.6MB
-
memory/4124-246-0x0000000004380000-0x00000000046A0000-memory.dmpFilesize
3.1MB
-
memory/5084-171-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-190-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-179-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-181-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-180-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-177-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-175-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-172-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-185-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/5084-186-0x0000000001620000-0x0000000001940000-memory.dmpFilesize
3.1MB
-
memory/5084-188-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-178-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-189-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-191-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-196-0x00000000011E0000-0x0000000001371000-memory.dmpFilesize
1.6MB
-
memory/5084-184-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5084-174-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-183-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-170-0x00000000004012B0-mapping.dmp
-
memory/5084-169-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5084-182-0x00000000773D0000-0x000000007755E000-memory.dmpFilesize
1.6MB
-
memory/5084-199-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5084-201-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB