Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 02:04
Static task
static1
Behavioral task
behavioral1
Sample
Arrival Notice.exe
Resource
win7-20221111-en
General
-
Target
Arrival Notice.exe
-
Size
443KB
-
MD5
7d71400ae523be4c870fca01cad243ae
-
SHA1
db3e7be3fc8dfdcff0147f944f519c99c69584eb
-
SHA256
c86c4b2413ae0161438065f00f28eae576d2fdfb2a27d06752316f1d1860edb1
-
SHA512
38894c771dd2c8efdb10e913e2702f1f85a16f66fa2876bfeb39b36053861426b086f73289c4e74e27cc8454d78f13629b23d8dc149819e241287c490c940fdc
-
SSDEEP
12288:lac6BafvIbRW06cviiD/EB7LlBgbgTKoOmRwFOp0/:lactfn09aiwVeoI/
Malware Config
Extracted
xloader
2.6
pdrq
welchsunstar.com
mppservicesllc.com
wiresofteflon.com
brabov.xyz
compnonoch.site
yourbuilderworks.com
iamsamirahman.com
eriqoes.com
eastudio.design
skyearth-est.com
teethfitness.com
razaancreates.com
shfbfs.com
joyfulbrokekids.com
kjbolden.com
howirep.com
deedeesmainecoons.website
e-powair.com
aheatea.com
shalfey0009.xyz
designcolor.style
netflixpaymentpending.ca
bothoitrang3.site
motondiarts.com
staynmocean.com
miamivideoshows.com
berendsit.com
yndzjs.com
yiwenhome.xyz
royaldeals.net
clearvison-ts.com
peluqueriasusanagalan.com
thelittlewellnessstudio.com
gurulotaska.com
smgsj.com
followpanelbd.com
prinirwedding.com
3559.fyi
amcvips.com
bigroof.top
chipbio-zt.com
candelasluxuryretreat.com
jboycephotography.com
affiliateindex.xyz
grannysseasonings.com
lcl-inc-test.com
beadallcreations.jewelry
yzzhome.top
tobe-science.com
cincinnaticustomrenovation.com
survaicommercial.xyz
businessdirectorymania.com
phqworld.com
miamigocars.com
labfour.systems
gregoryzeitler.com
dj-mary.com
one1-day.com
vegfiber.com
sfbayraw.net
xn--bndarsloto-s4a.com
felipesb.com
108580.com
1swj06mjrowgi.xyz
koalaglen.com
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
Arrival Notice.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions Arrival Notice.exe -
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3712-146-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral2/memory/3712-161-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral2/memory/4612-165-0x0000000000DA0000-0x0000000000DCB000-memory.dmp xloader behavioral2/memory/4612-172-0x0000000000DA0000-0x0000000000DCB000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
help.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run help.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TPXLAN = "C:\\Program Files (x86)\\Jz8ahft\\regsvc4h-.exe" help.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
Arrival Notice.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools Arrival Notice.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Arrival Notice.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Arrival Notice.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Arrival Notice.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Arrival Notice.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Arrival Notice.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Arrival Notice.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Arrival Notice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Arrival Notice.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Arrival Notice.exeArrival Notice.exehelp.exedescription pid process target process PID 4104 set thread context of 3712 4104 Arrival Notice.exe Arrival Notice.exe PID 3712 set thread context of 3048 3712 Arrival Notice.exe Explorer.EXE PID 4612 set thread context of 3048 4612 help.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
help.exedescription ioc process File opened for modification C:\Program Files (x86)\Jz8ahft\regsvc4h-.exe help.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Arrival Notice.exepowershell.exeArrival Notice.exehelp.exepid process 4104 Arrival Notice.exe 4104 Arrival Notice.exe 4104 Arrival Notice.exe 4104 Arrival Notice.exe 4104 Arrival Notice.exe 4104 Arrival Notice.exe 392 powershell.exe 3712 Arrival Notice.exe 3712 Arrival Notice.exe 392 powershell.exe 3712 Arrival Notice.exe 3712 Arrival Notice.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Arrival Notice.exehelp.exepid process 3712 Arrival Notice.exe 3712 Arrival Notice.exe 3712 Arrival Notice.exe 4612 help.exe 4612 help.exe 4612 help.exe 4612 help.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Arrival Notice.exepowershell.exeArrival Notice.exehelp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4104 Arrival Notice.exe Token: SeDebugPrivilege 392 powershell.exe Token: SeDebugPrivilege 3712 Arrival Notice.exe Token: SeDebugPrivilege 4612 help.exe Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
Arrival Notice.exeExplorer.EXEhelp.exedescription pid process target process PID 4104 wrote to memory of 392 4104 Arrival Notice.exe powershell.exe PID 4104 wrote to memory of 392 4104 Arrival Notice.exe powershell.exe PID 4104 wrote to memory of 392 4104 Arrival Notice.exe powershell.exe PID 4104 wrote to memory of 1068 4104 Arrival Notice.exe schtasks.exe PID 4104 wrote to memory of 1068 4104 Arrival Notice.exe schtasks.exe PID 4104 wrote to memory of 1068 4104 Arrival Notice.exe schtasks.exe PID 4104 wrote to memory of 3680 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 3680 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 3680 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 4512 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 4512 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 4512 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 3712 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 3712 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 3712 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 3712 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 3712 4104 Arrival Notice.exe Arrival Notice.exe PID 4104 wrote to memory of 3712 4104 Arrival Notice.exe Arrival Notice.exe PID 3048 wrote to memory of 4612 3048 Explorer.EXE help.exe PID 3048 wrote to memory of 4612 3048 Explorer.EXE help.exe PID 3048 wrote to memory of 4612 3048 Explorer.EXE help.exe PID 4612 wrote to memory of 1360 4612 help.exe cmd.exe PID 4612 wrote to memory of 1360 4612 help.exe cmd.exe PID 4612 wrote to memory of 1360 4612 help.exe cmd.exe PID 4612 wrote to memory of 3024 4612 help.exe cmd.exe PID 4612 wrote to memory of 3024 4612 help.exe cmd.exe PID 4612 wrote to memory of 3024 4612 help.exe cmd.exe PID 4612 wrote to memory of 1176 4612 help.exe cmd.exe PID 4612 wrote to memory of 1176 4612 help.exe cmd.exe PID 4612 wrote to memory of 1176 4612 help.exe cmd.exe PID 4612 wrote to memory of 956 4612 help.exe Firefox.exe PID 4612 wrote to memory of 956 4612 help.exe Firefox.exe PID 4612 wrote to memory of 956 4612 help.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Arrival Notice.exe"C:\Users\Admin\AppData\Local\Temp\Arrival Notice.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YyKWDHkSnIFE.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YyKWDHkSnIFE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp704E.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Arrival Notice.exe"C:\Users\Admin\AppData\Local\Temp\Arrival Notice.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Arrival Notice.exe"C:\Users\Admin\AppData\Local\Temp\Arrival Notice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Arrival Notice.exe"C:\Users\Admin\AppData\Local\Temp\Arrival Notice.exe"3⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Arrival Notice.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\tmp704E.tmpFilesize
1KB
MD54315db5cb5c88c00b0a3bbebefc673fa
SHA1e814b89cafbe08d1ed9fc486b322c7ad526ea2cc
SHA256072a2f8a9ff063ad67adaedf7ffb83f3a736b7f85321c6be179522596335b1e0
SHA51239d29543814c6e66801d3ecc40c8c909ffde0a95bc008d2216fd845887eb0fe5fba38568a7b1f8ae3e4b38fd6fa31f89bbf5e5dfd41b0ea6b25ad4e818a0496a
-
memory/392-155-0x00000000719E0000-0x0000000071A2C000-memory.dmpFilesize
304KB
-
memory/392-162-0x0000000007270000-0x0000000007306000-memory.dmpFilesize
600KB
-
memory/392-158-0x0000000006FF0000-0x000000000700A000-memory.dmpFilesize
104KB
-
memory/392-138-0x0000000000000000-mapping.dmp
-
memory/392-168-0x0000000007330000-0x000000000734A000-memory.dmpFilesize
104KB
-
memory/392-140-0x0000000002400000-0x0000000002436000-memory.dmpFilesize
216KB
-
memory/392-159-0x0000000007070000-0x000000000707A000-memory.dmpFilesize
40KB
-
memory/392-157-0x0000000007640000-0x0000000007CBA000-memory.dmpFilesize
6.5MB
-
memory/392-143-0x0000000004E50000-0x0000000005478000-memory.dmpFilesize
6.2MB
-
memory/392-154-0x00000000062B0000-0x00000000062E2000-memory.dmpFilesize
200KB
-
memory/392-147-0x0000000004D30000-0x0000000004D52000-memory.dmpFilesize
136KB
-
memory/392-167-0x0000000007220000-0x000000000722E000-memory.dmpFilesize
56KB
-
memory/392-156-0x0000000006290000-0x00000000062AE000-memory.dmpFilesize
120KB
-
memory/392-148-0x0000000005580000-0x00000000055E6000-memory.dmpFilesize
408KB
-
memory/392-150-0x0000000005CF0000-0x0000000005D0E000-memory.dmpFilesize
120KB
-
memory/392-169-0x0000000007310000-0x0000000007318000-memory.dmpFilesize
32KB
-
memory/1068-139-0x0000000000000000-mapping.dmp
-
memory/1176-176-0x0000000000000000-mapping.dmp
-
memory/1360-166-0x0000000000000000-mapping.dmp
-
memory/3024-174-0x0000000000000000-mapping.dmp
-
memory/3048-153-0x00000000031D0000-0x0000000003283000-memory.dmpFilesize
716KB
-
memory/3048-171-0x0000000007EF0000-0x0000000008048000-memory.dmpFilesize
1.3MB
-
memory/3048-173-0x0000000007EF0000-0x0000000008048000-memory.dmpFilesize
1.3MB
-
memory/3680-142-0x0000000000000000-mapping.dmp
-
memory/3712-161-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/3712-152-0x0000000001620000-0x0000000001631000-memory.dmpFilesize
68KB
-
memory/3712-151-0x00000000011F0000-0x000000000153A000-memory.dmpFilesize
3.3MB
-
memory/3712-145-0x0000000000000000-mapping.dmp
-
memory/3712-146-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4104-137-0x00000000078D0000-0x0000000007936000-memory.dmpFilesize
408KB
-
memory/4104-133-0x0000000005190000-0x0000000005734000-memory.dmpFilesize
5.6MB
-
memory/4104-135-0x0000000004C30000-0x0000000004C3A000-memory.dmpFilesize
40KB
-
memory/4104-136-0x00000000075C0000-0x000000000765C000-memory.dmpFilesize
624KB
-
memory/4104-134-0x0000000004C80000-0x0000000004D12000-memory.dmpFilesize
584KB
-
memory/4104-132-0x0000000000200000-0x0000000000274000-memory.dmpFilesize
464KB
-
memory/4512-144-0x0000000000000000-mapping.dmp
-
memory/4612-164-0x0000000001820000-0x0000000001B6A000-memory.dmpFilesize
3.3MB
-
memory/4612-172-0x0000000000DA0000-0x0000000000DCB000-memory.dmpFilesize
172KB
-
memory/4612-170-0x0000000001540000-0x00000000015D0000-memory.dmpFilesize
576KB
-
memory/4612-165-0x0000000000DA0000-0x0000000000DCB000-memory.dmpFilesize
172KB
-
memory/4612-160-0x0000000000000000-mapping.dmp
-
memory/4612-163-0x0000000000D80000-0x0000000000D87000-memory.dmpFilesize
28KB