Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-02-2023 09:22
Static task
static1
Behavioral task
behavioral1
Sample
878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe
Resource
win7-20220812-en
General
-
Target
878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe
-
Size
52KB
-
MD5
207fdcecc4c844004d064f7f7d25fb0f
-
SHA1
4a1b05f7cd8b3ba7c82f48ca8aeb10b264369c4c
-
SHA256
878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9
-
SHA512
739ce29e9cf6d5cb25e22841bb28d0e0d825c452df49f3b15e9a0b2d275150f88da198566b540fc3d40c089cbd0dcd077f79620e4a2c2d1f7d9e13a5cb46499d
-
SSDEEP
768:EyH64NqpyLvO3klekO2Pco2YQ78QTEB6SrZdP545gkRUnqkAmZbI:w5pyLvLy2awvsSVBqukeqxEI
Malware Config
Extracted
formbook
scse
SKpYFyVNT2zunKf0uuM=
FlEHUseI7I5XbrO8fR/XBcS9ZA==
FPuxoUOxkLiATugw
VKdxsDSk0jdT5Kw=
FpqHf9iI/1tl97E=
YGI6sIl3UIxfZvlD+JiUuuLR
oBAEO0suBEAD5aK00A==
RKJqTzg4gQ/Q6DYSuTjDGkwuyl0ik5Kb8w==
VFg9s3W0/Ype8A3cZb+D7g==
hwD+VNd6014nrsaTWm4FBcS9ZA==
zkAdUq1soKYUfZaTqLmL
XVQ9WbRivUIQ477a/hKv+g==
QireF2geizAwmp674AGc5g==
PSTUQxs6j8OATugw
LHJhyy2VbX8NEqf0uuM=
MiY1vg6T3HqATugw
wqkUjaVXnGgBqA==
jUr/eUtSIT01Wegt
PjQidcqKzAbSZICUZb+D7g==
OkAmcv12sUEAIHwFHakzdIo2FPHw
zyDLsw+3I3H6gnaGZb+D7g==
ll0HRs5IJGxCZMJPahHgOt2RqjU=
YqaIEokHuw6V
jGJG11YCObJ+IQIXCW8KU+ZcbA==
jv4ITr8zITdT5Kw=
nXYro3yHe5YV5aK00A==
rJt1IPkxeQDUayhVCJyUuuLR
oFwz1DUU/RdD5aK00A==
FHlVTKEVIRFE5aK00A==
8GhjL2lJOWD+5aK00A==
k3BLouunGsagwhAi6oeUuuLR
p45GiQN5bZMjR9karDwDa442FPHw
Zdd7rVCKu/b3TIVU6t/lP92RqjU=
wyjxGjYHuw6V
nW5RrwV6yTdT5Kw=
itzGDGclWW4SqnLBSWH5Pt2RqjU=
8zwgceJYRWn+DKf0uuM=
EmojFmj027tsHrs=
ExQEPY5UyyS00HPvNNCH8w==
laiGCZRTkbg/XAl/Zb+D7g==
wYQysWBl+DdT5Kw=
MWo3rYV3XoAJ5aK00A==
hnht0SrcDR+XpjV6H6WUuuLR
rxqw6S7qG8A=
aEcfph/RAUAcfZYnXOw=
EXdVkuuzJ8eEjkTROs2D
MDYsc8l6w0wM7ZOiyQ==
Rw3XPwT+8UID5aK00A==
zDPp+Pskft/5iqS+0Q==
Z8h8hYCm/ULHXQ+YY2kJBcS9ZA==
vTDkm31vabx5EfoFMjLsVpBlz+fQfg==
+EcrRpZyp7tFba65dhvXBcS9ZA==
rHVJpwl6dLSATugw
gUoTghFSoTMpiXyQe9N3uOjQ
47Zwn/CkFQCty07ROs2D
NYkP+jcHuw6V
nfvdFnkHuw6V
L4piRRhAmfwGKITjemhRkmQ=
s6Jdx36Q+t5U7LE=
58iYH6dVmzYCnHZ/Zb+D7g==
IQ/WHZJWuVUD5aK00A==
Cf6t72PUxhnicjvBiFxqP0o2FPHw
DQr7l4R4rlEJ5aK00A==
62gezKeQv8mIIBbcZb+D7g==
kmuregister.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
cscript.exeflow pid process 7 1984 cscript.exe -
Loads dropped DLL 1 IoCs
Processes:
cscript.exepid process 1984 cscript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exejsc.execscript.exedescription pid process target process PID 880 set thread context of 1652 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe jsc.exe PID 1652 set thread context of 1396 1652 jsc.exe Explorer.EXE PID 1984 set thread context of 1396 1984 cscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
cscript.exedescription ioc process Key created \Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exejsc.execscript.exepid process 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe 1652 jsc.exe 1652 jsc.exe 1652 jsc.exe 1652 jsc.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
jsc.execscript.exepid process 1652 jsc.exe 1652 jsc.exe 1652 jsc.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe 1984 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exejsc.execscript.exedescription pid process Token: SeDebugPrivilege 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe Token: SeDebugPrivilege 1652 jsc.exe Token: SeDebugPrivilege 1984 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exeExplorer.EXEcscript.exedescription pid process target process PID 880 wrote to memory of 1116 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe MSBuild.exe PID 880 wrote to memory of 1116 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe MSBuild.exe PID 880 wrote to memory of 1116 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe MSBuild.exe PID 880 wrote to memory of 1992 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe CasPol.exe PID 880 wrote to memory of 1992 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe CasPol.exe PID 880 wrote to memory of 1992 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe CasPol.exe PID 880 wrote to memory of 2020 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe AddInUtil.exe PID 880 wrote to memory of 2020 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe AddInUtil.exe PID 880 wrote to memory of 2020 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe AddInUtil.exe PID 880 wrote to memory of 2024 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe dfsvc.exe PID 880 wrote to memory of 2024 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe dfsvc.exe PID 880 wrote to memory of 2024 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe dfsvc.exe PID 880 wrote to memory of 1720 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_compiler.exe PID 880 wrote to memory of 1720 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_compiler.exe PID 880 wrote to memory of 1720 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_compiler.exe PID 880 wrote to memory of 1716 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe mscorsvw.exe PID 880 wrote to memory of 1716 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe mscorsvw.exe PID 880 wrote to memory of 1716 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe mscorsvw.exe PID 880 wrote to memory of 1988 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe ComSvcConfig.exe PID 880 wrote to memory of 1988 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe ComSvcConfig.exe PID 880 wrote to memory of 1988 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe ComSvcConfig.exe PID 880 wrote to memory of 1980 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_regiis.exe PID 880 wrote to memory of 1980 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_regiis.exe PID 880 wrote to memory of 1980 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_regiis.exe PID 880 wrote to memory of 1144 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_regbrowsers.exe PID 880 wrote to memory of 1144 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_regbrowsers.exe PID 880 wrote to memory of 1144 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_regbrowsers.exe PID 880 wrote to memory of 1928 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe csc.exe PID 880 wrote to memory of 1928 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe csc.exe PID 880 wrote to memory of 1928 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe csc.exe PID 880 wrote to memory of 1376 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_state.exe PID 880 wrote to memory of 1376 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_state.exe PID 880 wrote to memory of 1376 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe aspnet_state.exe PID 880 wrote to memory of 1652 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe jsc.exe PID 880 wrote to memory of 1652 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe jsc.exe PID 880 wrote to memory of 1652 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe jsc.exe PID 880 wrote to memory of 1652 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe jsc.exe PID 880 wrote to memory of 1652 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe jsc.exe PID 880 wrote to memory of 1652 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe jsc.exe PID 880 wrote to memory of 1652 880 878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe jsc.exe PID 1396 wrote to memory of 1984 1396 Explorer.EXE cscript.exe PID 1396 wrote to memory of 1984 1396 Explorer.EXE cscript.exe PID 1396 wrote to memory of 1984 1396 Explorer.EXE cscript.exe PID 1396 wrote to memory of 1984 1396 Explorer.EXE cscript.exe PID 1984 wrote to memory of 1544 1984 cscript.exe Firefox.exe PID 1984 wrote to memory of 1544 1984 cscript.exe Firefox.exe PID 1984 wrote to memory of 1544 1984 cscript.exe Firefox.exe PID 1984 wrote to memory of 1544 1984 cscript.exe Firefox.exe PID 1984 wrote to memory of 1544 1984 cscript.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe"C:\Users\Admin\AppData\Local\Temp\878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
804KB
MD5b09588d000ef4bf2a3dddd85bd701423
SHA144a810ff8920a340a30b66d932253555143dc28b
SHA256ce4ffc1a12150b8523378553f2a97dd3fc44d5210ae6c296ab31e2c78f0d03c3
SHA5121d807d92da34ccba4628f2a55c3ac1c03ff63925d79e266b4e52d71002228cbde76206ec696c3e25143fc2e0cab56589155666ff6f8ea0ebfd5ebcd362168e2a
-
memory/880-55-0x000000001B170000-0x000000001B1E4000-memory.dmpFilesize
464KB
-
memory/880-54-0x0000000001230000-0x0000000001242000-memory.dmpFilesize
72KB
-
memory/1396-65-0x0000000004930000-0x00000000049EA000-memory.dmpFilesize
744KB
-
memory/1396-75-0x0000000007000000-0x00000000070FA000-memory.dmpFilesize
1000KB
-
memory/1396-72-0x0000000004930000-0x00000000049EA000-memory.dmpFilesize
744KB
-
memory/1396-71-0x0000000007000000-0x00000000070FA000-memory.dmpFilesize
1000KB
-
memory/1652-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1652-61-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/1652-64-0x00000000000B0000-0x00000000000C0000-memory.dmpFilesize
64KB
-
memory/1652-62-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB
-
memory/1652-63-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/1652-56-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1652-57-0x00000000004012B0-mapping.dmp
-
memory/1652-59-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1984-66-0x0000000000000000-mapping.dmp
-
memory/1984-70-0x00000000009C0000-0x0000000000A4F000-memory.dmpFilesize
572KB
-
memory/1984-69-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1984-73-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/1984-74-0x0000000076871000-0x0000000076873000-memory.dmpFilesize
8KB
-
memory/1984-68-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/1984-67-0x0000000000A70000-0x0000000000A92000-memory.dmpFilesize
136KB