Overview

overview

7

Static

static

1

sample.exe

windows7-x64

7

Analysis

  • max time kernel
    299s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    08-02-2023 08:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sample.exe

  • Size

    681KB

  • MD5

    02d32289149e7f8e271d7a863cb30990

  • SHA1

    d07dbcdb61a88e7887efa1332c47eb15963013cb

  • SHA256

    608c05ae5120ee3ba36e1f105c4136e5d0cb4b6024b453bc8587a82458d30b71

  • SHA512

    73beae3ac4b99b1b39e997e96e5270cc12b8c9a86a261dbbb2bfdfba8bbe465506e24fac4f4a97604a00e08f60970b081544482d7e7edbfc5ebefc44b2fce83d

  • SSDEEP

    12288:rbJKteY6nXxNguWxxOE+eN2+ZMZi+ocWeh3ih9HXAf:PgR6nXxlWiE+eN2GGiRcBYTQf

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Users\Admin\AppData\Local\Temp\sample.exe
      "C:\Users\Admin\AppData\Local\Temp\sample.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Users\Admin\AppData\Local\Temp\sample.exe
        "C:\Users\Admin\AppData\Local\Temp\sample.exe"
        3⤵
          PID:1108
        • C:\Users\Admin\AppData\Local\Temp\sample.exe
          "C:\Users\Admin\AppData\Local\Temp\sample.exe"
          3⤵
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:836
      • C:\Windows\SysWOW64\autochk.exe
        "C:\Windows\SysWOW64\autochk.exe"
        2⤵
          PID:1008
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\SysWOW64\explorer.exe"
          2⤵
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:760
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:1712
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            2⤵
              PID:1616
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x154
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1980

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\35_3201L9
            Filesize

            88KB

            MD5

            8ee018331e95a610680a789192a9d362

            SHA1

            e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

            SHA256

            94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

            SHA512

            4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\5drx6p.zip
            Filesize

            486KB

            MD5

            1e73cacce02ae20026a81f1e56416aa3

            SHA1

            f491a7301ce11cf11a92c0245c7e03d927422286

            SHA256

            0dd0dd38cde5a14e7d6d0830db62cc7037e521fd042b0b8da0763128b2c0b3f2

            SHA512

            afe77facd8b16cc744ac2277414ffaf83436999d15eb8ac707f8098e2f8ed4cb29b430392ebe46b7fa65b20730615bc33dee9416f7141da5032a630894980a0a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\sqlite3.def
            Filesize

            5KB

            MD5

            540f7ab54d3b2e6e69222de98bb6b10e

            SHA1

            55fa5084ee581043a071f77d604a21db8d584424

            SHA256

            c07c024bf43d8ba619740174d104eace6c3576cab357f4a2b0a29b8fd88164dc

            SHA512

            e21c1ac8313446c4d482839938784f626f33ef2bed681209839dc5a9cec856fd1595c8b017cada857eaa537f5c5be73f85845c7808eab209bf9c77b339876119

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\sqlite3.dll
            Filesize

            927KB

            MD5

            7fd80b1cc72dc580c02ca4cfbfb2592d

            SHA1

            18da905af878b27151b359cf1a7d0a650764e8a1

            SHA256

            1e6dccbdf8527abb53c289da920463b7895300d0d984cc7e91a3ecda4e673190

            SHA512

            13f7f29b5ed31c551aa5f27742557aa4d026a226087d6fcbca094819759ecc753a2c33b7422ae88dc6a4a0a966edb8485a18e59a0283ba2686cae5d78e0190a3

            Download Submit

          • \Users\Admin\AppData\Local\Temp\sqlite3.dll
            Filesize

            927KB

            MD5

            7fd80b1cc72dc580c02ca4cfbfb2592d

            SHA1

            18da905af878b27151b359cf1a7d0a650764e8a1

            SHA256

            1e6dccbdf8527abb53c289da920463b7895300d0d984cc7e91a3ecda4e673190

            SHA512

            13f7f29b5ed31c551aa5f27742557aa4d026a226087d6fcbca094819759ecc753a2c33b7422ae88dc6a4a0a966edb8485a18e59a0283ba2686cae5d78e0190a3

            Download Submit

          • memory/760-77-0x00000000020C0000-0x000000000214F000-memory.dmp

            Filesize

            572KB

            Download

          • memory/760-76-0x0000000002230000-0x0000000002533000-memory.dmp

            Filesize

            3.0MB

            Download

          • memory/760-75-0x0000000000080000-0x00000000000AD000-memory.dmp

            Filesize

            180KB

            Download

          • memory/760-74-0x00000000005B0000-0x0000000000831000-memory.dmp

            Filesize

            2.5MB

            Download

          • memory/760-73-0x0000000075401000-0x0000000075403000-memory.dmp

            Filesize

            8KB

            Download

          • memory/836-63-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

            Download

          • memory/836-61-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

            Download

          • memory/836-65-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

            Download

          • memory/836-69-0x0000000000110000-0x0000000000120000-memory.dmp

            Filesize

            64KB

            Download

          • memory/836-71-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

            Download

          • memory/836-67-0x0000000000C60000-0x0000000000F63000-memory.dmp

            Filesize

            3.0MB

            Download

          • memory/836-66-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

            Download

          • memory/836-60-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

            Download

          • memory/1404-78-0x0000000006420000-0x00000000064E8000-memory.dmp

            Filesize

            800KB

            Download

          • memory/1404-68-0x0000000004230000-0x0000000004328000-memory.dmp

            Filesize

            992KB

            Download

          • memory/1404-79-0x0000000004230000-0x0000000004328000-memory.dmp

            Filesize

            992KB

            Download

          • memory/1404-80-0x0000000006420000-0x00000000064E8000-memory.dmp

            Filesize

            800KB

            Download

          • memory/1616-83-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1972-54-0x0000000000BB0000-0x0000000000C60000-memory.dmp

            Filesize

            704KB

            Download

          • memory/1972-59-0x00000000006B0000-0x00000000006E6000-memory.dmp

            Filesize

            216KB

            Download

          • memory/1972-58-0x00000000045E0000-0x0000000004650000-memory.dmp

            Filesize

            448KB

            Download

          • memory/1972-57-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/1972-56-0x0000000000240000-0x0000000000254000-memory.dmp

            Filesize

            80KB

            Download

          • memory/1972-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

            Filesize

            8KB

            Download