Analysis
-
max time kernel
51s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
11-05-2023 08:31
Behavioral task
behavioral1
Sample
792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe
Resource
win10-20230220-en
General
-
Target
792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe
-
Size
277KB
-
MD5
405035ce873542c0bed986de9feb5718
-
SHA1
9e2f1ec3109a335936a461d804289f3434ca5344
-
SHA256
792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208
-
SHA512
3e33ac120d0f232aac1d292bf6954d43a7cc4293d88c732c0bf7053821914080e9d073d69087a03e106267bb8a94dfc9fcca37e9109fe6c51f6671a178905c86
-
SSDEEP
6144:3XzKdNY49u8rVkJxaHWgzkx2/bQcFF01netb:Ia4AlCHzzZFF01w
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2456-122-0x0000000000E10000-0x0000000000EB0000-memory.dmp upx behavioral1/memory/2456-129-0x0000000000E10000-0x0000000000EB0000-memory.dmp upx -
Executes dropped EXE 2 IoCs
pid Process 2896 ITS SB App Switch.exe 3012 ITS SB App Switch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2456 792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe 2456 792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe 2456 792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe 2456 792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2896 2456 792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe 66 PID 2456 wrote to memory of 2896 2456 792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe 66 PID 2456 wrote to memory of 2896 2456 792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe 66 PID 2456 wrote to memory of 3012 2456 792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe 67 PID 2456 wrote to memory of 3012 2456 792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe 67 PID 2456 wrote to memory of 3012 2456 792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe 67
Processes
-
C:\Users\Admin\AppData\Local\Temp\792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe"C:\Users\Admin\AppData\Local\Temp\792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"2⤵
- Executes dropped EXE
PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"2⤵
- Executes dropped EXE
PID:3012
-
Network
-
Remote address:8.8.8.8:53Requestwww.programworkshop.comIN AResponsewww.programworkshop.comIN A64.106.220.214
-
GEThttp://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exeRemote address:64.106.220.214:80RequestGET /sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/ HTTP/1.1
User-Agent: /DownloadSecureBrowser
Host: www.programworkshop.com
ResponseHTTP/1.1 403 Url not valid
Content-Type: text/html
From: P01
p3p: CP="ALL DSP COR CURa ADMo DEVa TAIa CONi OUR DELa STP BUS PHY ONL UNI PUR COM NAV DEM STA"
Date: Thu, 11 May 2023 08:31:14 GMT
Content-Length: 1233
-
Remote address:8.8.8.8:53Request214.220.106.64.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.254.224.20.in-addr.arpaIN PTRResponse
-
64.106.220.214:80http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/http792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe603 B 1.7kB 6 4
HTTP Request
GET http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/HTTP Response
403 -
322 B 7
-
322 B 7
-
8.8.8.8:53www.programworkshop.comdns792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe69 B 85 B 1 1
DNS Request
www.programworkshop.com
DNS Response
64.106.220.214
-
73 B 154 B 1 1
DNS Request
214.220.106.64.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
73.254.224.20.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5368332fca74f48697d842c5f4698ae1d
SHA10275153a1e62bd0eca0b02168895517ed66aac56
SHA2563a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59
SHA512fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5
-
Filesize
87KB
MD5368332fca74f48697d842c5f4698ae1d
SHA10275153a1e62bd0eca0b02168895517ed66aac56
SHA2563a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59
SHA512fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5
-
Filesize
87KB
MD5368332fca74f48697d842c5f4698ae1d
SHA10275153a1e62bd0eca0b02168895517ed66aac56
SHA2563a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59
SHA512fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5