04e338b306c1f8ae3c2025bfa779a5926f0432270792db5acb944e486c7893a5

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2023, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Product List.exe
Size 939KB
Sample230519-s6f2taee63
SHA256 04e338b306c1f8ae3c2025bfa779a5926f0432270792db5acb944e486c7893a5
MD5 99a12ce4a1c70ef4268d828b018bcbf6
SHA1 31eade1627cd235f7790806ac56d8da1dcb788a8
SHA512 410e12487610b023ec839845ffc081d153504104dfe46c2919742bf237d3e326323080953b24a299037ec9126785e1dd13b64d76014392b89e867a23c7518b55
SSDEEP 12288:80VJLpNaPn0YPX/NWGhy4R2Q4yD2bX4auXoG46IxMPOEkWYiHkbjAsC50pB52I01:9V8P0N+9462TuXrbIyPO94HkwlY2X
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	Product List.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4452 set thread context of 2136	4452	Product List.exe	90
PID 2136 set thread context of 3156	2136	Product List.exe	40
PID 3728 set thread context of 3156	3728	chkdsk.exe	40

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	2768	WerFault.exe	92

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2136	Product List.exe
2136	Product List.exe
2136	Product List.exe
2136	Product List.exe
2136	Product List.exe
2136	Product List.exe
2136	Product List.exe
2136	Product List.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3156	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2136	Product List.exe
2136	Product List.exe
2136	Product List.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe
3728	chkdsk.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	Product List.exe
Token: SeDebugPrivilege	3728	chkdsk.exe
Token: SeShutdownPrivilege	3156	Explorer.EXE
Token: SeCreatePagefilePrivilege	3156	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 2136	4452	Product List.exe	90
PID 4452 wrote to memory of 2136	4452	Product List.exe	90
PID 4452 wrote to memory of 2136	4452	Product List.exe	90
PID 4452 wrote to memory of 2136	4452	Product List.exe	90
PID 4452 wrote to memory of 2136	4452	Product List.exe	90
PID 4452 wrote to memory of 2136	4452	Product List.exe	90
PID 3156 wrote to memory of 3728	3156	Explorer.EXE	91
PID 3156 wrote to memory of 3728	3156	Explorer.EXE	91
PID 3156 wrote to memory of 3728	3156	Explorer.EXE	91
PID 3728 wrote to memory of 2768	3728	chkdsk.exe	92
PID 3728 wrote to memory of 2768	3728	chkdsk.exe	92
PID 3728 wrote to memory of 2768	3728	chkdsk.exe	92

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\Product List.exe
  "C:\Users\Admin\AppData\Local\Temp\Product List.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Product List.exe
    "C:\Users\Admin\AppData\Local\Temp\Product List.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2768
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2768 -s 120
      4⤵
      Program crash
      PID:844

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 2768 -ip 2768
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-142-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2136-145-0x00000000014B0000-0x00000000014C0000-memory.dmp

Download

memory/2136-144-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2136-143-0x00000000014D0000-0x000000000181A000-memory.dmp

Download

memory/2136-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3156-156-0x00000000033E0000-0x00000000034A2000-memory.dmp

Download

memory/3156-152-0x00000000033E0000-0x00000000034A2000-memory.dmp

Download

memory/3156-146-0x00000000031F0000-0x00000000032B5000-memory.dmp

Download

memory/3728-149-0x00000000003B0000-0x00000000003DD000-memory.dmp

Download

memory/3728-147-0x0000000000950000-0x000000000095A000-memory.dmp

Download

memory/3728-148-0x0000000000950000-0x000000000095A000-memory.dmp

Download

memory/3728-150-0x00000000003B0000-0x00000000003DD000-memory.dmp

Download

memory/3728-151-0x0000000000E90000-0x00000000011DA000-memory.dmp

Download

memory/3728-153-0x0000000000CC0000-0x0000000000D4F000-memory.dmp

Download

memory/4452-139-0x00000000077B0000-0x000000000784C000-memory.dmp

Download

memory/4452-138-0x0000000005C70000-0x0000000005C80000-memory.dmp

Download

memory/4452-137-0x0000000005C70000-0x0000000005C80000-memory.dmp

Download

memory/4452-136-0x00000000059A0000-0x00000000059AA000-memory.dmp

Download

memory/4452-133-0x0000000000F00000-0x0000000000FF0000-memory.dmp

Download

memory/4452-135-0x00000000059E0000-0x0000000005A72000-memory.dmp

Download

memory/4452-134-0x0000000005EF0000-0x0000000006494000-memory.dmp

Download