Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2023 12:56

General

  • Target

    193460b43722438a162df4b740d8ccd4.exe

  • Size

    692KB

  • MD5

    193460b43722438a162df4b740d8ccd4

  • SHA1

    adde849ff2ebd5ab85bdb4075b6ba812fc1f01e7

  • SHA256

    87e02f29fe50e052f7fb2f65f7795484eb7ae6c41859c755fc5f86e81de6f020

  • SHA512

    35443ba627bfb07f36b2b9e4d4fedb27de861666ba21781237d66313d06825f542fe5992cc03e7f5eb82b4df858169c273377ca8df37a320e61a80f4da6a93dd

  • SSDEEP

    12288:P/uAGTo28+SCyqzQSTorJoBrcN6kNupgt2JxloBgl:P/uAa8vcDcrKBrUxcdJxlo2

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\193460b43722438a162df4b740d8ccd4.exe
    "C:\Users\Admin\AppData\Local\Temp\193460b43722438a162df4b740d8ccd4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Users\Admin\AppData\Local\Temp\193460b43722438a162df4b740d8ccd4.exe
      C:\Users\Admin\AppData\Local\Temp\193460b43722438a162df4b740d8ccd4.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3744
      • C:\winrarlab\69888B74A53.exe
        "C:\winrarlab\69888B74A53.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4576
        • C:\winrarlab\69888B74A53.exe
          C:\winrarlab\69888B74A53.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2000
          • C:\Users\Admin\AppData\Local\Temp\5sWBB32.exe
            "C:\Users\Admin\AppData\Local\Temp\5sWBB32.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3592

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5sWBB32.exe
    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • C:\winrarlab\4750006A1CE60F1
    Filesize

    197KB

    MD5

    45858b33b650c149aee2b1a8f8b813b4

    SHA1

    28dfe14e74bf919f88c7710e7350403c2753efa0

    SHA256

    2d7e9299bef4f9d2ea6e3daf7eb056c71b1fa9e21feb84f083fe6fc51de1c92e

    SHA512

    9d67266abe38470b989e18edc3144eaf796733385d95b671d8e7927109b0ed02265b826bb669387f3ffd4252d4945eda9f24fedb8eff57db7930d75207ff6b15

  • C:\winrarlab\69888B74A53.exe
    Filesize

    692KB

    MD5

    193460b43722438a162df4b740d8ccd4

    SHA1

    adde849ff2ebd5ab85bdb4075b6ba812fc1f01e7

    SHA256

    87e02f29fe50e052f7fb2f65f7795484eb7ae6c41859c755fc5f86e81de6f020

    SHA512

    35443ba627bfb07f36b2b9e4d4fedb27de861666ba21781237d66313d06825f542fe5992cc03e7f5eb82b4df858169c273377ca8df37a320e61a80f4da6a93dd

  • memory/2000-53-0x0000000000400000-0x000000000048C000-memory.dmp
    Filesize

    560KB

  • memory/2000-61-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/2000-49-0x00000000022D0000-0x00000000023C0000-memory.dmp
    Filesize

    960KB

  • memory/2000-47-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/2000-43-0x0000000000A30000-0x0000000000B20000-memory.dmp
    Filesize

    960KB

  • memory/2000-40-0x0000000000A30000-0x0000000000B20000-memory.dmp
    Filesize

    960KB

  • memory/2000-39-0x0000000000A30000-0x0000000000B20000-memory.dmp
    Filesize

    960KB

  • memory/2000-38-0x0000000000400000-0x000000000048C000-memory.dmp
    Filesize

    560KB

  • memory/3592-102-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-125-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-151-0x0000000002E40000-0x0000000002EA3000-memory.dmp
    Filesize

    396KB

  • memory/3592-109-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-150-0x00000000030C0000-0x0000000003510000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-149-0x00000000030C0000-0x0000000003510000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-148-0x00000000030C0000-0x0000000003510000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-110-0x0000000075190000-0x00000000755E0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-139-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-138-0x0000000002E40000-0x0000000002EA3000-memory.dmp
    Filesize

    396KB

  • memory/3592-137-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-135-0x0000000003510000-0x0000000003550000-memory.dmp
    Filesize

    256KB

  • memory/3592-136-0x0000000075970000-0x00000000759D3000-memory.dmp
    Filesize

    396KB

  • memory/3592-134-0x0000000075190000-0x00000000755E0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-133-0x00000000030C0000-0x0000000003510000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-51-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-132-0x00000000030C0000-0x0000000003510000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-57-0x0000000001000000-0x0000000001004000-memory.dmp
    Filesize

    16KB

  • memory/3592-56-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-60-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-130-0x00000000030C0000-0x0000000003510000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-63-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-64-0x00000000001D0000-0x00000000001D5000-memory.dmp
    Filesize

    20KB

  • memory/3592-67-0x00000000001E0000-0x00000000001E6000-memory.dmp
    Filesize

    24KB

  • memory/3592-70-0x00000000001F0000-0x00000000001F7000-memory.dmp
    Filesize

    28KB

  • memory/3592-131-0x00000000030C0000-0x0000000003510000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-72-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-75-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-79-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-111-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-81-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-76-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-83-0x0000000002A70000-0x0000000002EC0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-84-0x0000000077792000-0x0000000077794000-memory.dmp
    Filesize

    8KB

  • memory/3592-86-0x0000000077794000-0x0000000077796000-memory.dmp
    Filesize

    8KB

  • memory/3592-87-0x0000000077792000-0x0000000077794000-memory.dmp
    Filesize

    8KB

  • memory/3592-89-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-91-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-92-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-94-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-95-0x0000000075190000-0x00000000755E0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-99-0x0000000075190000-0x00000000755E0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-98-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-129-0x0000000075190000-0x00000000755E0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-104-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-106-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-108-0x0000000075190000-0x00000000755E0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-107-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-127-0x00000000001F0000-0x00000000001F7000-memory.dmp
    Filesize

    28KB

  • memory/3592-128-0x0000000000450000-0x0000000000459000-memory.dmp
    Filesize

    36KB

  • memory/3592-80-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-113-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-114-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-116-0x0000000003510000-0x0000000003550000-memory.dmp
    Filesize

    256KB

  • memory/3592-121-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-122-0x00000000027A0000-0x00000000027A5000-memory.dmp
    Filesize

    20KB

  • memory/3592-120-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-119-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-118-0x0000000003550000-0x00000000035B3000-memory.dmp
    Filesize

    396KB

  • memory/3592-117-0x0000000075970000-0x00000000759D3000-memory.dmp
    Filesize

    396KB

  • memory/3592-115-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-112-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-105-0x0000000075190000-0x00000000755E0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-103-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-123-0x0000000075190000-0x00000000755E0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-101-0x00000000030C0000-0x0000000003510000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-124-0x0000000075190000-0x00000000755E0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-100-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-97-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-96-0x0000000075190000-0x00000000755E0000-memory.dmp
    Filesize

    4.3MB

  • memory/3592-93-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-90-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-88-0x0000000077792000-0x0000000077794000-memory.dmp
    Filesize

    8KB

  • memory/3592-126-0x00000000001E0000-0x00000000001E6000-memory.dmp
    Filesize

    24KB

  • memory/3592-85-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
    Filesize

    312KB

  • memory/3592-82-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-78-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3592-77-0x0000000000450000-0x0000000000459000-memory.dmp
    Filesize

    36KB

  • memory/3592-74-0x0000000000440000-0x0000000000446000-memory.dmp
    Filesize

    24KB

  • memory/3592-59-0x00000000005D0000-0x000000000061E000-memory.dmp
    Filesize

    312KB

  • memory/3744-32-0x0000000000960000-0x0000000000A50000-memory.dmp
    Filesize

    960KB

  • memory/3744-8-0x0000000000960000-0x0000000000A50000-memory.dmp
    Filesize

    960KB

  • memory/3744-4-0x0000000000400000-0x000000000048C000-memory.dmp
    Filesize

    560KB

  • memory/3744-18-0x0000000077792000-0x0000000077794000-memory.dmp
    Filesize

    8KB

  • memory/3744-2-0x0000000000400000-0x000000000048C000-memory.dmp
    Filesize

    560KB

  • memory/3744-5-0x0000000000400000-0x000000000048C000-memory.dmp
    Filesize

    560KB

  • memory/3744-11-0x00000000004D0000-0x00000000004E0000-memory.dmp
    Filesize

    64KB

  • memory/3744-19-0x00000000004D0000-0x00000000004D2000-memory.dmp
    Filesize

    8KB

  • memory/3744-35-0x00000000004D0000-0x00000000004E0000-memory.dmp
    Filesize

    64KB

  • memory/3744-14-0x0000000077792000-0x0000000077794000-memory.dmp
    Filesize

    8KB

  • memory/3744-12-0x0000000000960000-0x0000000000A60000-memory.dmp
    Filesize

    1024KB

  • memory/3744-9-0x0000000000400000-0x000000000048C000-memory.dmp
    Filesize

    560KB

  • memory/3744-13-0x00000000004E0000-0x00000000004E1000-memory.dmp
    Filesize

    4KB

  • memory/3744-16-0x00000000004E0000-0x00000000004E1000-memory.dmp
    Filesize

    4KB

  • memory/3744-37-0x0000000000960000-0x0000000000A60000-memory.dmp
    Filesize

    1024KB

  • memory/3744-34-0x0000000000960000-0x0000000000A50000-memory.dmp
    Filesize

    960KB

  • memory/3744-10-0x0000000000960000-0x0000000000A50000-memory.dmp
    Filesize

    960KB

  • memory/3744-27-0x0000000000400000-0x000000000048C000-memory.dmp
    Filesize

    560KB

  • memory/3744-7-0x0000000000400000-0x000000000048C000-memory.dmp
    Filesize

    560KB