7ccd7791942d7fb2a511b0841af3669d365aba20dd73739808c3666352fa9dea

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
17/01/2024, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Revised documents.exe
Size 1.0MB
Sample240117-lrl6yscgbl
SHA256 7ccd7791942d7fb2a511b0841af3669d365aba20dd73739808c3666352fa9dea
MD5 adce9ab8247be2087a3c8c897e6cfd97
SHA1 27ac60c8d23d4c93d65a1981db54a1a1d94359a7
SHA512 85abf88048abad442740037d107572658baaed5c553fe2c129fa31bb4b62b20e407272cbe5d986d6dddd2cd86fd91ac467d1fa5280220af81f3324d29dfa03ee
SSDEEP 12288:uz5Y1MN62qZaSjVObADlonESN4A0wr35ZSAhqnAPwMbjRKhzJ2ShvkBx9XZXbIG:uzGSUZaITo4A0wrbSA0APwW8eSmr9Bn
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3708 set thread context of 4604	3708	Revised documents.exe	103
PID 4604 set thread context of 3596	4604	Revised documents.exe	18
PID 4604 set thread context of 4056	4604	Revised documents.exe	106
PID 4056 set thread context of 3596	4056	tasklist.exe	18

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4056	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3708	Revised documents.exe
3708	Revised documents.exe
3708	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4604	Revised documents.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4604	Revised documents.exe
3596	Explorer.EXE
3596	Explorer.EXE
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe
4056	tasklist.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	Revised documents.exe
Token: SeShutdownPrivilege	3596	Explorer.EXE
Token: SeCreatePagefilePrivilege	3596	Explorer.EXE
Token: SeShutdownPrivilege	3596	Explorer.EXE
Token: SeCreatePagefilePrivilege	3596	Explorer.EXE
Token: SeManageVolumePrivilege	3716	svchost.exe
Token: SeShutdownPrivilege	3596	Explorer.EXE
Token: SeCreatePagefilePrivilege	3596	Explorer.EXE
Token: SeShutdownPrivilege	3596	Explorer.EXE
Token: SeCreatePagefilePrivilege	3596	Explorer.EXE
Token: SeShutdownPrivilege	3596	Explorer.EXE
Token: SeCreatePagefilePrivilege	3596	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3596	Explorer.EXE
3596	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3596	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4604	3708	Revised documents.exe	103
PID 3708 wrote to memory of 4604	3708	Revised documents.exe	103
PID 3708 wrote to memory of 4604	3708	Revised documents.exe	103
PID 3708 wrote to memory of 4604	3708	Revised documents.exe	103
PID 3708 wrote to memory of 4604	3708	Revised documents.exe	103
PID 3708 wrote to memory of 4604	3708	Revised documents.exe	103
PID 3596 wrote to memory of 4056	3596	Explorer.EXE	106
PID 3596 wrote to memory of 4056	3596	Explorer.EXE	106
PID 3596 wrote to memory of 4056	3596	Explorer.EXE	106
PID 4056 wrote to memory of 4784	4056	tasklist.exe	116
PID 4056 wrote to memory of 4784	4056	tasklist.exe	116
PID 4056 wrote to memory of 4784	4056	tasklist.exe	116

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\Revised documents.exe
  "C:\Users\Admin\AppData\Local\Temp\Revised documents.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Revised documents.exe
    "C:\Users\Admin\AppData\Local\Temp\Revised documents.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4604
- C:\Windows\SysWOW64\tasklist.exe
  "C:\Windows\SysWOW64\tasklist.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates processes with tasklist
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4784

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3596-21-0x000000000CBE0000-0x000000000F77F000-memory.dmp

Download

memory/3596-29-0x000000000CBE0000-0x000000000F77F000-memory.dmp

Download

memory/3596-31-0x0000000002F20000-0x0000000002FDF000-memory.dmp

Download

memory/3596-32-0x0000000002F20000-0x0000000002FDF000-memory.dmp

Download

memory/3596-39-0x0000000002F20000-0x0000000002FDF000-memory.dmp

Download

memory/3708-12-0x0000000004E70000-0x0000000004E80000-memory.dmp

Download

memory/3708-15-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

memory/3708-7-0x0000000005260000-0x000000000526A000-memory.dmp

Download

memory/3708-8-0x0000000004940000-0x000000000494E000-memory.dmp

Download

memory/3708-9-0x0000000006CB0000-0x0000000006D2E000-memory.dmp

Download

memory/3708-10-0x0000000006DD0000-0x0000000006E6C000-memory.dmp

Download

memory/3708-11-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

memory/3708-0-0x00000000003F0000-0x0000000000500000-memory.dmp

Download

memory/3708-1-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

memory/3708-6-0x0000000005240000-0x0000000005260000-memory.dmp

Download

memory/3708-2-0x00000000053D0000-0x0000000005974000-memory.dmp

Download

memory/3708-3-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Download

memory/3708-4-0x0000000004E70000-0x0000000004E80000-memory.dmp

Download

memory/3708-5-0x0000000005050000-0x000000000505A000-memory.dmp

Download

memory/3716-56-0x000001B50E150000-0x000001B50E160000-memory.dmp

Download

memory/3716-40-0x000001B50E050000-0x000001B50E060000-memory.dmp

Download

memory/3716-72-0x000001B5164C0000-0x000001B5164C1000-memory.dmp

Download

memory/3716-76-0x000001B516600000-0x000001B516601000-memory.dmp

Download

memory/3716-75-0x000001B5164F0000-0x000001B5164F1000-memory.dmp

Download

memory/3716-74-0x000001B5164F0000-0x000001B5164F1000-memory.dmp

Download

memory/4056-28-0x0000000003130000-0x00000000031D0000-memory.dmp

Download

memory/4056-22-0x0000000000D40000-0x0000000000D7B000-memory.dmp

Download

memory/4056-27-0x0000000000D40000-0x0000000000D7B000-memory.dmp

Download

memory/4056-26-0x0000000003210000-0x000000000355A000-memory.dmp

Download

memory/4056-30-0x0000000000D40000-0x0000000000D7B000-memory.dmp

Download

memory/4056-23-0x0000000000D40000-0x0000000000D7B000-memory.dmp

Download

memory/4604-24-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4604-25-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/4604-20-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/4604-19-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4604-18-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4604-17-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4604-16-0x0000000001280000-0x00000000015CA000-memory.dmp

Download

memory/4604-13-0x0000000000400000-0x000000000043F000-memory.dmp

Download