Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:12
Static task
static1
Behavioral task
behavioral1
Sample
U prilogu lista novih narudzbi.exe
Resource
win7-20231215-en
General
-
Target
U prilogu lista novih narudzbi.exe
-
Size
776KB
-
MD5
75c1a9a40b3594e87dfd526d5d02786e
-
SHA1
9da904b9ade761c097d214a2fa823edc219522da
-
SHA256
be6c4cf0c6c048a2a1c98374746b282bae9c7eb191ec193a747b47910ade5aa1
-
SHA512
808bda7370c3c5c00faca7a088b059baa59545f17bd8167964565379dbf77d0093824cc4496c7154dc65b83dea92e118027e737ac640a6cd697928f6f81ed7a9
-
SSDEEP
24576:20vDyK4nrFuXSrTb/bqQlt/GR4lHKg6Qsi08StK2PwxNcH:20uKYFuXkcssi08IK2ozcH
Malware Config
Signatures
-
Drops startup file 3 IoCs
Processes:
U prilogu lista novih narudzbi.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype.lnk U prilogu lista novih narudzbi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
skype.exepid process 2932 skype.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2704 cmd.exe 2704 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
skype.exeAddInProcess32.exeNETSTAT.EXEdescription pid process target process PID 2932 set thread context of 2556 2932 skype.exe AddInProcess32.exe PID 2556 set thread context of 1264 2556 AddInProcess32.exe Explorer.EXE PID 2412 set thread context of 1264 2412 NETSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 2412 NETSTAT.EXE -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
U prilogu lista novih narudzbi.exeskype.exeskype.exeAddInProcess32.exeNETSTAT.EXEpid process 1364 U prilogu lista novih narudzbi.exe 1364 U prilogu lista novih narudzbi.exe 1364 U prilogu lista novih narudzbi.exe 2684 skype.exe 2684 skype.exe 2684 skype.exe 2684 skype.exe 2684 skype.exe 2684 skype.exe 2932 skype.exe 2932 skype.exe 2932 skype.exe 2932 skype.exe 2556 AddInProcess32.exe 2556 AddInProcess32.exe 2556 AddInProcess32.exe 2556 AddInProcess32.exe 2412 NETSTAT.EXE 2412 NETSTAT.EXE 2412 NETSTAT.EXE 2412 NETSTAT.EXE 2412 NETSTAT.EXE 2412 NETSTAT.EXE 2412 NETSTAT.EXE 2412 NETSTAT.EXE 2412 NETSTAT.EXE 2412 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
AddInProcess32.exeNETSTAT.EXEpid process 2556 AddInProcess32.exe 2556 AddInProcess32.exe 2556 AddInProcess32.exe 2412 NETSTAT.EXE 2412 NETSTAT.EXE -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
U prilogu lista novih narudzbi.exepid process 1364 U prilogu lista novih narudzbi.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
U prilogu lista novih narudzbi.exeskype.exeskype.exeAddInProcess32.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1364 U prilogu lista novih narudzbi.exe Token: SeDebugPrivilege 2684 skype.exe Token: SeDebugPrivilege 2932 skype.exe Token: SeDebugPrivilege 2556 AddInProcess32.exe Token: SeDebugPrivilege 2412 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
U prilogu lista novih narudzbi.exeskype.execmd.exeskype.exeExplorer.EXEdescription pid process target process PID 1364 wrote to memory of 2684 1364 U prilogu lista novih narudzbi.exe skype.exe PID 1364 wrote to memory of 2684 1364 U prilogu lista novih narudzbi.exe skype.exe PID 1364 wrote to memory of 2684 1364 U prilogu lista novih narudzbi.exe skype.exe PID 1364 wrote to memory of 2684 1364 U prilogu lista novih narudzbi.exe skype.exe PID 2684 wrote to memory of 2704 2684 skype.exe cmd.exe PID 2684 wrote to memory of 2704 2684 skype.exe cmd.exe PID 2684 wrote to memory of 2704 2684 skype.exe cmd.exe PID 2684 wrote to memory of 2704 2684 skype.exe cmd.exe PID 2704 wrote to memory of 2608 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2608 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2608 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2608 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2748 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2748 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2748 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2748 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2932 2704 cmd.exe skype.exe PID 2704 wrote to memory of 2932 2704 cmd.exe skype.exe PID 2704 wrote to memory of 2932 2704 cmd.exe skype.exe PID 2704 wrote to memory of 2932 2704 cmd.exe skype.exe PID 2932 wrote to memory of 2556 2932 skype.exe AddInProcess32.exe PID 2932 wrote to memory of 2556 2932 skype.exe AddInProcess32.exe PID 2932 wrote to memory of 2556 2932 skype.exe AddInProcess32.exe PID 2932 wrote to memory of 2556 2932 skype.exe AddInProcess32.exe PID 2932 wrote to memory of 2556 2932 skype.exe AddInProcess32.exe PID 2932 wrote to memory of 2556 2932 skype.exe AddInProcess32.exe PID 2932 wrote to memory of 2556 2932 skype.exe AddInProcess32.exe PID 1264 wrote to memory of 2412 1264 Explorer.EXE NETSTAT.EXE PID 1264 wrote to memory of 2412 1264 Explorer.EXE NETSTAT.EXE PID 1264 wrote to memory of 2412 1264 Explorer.EXE NETSTAT.EXE PID 1264 wrote to memory of 2412 1264 Explorer.EXE NETSTAT.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\U prilogu lista novih narudzbi.exe"C:\Users\Admin\AppData\Local\Temp\U prilogu lista novih narudzbi.exe"2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\skype.exe"C:\Users\Admin\AppData\Local\Temp\skype.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\Admin\AppData\Local\Temp\skype.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"4⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 205⤵
- Runs ping.exe
PID:2608 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 205⤵
- Runs ping.exe
PID:2748 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2556 -
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exeFilesize
776KB
MD575c1a9a40b3594e87dfd526d5d02786e
SHA19da904b9ade761c097d214a2fa823edc219522da
SHA256be6c4cf0c6c048a2a1c98374746b282bae9c7eb191ec193a747b47910ade5aa1
SHA512808bda7370c3c5c00faca7a088b059baa59545f17bd8167964565379dbf77d0093824cc4496c7154dc65b83dea92e118027e737ac640a6cd697928f6f81ed7a9
-
memory/1264-39-0x0000000002CF0000-0x0000000002DF0000-memory.dmpFilesize
1024KB
-
memory/1264-41-0x00000000049A0000-0x0000000004A74000-memory.dmpFilesize
848KB
-
memory/1264-50-0x00000000049A0000-0x0000000004A74000-memory.dmpFilesize
848KB
-
memory/1364-1-0x00000000740A0000-0x000000007478E000-memory.dmpFilesize
6.9MB
-
memory/1364-0-0x0000000000810000-0x00000000008D8000-memory.dmpFilesize
800KB
-
memory/1364-2-0x0000000004D70000-0x0000000004DB0000-memory.dmpFilesize
256KB
-
memory/1364-3-0x0000000004DB0000-0x0000000004DF4000-memory.dmpFilesize
272KB
-
memory/1364-5-0x00000000740A0000-0x000000007478E000-memory.dmpFilesize
6.9MB
-
memory/2412-43-0x0000000000860000-0x0000000000869000-memory.dmpFilesize
36KB
-
memory/2412-42-0x0000000000860000-0x0000000000869000-memory.dmpFilesize
36KB
-
memory/2412-47-0x0000000000530000-0x00000000005BF000-memory.dmpFilesize
572KB
-
memory/2412-46-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/2412-45-0x00000000022E0000-0x00000000025E3000-memory.dmpFilesize
3.0MB
-
memory/2412-44-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/2556-38-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2556-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2556-27-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2556-25-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2556-33-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2556-40-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/2556-34-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2556-36-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/2556-37-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2684-8-0x00000000740A0000-0x000000007478E000-memory.dmpFilesize
6.9MB
-
memory/2684-7-0x00000000048D0000-0x0000000004910000-memory.dmpFilesize
256KB
-
memory/2684-6-0x00000000740A0000-0x000000007478E000-memory.dmpFilesize
6.9MB
-
memory/2932-19-0x0000000000E40000-0x0000000000F08000-memory.dmpFilesize
800KB
-
memory/2932-35-0x0000000072FB0000-0x000000007369E000-memory.dmpFilesize
6.9MB
-
memory/2932-32-0x00000000049C0000-0x0000000004A00000-memory.dmpFilesize
256KB
-
memory/2932-31-0x00000000049C0000-0x0000000004A00000-memory.dmpFilesize
256KB
-
memory/2932-30-0x0000000072FB0000-0x000000007369E000-memory.dmpFilesize
6.9MB
-
memory/2932-24-0x00000000005A0000-0x00000000005A6000-memory.dmpFilesize
24KB
-
memory/2932-23-0x0000000000500000-0x000000000051A000-memory.dmpFilesize
104KB
-
memory/2932-22-0x00000000049C0000-0x0000000004A00000-memory.dmpFilesize
256KB
-
memory/2932-21-0x00000000049C0000-0x0000000004A00000-memory.dmpFilesize
256KB
-
memory/2932-20-0x0000000072FB0000-0x000000007369E000-memory.dmpFilesize
6.9MB