Analysis
-
max time kernel
147s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:21
Static task
static1
Behavioral task
behavioral1
Sample
U prilogu lista novih narudzbi.exe
Resource
win7-20231129-en
General
-
Target
U prilogu lista novih narudzbi.exe
-
Size
776KB
-
MD5
75c1a9a40b3594e87dfd526d5d02786e
-
SHA1
9da904b9ade761c097d214a2fa823edc219522da
-
SHA256
be6c4cf0c6c048a2a1c98374746b282bae9c7eb191ec193a747b47910ade5aa1
-
SHA512
808bda7370c3c5c00faca7a088b059baa59545f17bd8167964565379dbf77d0093824cc4496c7154dc65b83dea92e118027e737ac640a6cd697928f6f81ed7a9
-
SSDEEP
24576:20vDyK4nrFuXSrTb/bqQlt/GR4lHKg6Qsi08StK2PwxNcH:20uKYFuXkcssi08IK2ozcH
Malware Config
Signatures
-
Drops startup file 3 IoCs
Processes:
U prilogu lista novih narudzbi.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype.lnk U prilogu lista novih narudzbi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
skype.exepid process 2548 skype.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2632 cmd.exe 2632 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
skype.exeAddInProcess32.execscript.exedescription pid process target process PID 2548 set thread context of 1624 2548 skype.exe AddInProcess32.exe PID 1624 set thread context of 1216 1624 AddInProcess32.exe Explorer.EXE PID 1776 set thread context of 1216 1776 cscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
U prilogu lista novih narudzbi.exeskype.exeskype.exeAddInProcess32.execscript.exepid process 2932 U prilogu lista novih narudzbi.exe 2932 U prilogu lista novih narudzbi.exe 2932 U prilogu lista novih narudzbi.exe 1628 skype.exe 1628 skype.exe 1628 skype.exe 1628 skype.exe 1628 skype.exe 1628 skype.exe 2548 skype.exe 2548 skype.exe 2548 skype.exe 2548 skype.exe 1624 AddInProcess32.exe 1624 AddInProcess32.exe 1624 AddInProcess32.exe 1624 AddInProcess32.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe 1776 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
AddInProcess32.execscript.exepid process 1624 AddInProcess32.exe 1624 AddInProcess32.exe 1624 AddInProcess32.exe 1776 cscript.exe 1776 cscript.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
U prilogu lista novih narudzbi.exepid process 2932 U prilogu lista novih narudzbi.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
U prilogu lista novih narudzbi.exeskype.exeskype.exeAddInProcess32.execscript.exedescription pid process Token: SeDebugPrivilege 2932 U prilogu lista novih narudzbi.exe Token: SeDebugPrivilege 1628 skype.exe Token: SeDebugPrivilege 2548 skype.exe Token: SeDebugPrivilege 1624 AddInProcess32.exe Token: SeDebugPrivilege 1776 cscript.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
U prilogu lista novih narudzbi.exeskype.execmd.exeskype.exeExplorer.EXEdescription pid process target process PID 2932 wrote to memory of 1628 2932 U prilogu lista novih narudzbi.exe skype.exe PID 2932 wrote to memory of 1628 2932 U prilogu lista novih narudzbi.exe skype.exe PID 2932 wrote to memory of 1628 2932 U prilogu lista novih narudzbi.exe skype.exe PID 2932 wrote to memory of 1628 2932 U prilogu lista novih narudzbi.exe skype.exe PID 1628 wrote to memory of 2632 1628 skype.exe cmd.exe PID 1628 wrote to memory of 2632 1628 skype.exe cmd.exe PID 1628 wrote to memory of 2632 1628 skype.exe cmd.exe PID 1628 wrote to memory of 2632 1628 skype.exe cmd.exe PID 2632 wrote to memory of 3040 2632 cmd.exe PING.EXE PID 2632 wrote to memory of 3040 2632 cmd.exe PING.EXE PID 2632 wrote to memory of 3040 2632 cmd.exe PING.EXE PID 2632 wrote to memory of 3040 2632 cmd.exe PING.EXE PID 2632 wrote to memory of 2776 2632 cmd.exe PING.EXE PID 2632 wrote to memory of 2776 2632 cmd.exe PING.EXE PID 2632 wrote to memory of 2776 2632 cmd.exe PING.EXE PID 2632 wrote to memory of 2776 2632 cmd.exe PING.EXE PID 2632 wrote to memory of 2548 2632 cmd.exe skype.exe PID 2632 wrote to memory of 2548 2632 cmd.exe skype.exe PID 2632 wrote to memory of 2548 2632 cmd.exe skype.exe PID 2632 wrote to memory of 2548 2632 cmd.exe skype.exe PID 2548 wrote to memory of 1624 2548 skype.exe AddInProcess32.exe PID 2548 wrote to memory of 1624 2548 skype.exe AddInProcess32.exe PID 2548 wrote to memory of 1624 2548 skype.exe AddInProcess32.exe PID 2548 wrote to memory of 1624 2548 skype.exe AddInProcess32.exe PID 2548 wrote to memory of 1624 2548 skype.exe AddInProcess32.exe PID 2548 wrote to memory of 1624 2548 skype.exe AddInProcess32.exe PID 2548 wrote to memory of 1624 2548 skype.exe AddInProcess32.exe PID 1216 wrote to memory of 1776 1216 Explorer.EXE cscript.exe PID 1216 wrote to memory of 1776 1216 Explorer.EXE cscript.exe PID 1216 wrote to memory of 1776 1216 Explorer.EXE cscript.exe PID 1216 wrote to memory of 1776 1216 Explorer.EXE cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\U prilogu lista novih narudzbi.exe"C:\Users\Admin\AppData\Local\Temp\U prilogu lista novih narudzbi.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\skype.exe"C:\Users\Admin\AppData\Local\Temp\skype.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\Users\Admin\AppData\Local\Temp\skype.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 144⤵
- Runs ping.exe
PID:3040 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 144⤵
- Runs ping.exe
PID:2776 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exeFilesize
776KB
MD575c1a9a40b3594e87dfd526d5d02786e
SHA19da904b9ade761c097d214a2fa823edc219522da
SHA256be6c4cf0c6c048a2a1c98374746b282bae9c7eb191ec193a747b47910ade5aa1
SHA512808bda7370c3c5c00faca7a088b059baa59545f17bd8167964565379dbf77d0093824cc4496c7154dc65b83dea92e118027e737ac640a6cd697928f6f81ed7a9
-
memory/1216-45-0x00000000062B0000-0x0000000006389000-memory.dmpFilesize
868KB
-
memory/1216-37-0x00000000062B0000-0x0000000006389000-memory.dmpFilesize
868KB
-
memory/1216-34-0x0000000003B40000-0x0000000003C40000-memory.dmpFilesize
1024KB
-
memory/1624-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1624-25-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1624-30-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1624-32-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1624-35-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB
-
memory/1624-33-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1624-36-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1624-24-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1628-7-0x0000000004CA0000-0x0000000004CE0000-memory.dmpFilesize
256KB
-
memory/1628-8-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/1628-5-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/1776-42-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/1776-38-0x00000000007E0000-0x0000000000802000-memory.dmpFilesize
136KB
-
memory/1776-39-0x00000000007E0000-0x0000000000802000-memory.dmpFilesize
136KB
-
memory/1776-40-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/1776-41-0x00000000021B0000-0x00000000024B3000-memory.dmpFilesize
3.0MB
-
memory/1776-43-0x0000000000470000-0x00000000004FF000-memory.dmpFilesize
572KB
-
memory/2548-22-0x00000000006E0000-0x00000000006FA000-memory.dmpFilesize
104KB
-
memory/2548-20-0x0000000074500000-0x0000000074BEE000-memory.dmpFilesize
6.9MB
-
memory/2548-19-0x0000000000FB0000-0x0000000001078000-memory.dmpFilesize
800KB
-
memory/2548-29-0x0000000004F60000-0x0000000004FA0000-memory.dmpFilesize
256KB
-
memory/2548-28-0x0000000004F60000-0x0000000004FA0000-memory.dmpFilesize
256KB
-
memory/2548-27-0x0000000074500000-0x0000000074BEE000-memory.dmpFilesize
6.9MB
-
memory/2548-31-0x0000000074500000-0x0000000074BEE000-memory.dmpFilesize
6.9MB
-
memory/2548-21-0x0000000004F60000-0x0000000004FA0000-memory.dmpFilesize
256KB
-
memory/2548-23-0x0000000000700000-0x0000000000706000-memory.dmpFilesize
24KB
-
memory/2932-1-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/2932-2-0x0000000004D40000-0x0000000004D80000-memory.dmpFilesize
256KB
-
memory/2932-3-0x0000000002130000-0x0000000002174000-memory.dmpFilesize
272KB
-
memory/2932-6-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/2932-0-0x0000000000AA0000-0x0000000000B68000-memory.dmpFilesize
800KB