c5f12df3ea1a353211d78d2fee55c7efdf9ff6ada6ec21ffb513661734072543

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO SENDFAFE600.exe
Size

1.0MB
MD5

ecbfd514f4c2e49d00cfc028f79b8de9
SHA1

c6fad2f3781b734690d9fb7cc3e44c5ae6ce16dd
SHA256

c5f12df3ea1a353211d78d2fee55c7efdf9ff6ada6ec21ffb513661734072543
SHA512

07a18904309f1b9ab99d3bb96386836739e00b851649ffa2ac7a66b8ecd10bfe9571980a080fdac7234f86bdcba34216905b1ca45cdb3a1dbe9cb9c261aeab49
SSDEEP

12288:vETzHr7FLOYmpEzAZ3wSCB93O7P+qnAivnyo9rMS9NaWoH8J5s1pkvgV:KNL2+zAaO7P7nAEyo+S9UVHmuog

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2304 set thread context of 1572	2304	PO SENDFAFE600.exe	91
PID 1572 set thread context of 3432	1572	PO SENDFAFE600.exe	38
PID 1572 set thread context of 3020	1572	PO SENDFAFE600.exe	93
PID 3020 set thread context of 3432	3020	DWWIN.EXE	38

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	DWWIN.EXE

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
1572	PO SENDFAFE600.exe
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1572	PO SENDFAFE600.exe
3432	Explorer.EXE
3432	Explorer.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE
3020	DWWIN.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1572	2304	PO SENDFAFE600.exe	91
PID 2304 wrote to memory of 1572	2304	PO SENDFAFE600.exe	91
PID 2304 wrote to memory of 1572	2304	PO SENDFAFE600.exe	91
PID 2304 wrote to memory of 1572	2304	PO SENDFAFE600.exe	91
PID 2304 wrote to memory of 1572	2304	PO SENDFAFE600.exe	91
PID 2304 wrote to memory of 1572	2304	PO SENDFAFE600.exe	91
PID 3432 wrote to memory of 3020	3432	Explorer.EXE	93
PID 3432 wrote to memory of 3020	3432	Explorer.EXE	93
PID 3432 wrote to memory of 3020	3432	Explorer.EXE	93
PID 3020 wrote to memory of 1528	3020	DWWIN.EXE	94
PID 3020 wrote to memory of 1528	3020	DWWIN.EXE	94
PID 3020 wrote to memory of 1528	3020	DWWIN.EXE	94

C:\Users\Admin\AppData\Local\Temp\PO SENDFAFE600.exe
"C:\Users\Admin\AppData\Local\Temp\PO SENDFAFE600.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\PO SENDFAFE600.exe
  "C:\Users\Admin\AppData\Local\Temp\PO SENDFAFE600.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1572

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\DWWIN.EXE
  "C:\Windows\SysWOW64\DWWIN.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-12-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-23-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-24-0x0000000001680000-0x00000000016A1000-memory.dmp

Filesize
132KB

Download
memory/1572-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-19-0x0000000001680000-0x00000000016A1000-memory.dmp

Filesize
132KB

Download
memory/1572-17-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-15-0x0000000001B20000-0x0000000001E6A000-memory.dmp

Filesize
3.3MB

Download
memory/2304-8-0x0000000008720000-0x000000000879E000-memory.dmp

Filesize
504KB

Download
memory/2304-0-0x0000000000DA0000-0x0000000000EB0000-memory.dmp

Filesize
1.1MB

Download
memory/2304-10-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/2304-11-0x0000000005B40000-0x0000000005B50000-memory.dmp

Filesize
64KB

Download
memory/2304-1-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/2304-14-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/2304-7-0x0000000005B20000-0x0000000005B2E000-memory.dmp

Filesize
56KB

Download
memory/2304-6-0x0000000005B10000-0x0000000005B22000-memory.dmp

Filesize
72KB

Download
memory/2304-5-0x00000000058A0000-0x00000000058AA000-memory.dmp

Filesize
40KB

Download
memory/2304-4-0x0000000005B40000-0x0000000005B50000-memory.dmp

Filesize
64KB

Download
memory/2304-3-0x0000000005910000-0x00000000059A2000-memory.dmp

Filesize
584KB

Download
memory/2304-9-0x000000000AF00000-0x000000000AF9C000-memory.dmp

Filesize
624KB

Download
memory/2304-2-0x0000000005EC0000-0x0000000006464000-memory.dmp

Filesize
5.6MB

Download
memory/3020-25-0x0000000003260000-0x00000000035AA000-memory.dmp

Filesize
3.3MB

Download
memory/3020-22-0x0000000001210000-0x000000000124C000-memory.dmp

Filesize
240KB

Download
memory/3020-21-0x0000000001210000-0x000000000124C000-memory.dmp

Filesize
240KB

Download
memory/3020-26-0x0000000001210000-0x000000000124C000-memory.dmp

Filesize
240KB

Download
memory/3020-27-0x00000000031B0000-0x0000000003250000-memory.dmp

Filesize
640KB

Download
memory/3020-29-0x0000000001210000-0x000000000124C000-memory.dmp

Filesize
240KB

Download
memory/3432-20-0x000000000D7C0000-0x000000000E386000-memory.dmp

Filesize
11.8MB

Download
memory/3432-28-0x000000000D7C0000-0x000000000E386000-memory.dmp

Filesize
11.8MB

Download
memory/3432-30-0x00000000076F0000-0x00000000077DF000-memory.dmp

Filesize
956KB

Download
memory/3432-31-0x00000000076F0000-0x00000000077DF000-memory.dmp

Filesize
956KB

Download
memory/3432-38-0x00000000076F0000-0x00000000077DF000-memory.dmp

Filesize
956KB

Download