Analysis
- max time kernel
25s - max time network
43s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
02/03/2024, 16:28
General
- Target [email protected]
- Size 53KB
- Sample240302-tymp3afc69
- SHA256 775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Modifies Control Panel 21 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Adds Run key to start application
- Modifies Control Panel
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\HideEnable.nfo"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding2⤵
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\NewCopy.docm" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\NewCopy.docm" /o ""1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\GetRequest.odt"1⤵
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\HideEnable.nfo"1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
4F398924-F001-4C4A-B205-D555F0538505
winword.exe.db-wal
74a0ad00a184813f0b8867eb2f8dfef7227a18a4.tbres
WMSDKNS.XML
2219095117.pri
allservices.xml
serviceinfo.xml
wmsetup.log
memory/396-462-0x00000244F4500000-0x00000244F4600000-memory.dmp
memory/396-465-0x0000024CF81E0000-0x0000024CF82E0000-memory.dmp
memory/396-335-0x0000024CF89E0000-0x0000024CF8AE0000-memory.dmp
memory/396-449-0x0000024CF8EE0000-0x0000024CF8FE0000-memory.dmp
memory/396-459-0x0000024CF6700000-0x0000024CF6800000-memory.dmp
memory/396-400-0x0000024CF8DE0000-0x0000024CF8EE0000-memory.dmp
memory/1076-95-0x00007FFF43080000-0x00007FFF43090000-memory.dmp
memory/1076-96-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1076-89-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1076-83-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1076-99-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1076-97-0x00007FFF43080000-0x00007FFF43090000-memory.dmp
memory/1076-98-0x00007FFF80550000-0x00007FFF805FE000-memory.dmp
memory/1076-93-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1076-94-0x00007FFF43080000-0x00007FFF43090000-memory.dmp
memory/1076-92-0x00007FFF43080000-0x00007FFF43090000-memory.dmp
memory/1076-91-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1076-87-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1076-85-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1076-84-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1252-129-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1252-131-0x00007FFF80550000-0x00007FFF805FE000-memory.dmp
memory/1252-119-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1252-122-0x00007FFF80550000-0x00007FFF805FE000-memory.dmp
memory/1252-114-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1252-124-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/1252-127-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/2012-0-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2204-360-0x00000224E8500000-0x00000224E8600000-memory.dmp
memory/2204-381-0x00000224E8800000-0x00000224E8900000-memory.dmp
memory/2204-488-0x00000224E8A00000-0x00000224E8B00000-memory.dmp
memory/2732-138-0x00000172D9D20000-0x00000172D9D30000-memory.dmp
memory/2732-154-0x00000172DA500000-0x00000172DA510000-memory.dmp
memory/2732-173-0x00000172D8FE0000-0x00000172D8FE2000-memory.dmp
memory/3616-57-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-68-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-50-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-110-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-111-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-54-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-51-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-56-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-80-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-62-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-61-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-49-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-65-0x00007FFF40300000-0x00007FFF40310000-memory.dmp
memory/3616-66-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-64-0x00007FFF80550000-0x00007FFF805FE000-memory.dmp
memory/3616-52-0x00007FFF40300000-0x00007FFF40310000-memory.dmp
memory/3616-47-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-45-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-44-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-70-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-72-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-43-0x00007FFF43080000-0x00007FFF43090000-memory.dmp
memory/3616-42-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-41-0x00007FFF43080000-0x00007FFF43090000-memory.dmp
memory/3616-39-0x00007FFF43080000-0x00007FFF43090000-memory.dmp
memory/3616-40-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-75-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-38-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp
memory/3616-37-0x00007FFF43080000-0x00007FFF43090000-memory.dmp