cb348e8dbd6c518a9ad671a9fb235cea3eeba8b7036fc5498f6b118d4bc3060b

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/03/2024, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Supplier Registration to ARIBA System.exe
Size 700KB
Sample240321-kepwmsgh21
SHA256 cb348e8dbd6c518a9ad671a9fb235cea3eeba8b7036fc5498f6b118d4bc3060b
MD5 8b5bdf8ac612f2ebe7ad3656a43b42fb
SHA1 336f0aec4422efbb8716d2fc37ba4e5ee29b088f
SHA512 007c585c078d23e890eb741b6e61df08580c641cf45d98d5aac5955c76daa411027c49f88bd7702be0a681b6ed38d532561042a1c469577065541cb14fba8654
SSDEEP 12288:NiUqyAxN1kz0Mbv3RGGxL+S7UrpVDgZhsiSOfgT53nwYf33yzm8fkNxmCgLDt+w1:NiUqyAxN1ZIJGY8rpVDJF3wKAsNgLRQk
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 2508	2188	Supplier Registration to ARIBA System.exe	29
PID 2508 set thread context of 2188	2508	Supplier Registration to ARIBA System.exe	27
PID 2508 set thread context of 2420	2508	Supplier Registration to ARIBA System.exe	31
PID 2420 set thread context of 1192	2420	proquota.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2188	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2508	Supplier Registration to ARIBA System.exe
2508	Supplier Registration to ARIBA System.exe
2508	Supplier Registration to ARIBA System.exe
2508	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2500	powershell.exe
2188	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe
2420	proquota.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2508	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2188	Supplier Registration to ARIBA System.exe
2420	proquota.exe
2420	proquota.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	Supplier Registration to ARIBA System.exe
Token: SeDebugPrivilege	2500	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2500	2188	Supplier Registration to ARIBA System.exe	28
PID 2188 wrote to memory of 2500	2188	Supplier Registration to ARIBA System.exe	28
PID 2188 wrote to memory of 2500	2188	Supplier Registration to ARIBA System.exe	28
PID 2188 wrote to memory of 2500	2188	Supplier Registration to ARIBA System.exe	28
PID 2188 wrote to memory of 2508	2188	Supplier Registration to ARIBA System.exe	29
PID 2188 wrote to memory of 2508	2188	Supplier Registration to ARIBA System.exe	29
PID 2188 wrote to memory of 2508	2188	Supplier Registration to ARIBA System.exe	29
PID 2188 wrote to memory of 2508	2188	Supplier Registration to ARIBA System.exe	29
PID 2188 wrote to memory of 2508	2188	Supplier Registration to ARIBA System.exe	29
PID 2188 wrote to memory of 2508	2188	Supplier Registration to ARIBA System.exe	29
PID 2188 wrote to memory of 2508	2188	Supplier Registration to ARIBA System.exe	29
PID 2188 wrote to memory of 2420	2188	Supplier Registration to ARIBA System.exe	31
PID 2188 wrote to memory of 2420	2188	Supplier Registration to ARIBA System.exe	31
PID 2188 wrote to memory of 2420	2188	Supplier Registration to ARIBA System.exe	31
PID 2188 wrote to memory of 2420	2188	Supplier Registration to ARIBA System.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe
  "C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe
    "C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2508
- - C:\Windows\SysWOW64\proquota.exe
    "C:\Windows\SysWOW64\proquota.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-12-0x0000000074390000-0x0000000074A7E000-memory.dmp

Download

memory/2188-1-0x0000000074390000-0x0000000074A7E000-memory.dmp

Download

memory/2188-2-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Download

memory/2188-3-0x0000000000450000-0x0000000000466000-memory.dmp

Download

memory/2188-4-0x0000000000700000-0x0000000000708000-memory.dmp

Download

memory/2188-5-0x0000000000710000-0x000000000071C000-memory.dmp

Download

memory/2188-6-0x00000000053F0000-0x0000000005476000-memory.dmp

Download

memory/2188-0-0x00000000011B0000-0x0000000001264000-memory.dmp

Download

memory/2188-25-0x0000000074390000-0x0000000074A7E000-memory.dmp

Download

memory/2188-15-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Download

memory/2420-27-0x0000000000080000-0x00000000000BC000-memory.dmp

Download

memory/2420-24-0x0000000000080000-0x00000000000BC000-memory.dmp

Download

memory/2420-28-0x0000000001EB0000-0x00000000021B3000-memory.dmp

Download

memory/2420-29-0x0000000001D30000-0x0000000001DCE000-memory.dmp

Download

memory/2420-30-0x0000000000080000-0x00000000000BC000-memory.dmp

Download

memory/2420-23-0x0000000000080000-0x00000000000BC000-memory.dmp

Download

memory/2500-18-0x000000006F300000-0x000000006F8AB000-memory.dmp

Download

memory/2500-19-0x000000006F300000-0x000000006F8AB000-memory.dmp

Download

memory/2500-20-0x0000000002D40000-0x0000000002D80000-memory.dmp

Download

memory/2500-21-0x0000000002D40000-0x0000000002D80000-memory.dmp

Download

memory/2500-22-0x000000006F300000-0x000000006F8AB000-memory.dmp

Download

memory/2508-7-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2508-14-0x0000000000990000-0x0000000000C93000-memory.dmp

Download

memory/2508-13-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2508-8-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2508-26-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2508-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2508-11-0x0000000000400000-0x000000000043F000-memory.dmp

Download