Analysis
- max time kernel
152s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
21/03/2024, 08:31
General
- Target Supplier Registration to ARIBA System.exe
- Size 700KB
- Sample240321-kepwmsgh21
- SHA256 cb348e8dbd6c518a9ad671a9fb235cea3eeba8b7036fc5498f6b118d4bc3060b
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe"C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe"C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe"C:\Users\Admin\AppData\Local\Temp\Supplier Registration to ARIBA System.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\proquota.exe"C:\Windows\SysWOW64\proquota.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3928 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_khvsg5nk.xax.ps1
memory/1100-48-0x0000000006790000-0x00000000067AE000-memory.dmp
memory/1100-62-0x00000000078A0000-0x00000000078A8000-memory.dmp
memory/1100-65-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/1100-38-0x0000000070FE0000-0x000000007102C000-memory.dmp
memory/1100-49-0x00000000073B0000-0x0000000007453000-memory.dmp
memory/1100-61-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/1100-60-0x00000000078C0000-0x00000000078DA000-memory.dmp
memory/1100-59-0x00000000077C0000-0x00000000077D4000-memory.dmp
memory/1100-57-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/1100-56-0x0000000007780000-0x0000000007791000-memory.dmp
memory/1100-55-0x0000000007800000-0x0000000007896000-memory.dmp
memory/1100-54-0x00000000075F0000-0x00000000075FA000-memory.dmp
memory/1100-53-0x0000000007580000-0x000000000759A000-memory.dmp
memory/1100-15-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/1100-52-0x0000000007BC0000-0x000000000823A000-memory.dmp
memory/1100-17-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/1100-18-0x0000000004BE0000-0x0000000004C16000-memory.dmp
memory/1100-19-0x00000000053C0000-0x00000000059E8000-memory.dmp
memory/1100-51-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/1100-21-0x00000000051F0000-0x0000000005212000-memory.dmp
memory/1100-22-0x0000000005290000-0x00000000052F6000-memory.dmp
memory/1100-23-0x0000000005300000-0x0000000005366000-memory.dmp
memory/1100-58-0x00000000077B0000-0x00000000077BE000-memory.dmp
memory/1100-33-0x0000000005B70000-0x0000000005EC4000-memory.dmp
memory/1100-34-0x00000000061C0000-0x00000000061DE000-memory.dmp
memory/1100-35-0x0000000006200000-0x000000000624C000-memory.dmp
memory/1100-36-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/1100-37-0x0000000007370000-0x00000000073A2000-memory.dmp
memory/1592-69-0x0000000000780000-0x00000000007BC000-memory.dmp
memory/1592-79-0x0000000002850000-0x00000000028EE000-memory.dmp
memory/1592-76-0x0000000000780000-0x00000000007BC000-memory.dmp
memory/1592-75-0x0000000002850000-0x00000000028EE000-memory.dmp
memory/1592-74-0x0000000000780000-0x00000000007BC000-memory.dmp
memory/1592-73-0x0000000002980000-0x0000000002CCA000-memory.dmp
memory/1592-70-0x0000000000780000-0x00000000007BC000-memory.dmp
memory/3372-80-0x0000000008130000-0x0000000008247000-memory.dmp
memory/3372-78-0x0000000008130000-0x0000000008247000-memory.dmp
memory/3372-77-0x0000000008130000-0x0000000008247000-memory.dmp
memory/3492-11-0x0000000007AA0000-0x0000000007B26000-memory.dmp
memory/3492-10-0x0000000007710000-0x000000000771C000-memory.dmp
memory/3492-8-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/3492-7-0x0000000005E20000-0x0000000005E36000-memory.dmp
memory/3492-6-0x0000000005BD0000-0x0000000005C6C000-memory.dmp
memory/3492-2-0x0000000005E40000-0x00000000063E4000-memory.dmp
memory/3492-3-0x0000000005930000-0x00000000059C2000-memory.dmp
memory/3492-4-0x00000000058A0000-0x00000000058B0000-memory.dmp
memory/3492-1-0x0000000000E70000-0x0000000000F24000-memory.dmp
memory/3492-5-0x0000000005AC0000-0x0000000005ACA000-memory.dmp
memory/3492-9-0x0000000007360000-0x0000000007368000-memory.dmp
memory/3492-0-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/3492-16-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/3492-12-0x00000000058A0000-0x00000000058B0000-memory.dmp
memory/4940-66-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4940-72-0x00000000018C0000-0x00000000018DF000-memory.dmp
memory/4940-13-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4940-71-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4940-20-0x0000000001930000-0x0000000001C7A000-memory.dmp
memory/4940-50-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4940-68-0x00000000018C0000-0x00000000018DF000-memory.dmp
memory/4940-67-0x0000000000400000-0x000000000043F000-memory.dmp