Analysis
-
max time kernel
146s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 02:43
Static task
static1
Behavioral task
behavioral1
Sample
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe
Resource
win7-20240221-en
General
-
Target
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe
-
Size
619KB
-
MD5
996f511df3eb434b0c8c8bb2f5ffac86
-
SHA1
61c47ca95118845ed58d0a95861534b2c697e073
-
SHA256
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924
-
SHA512
443152150b99c31c82ef2d74e6a9bbba4b970c4863ed4527b6df299f622705c72a72d0e34f1698227cd463ed77d66322d284f8e650451dc020d2d62b69e04d13
-
SSDEEP
12288:WG2iNlw0Tpi/K61Zp5TIoc2uEj+5Qf+rdu7BrYb0kg4taHk9KnQbJUNkR:h1XLodbpOoci2Q+rdUrYQjHkcQbZ
Malware Config
Extracted
formbook
4.1
dd20
unblurd.com
docu-zign.com
randijpaulsen.com
angsabet.com
sedatelynx.com
opiumcore.store
thelordismysaviormerch.com
mindstudio.support
waterbygraceteam.com
furnitureinspiredbythesea.com
amablanca.com
hespelerdental.com
arcalid.net
balajinursingbureau.online
caixias.shop
solingen-buergerstiftung.com
194916.top
6travel-insurance.xyz
xn--fiqp9b17y.xn--czr694b
syntixi.trade
dataaudit.xyz
judgefever.com
agapornis.pet
sparkasse-banking-service.app
holylandmerch.com
synive.com
knittingbyangela.com
keytorapidweightloss.com
maradesarrollos.store
asherveer.com
kalame.info
khuwezu.top
myfreebd.com
jeepcherokeedeals.xyz
pointschauds.net
narae.xyz
nsivyyu.top
vetlinx360.com
1709frankford.com
checchintrasportilogistica.com
grupoagrarius.com
themasternoi.com
wurdsspeledrong.com
xn--diseafacil-w9a.com
playtoown.shop
butrikl.xyz
amazonpublisherservice.com
belihape.com
ajaysilverpalace.in
geredehanhotel.com
cruises-11028.bond
catering-57592.bond
haloogi.com
compasstransportaion.com
713952.site
downloadfirekirin.xyz
soapcoverr.store
wellnesswomenassociation.com
nortiapro.com
trustedoakllc.info
canadasimnigeria.com
aiappsreviews.com
dct15.com
venenciadorapp.com
fight4yourhappiness.com
Signatures
-
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2924-4-0x0000000000560000-0x000000000056C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2628-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2628-23-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2628-31-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2980-37-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/2980-39-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exeRegSvcs.exeipconfig.exedescription pid process target process PID 2924 set thread context of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 2628 set thread context of 1204 2628 RegSvcs.exe Explorer.EXE PID 2628 set thread context of 1204 2628 RegSvcs.exe Explorer.EXE PID 2980 set thread context of 1204 2980 ipconfig.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 2980 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exeRegSvcs.exepowershell.exeipconfig.exepid process 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe 2628 RegSvcs.exe 2628 RegSvcs.exe 2520 powershell.exe 2628 RegSvcs.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe 2980 ipconfig.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exeipconfig.exepid process 2628 RegSvcs.exe 2628 RegSvcs.exe 2628 RegSvcs.exe 2628 RegSvcs.exe 2980 ipconfig.exe 2980 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exeRegSvcs.exepowershell.exeipconfig.exedescription pid process Token: SeDebugPrivilege 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe Token: SeDebugPrivilege 2628 RegSvcs.exe Token: SeDebugPrivilege 2520 powershell.exe Token: SeDebugPrivilege 2980 ipconfig.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exeExplorer.EXEipconfig.exedescription pid process target process PID 2924 wrote to memory of 2520 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe powershell.exe PID 2924 wrote to memory of 2520 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe powershell.exe PID 2924 wrote to memory of 2520 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe powershell.exe PID 2924 wrote to memory of 2520 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe powershell.exe PID 2924 wrote to memory of 2572 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe schtasks.exe PID 2924 wrote to memory of 2572 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe schtasks.exe PID 2924 wrote to memory of 2572 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe schtasks.exe PID 2924 wrote to memory of 2572 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe schtasks.exe PID 2924 wrote to memory of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 2924 wrote to memory of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 2924 wrote to memory of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 2924 wrote to memory of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 2924 wrote to memory of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 2924 wrote to memory of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 2924 wrote to memory of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 2924 wrote to memory of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 2924 wrote to memory of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 2924 wrote to memory of 2628 2924 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 1204 wrote to memory of 2980 1204 Explorer.EXE ipconfig.exe PID 1204 wrote to memory of 2980 1204 Explorer.EXE ipconfig.exe PID 1204 wrote to memory of 2980 1204 Explorer.EXE ipconfig.exe PID 1204 wrote to memory of 2980 1204 Explorer.EXE ipconfig.exe PID 2980 wrote to memory of 1660 2980 ipconfig.exe cmd.exe PID 2980 wrote to memory of 1660 2980 ipconfig.exe cmd.exe PID 2980 wrote to memory of 1660 2980 ipconfig.exe cmd.exe PID 2980 wrote to memory of 1660 2980 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe"C:\Users\Admin\AppData\Local\Temp\ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hIHKJIXn.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hIHKJIXn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp46EF.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp46EF.tmpFilesize
1KB
MD5494873bdae664f51324858f787684077
SHA1484fd9d1ecbe8fadcc1ed546570f71a713b0f63b
SHA2561888bf7d5116c0e1f7578f2a525ed1303932d17ebeaf076b1cd7395cc169b96d
SHA512295ab4d9c0fb76bfdc145754c7e143385e7a2e84d7a0687fd49c95bebdbc2d4f16ef853776560914cd2f246f748a1b1fcf3e002a6d477fff2a1fbbcc1f156c53
-
memory/1204-20-0x0000000003C70000-0x0000000003D70000-memory.dmpFilesize
1024KB
-
memory/1204-48-0x0000000006740000-0x0000000006895000-memory.dmpFilesize
1.3MB
-
memory/1204-45-0x0000000006740000-0x0000000006895000-memory.dmpFilesize
1.3MB
-
memory/1204-44-0x0000000006740000-0x0000000006895000-memory.dmpFilesize
1.3MB
-
memory/1204-42-0x0000000007750000-0x00000000078E0000-memory.dmpFilesize
1.6MB
-
memory/1204-34-0x0000000007750000-0x00000000078E0000-memory.dmpFilesize
1.6MB
-
memory/1204-28-0x0000000004FA0000-0x0000000005129000-memory.dmpFilesize
1.5MB
-
memory/2520-25-0x0000000002A60000-0x0000000002AA0000-memory.dmpFilesize
256KB
-
memory/2520-22-0x000000006E8E0000-0x000000006EE8B000-memory.dmpFilesize
5.7MB
-
memory/2520-29-0x000000006E8E0000-0x000000006EE8B000-memory.dmpFilesize
5.7MB
-
memory/2520-27-0x0000000002A60000-0x0000000002AA0000-memory.dmpFilesize
256KB
-
memory/2520-21-0x000000006E8E0000-0x000000006EE8B000-memory.dmpFilesize
5.7MB
-
memory/2628-23-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2628-31-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2628-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2628-24-0x0000000000240000-0x0000000000255000-memory.dmpFilesize
84KB
-
memory/2628-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2628-26-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/2628-33-0x0000000000300000-0x0000000000315000-memory.dmpFilesize
84KB
-
memory/2628-13-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2628-17-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2924-5-0x00000000052E0000-0x0000000005356000-memory.dmpFilesize
472KB
-
memory/2924-18-0x0000000074470000-0x0000000074B5E000-memory.dmpFilesize
6.9MB
-
memory/2924-0-0x0000000001020000-0x00000000010BC000-memory.dmpFilesize
624KB
-
memory/2924-4-0x0000000000560000-0x000000000056C000-memory.dmpFilesize
48KB
-
memory/2924-3-0x0000000000420000-0x0000000000432000-memory.dmpFilesize
72KB
-
memory/2924-2-0x0000000000F30000-0x0000000000F70000-memory.dmpFilesize
256KB
-
memory/2924-1-0x0000000074470000-0x0000000074B5E000-memory.dmpFilesize
6.9MB
-
memory/2980-35-0x0000000000E20000-0x0000000000E2A000-memory.dmpFilesize
40KB
-
memory/2980-36-0x0000000000E20000-0x0000000000E2A000-memory.dmpFilesize
40KB
-
memory/2980-37-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2980-38-0x0000000002230000-0x0000000002533000-memory.dmpFilesize
3.0MB
-
memory/2980-39-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2980-41-0x0000000000AB0000-0x0000000000B44000-memory.dmpFilesize
592KB