Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 02:43
Static task
static1
Behavioral task
behavioral1
Sample
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe
Resource
win7-20240221-en
General
-
Target
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe
-
Size
619KB
-
MD5
996f511df3eb434b0c8c8bb2f5ffac86
-
SHA1
61c47ca95118845ed58d0a95861534b2c697e073
-
SHA256
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924
-
SHA512
443152150b99c31c82ef2d74e6a9bbba4b970c4863ed4527b6df299f622705c72a72d0e34f1698227cd463ed77d66322d284f8e650451dc020d2d62b69e04d13
-
SSDEEP
12288:WG2iNlw0Tpi/K61Zp5TIoc2uEj+5Qf+rdu7BrYb0kg4taHk9KnQbJUNkR:h1XLodbpOoci2Q+rdUrYQjHkcQbZ
Malware Config
Extracted
formbook
4.1
dd20
unblurd.com
docu-zign.com
randijpaulsen.com
angsabet.com
sedatelynx.com
opiumcore.store
thelordismysaviormerch.com
mindstudio.support
waterbygraceteam.com
furnitureinspiredbythesea.com
amablanca.com
hespelerdental.com
arcalid.net
balajinursingbureau.online
caixias.shop
solingen-buergerstiftung.com
194916.top
6travel-insurance.xyz
xn--fiqp9b17y.xn--czr694b
syntixi.trade
dataaudit.xyz
judgefever.com
agapornis.pet
sparkasse-banking-service.app
holylandmerch.com
synive.com
knittingbyangela.com
keytorapidweightloss.com
maradesarrollos.store
asherveer.com
kalame.info
khuwezu.top
myfreebd.com
jeepcherokeedeals.xyz
pointschauds.net
narae.xyz
nsivyyu.top
vetlinx360.com
1709frankford.com
checchintrasportilogistica.com
grupoagrarius.com
themasternoi.com
wurdsspeledrong.com
xn--diseafacil-w9a.com
playtoown.shop
butrikl.xyz
amazonpublisherservice.com
belihape.com
ajaysilverpalace.in
geredehanhotel.com
cruises-11028.bond
catering-57592.bond
haloogi.com
compasstransportaion.com
713952.site
downloadfirekirin.xyz
soapcoverr.store
wellnesswomenassociation.com
nortiapro.com
trustedoakllc.info
canadasimnigeria.com
aiappsreviews.com
dct15.com
venenciadorapp.com
fight4yourhappiness.com
Signatures
-
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4460-8-0x0000000005590000-0x000000000559C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4404-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4404-35-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4456-47-0x0000000000550000-0x000000000057F000-memory.dmp formbook behavioral2/memory/4456-65-0x0000000000550000-0x000000000057F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exeRegSvcs.execmmon32.exedescription pid process target process PID 4460 set thread context of 4404 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 4404 set thread context of 3332 4404 RegSvcs.exe Explorer.EXE PID 4456 set thread context of 3332 4456 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exepowershell.exeRegSvcs.execmmon32.exepid process 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe 2784 powershell.exe 2784 powershell.exe 4404 RegSvcs.exe 4404 RegSvcs.exe 4404 RegSvcs.exe 4404 RegSvcs.exe 4404 RegSvcs.exe 4404 RegSvcs.exe 2784 powershell.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe 4456 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execmmon32.exepid process 4404 RegSvcs.exe 4404 RegSvcs.exe 4404 RegSvcs.exe 4456 cmmon32.exe 4456 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exepowershell.exeRegSvcs.execmmon32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 4404 RegSvcs.exe Token: SeDebugPrivilege 4456 cmmon32.exe Token: SeShutdownPrivilege 3332 Explorer.EXE Token: SeCreatePagefilePrivilege 3332 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3332 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exeExplorer.EXEcmmon32.exedescription pid process target process PID 4460 wrote to memory of 2784 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe powershell.exe PID 4460 wrote to memory of 2784 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe powershell.exe PID 4460 wrote to memory of 2784 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe powershell.exe PID 4460 wrote to memory of 936 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe schtasks.exe PID 4460 wrote to memory of 936 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe schtasks.exe PID 4460 wrote to memory of 936 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe schtasks.exe PID 4460 wrote to memory of 4404 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 4460 wrote to memory of 4404 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 4460 wrote to memory of 4404 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 4460 wrote to memory of 4404 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 4460 wrote to memory of 4404 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 4460 wrote to memory of 4404 4460 ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe RegSvcs.exe PID 3332 wrote to memory of 4456 3332 Explorer.EXE cmmon32.exe PID 3332 wrote to memory of 4456 3332 Explorer.EXE cmmon32.exe PID 3332 wrote to memory of 4456 3332 Explorer.EXE cmmon32.exe PID 4456 wrote to memory of 1504 4456 cmmon32.exe cmd.exe PID 4456 wrote to memory of 1504 4456 cmmon32.exe cmd.exe PID 4456 wrote to memory of 1504 4456 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe"C:\Users\Admin\AppData\Local\Temp\ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hIHKJIXn.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hIHKJIXn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7059.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o0dps3oe.10o.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp7059.tmpFilesize
1KB
MD57839c9ea4d394e577dfa200823d58e9d
SHA185cd5076005df3bebc4553c2c818263f70860d79
SHA2565be1f7158c3096b9b72f28d988d252e015508ba777459b87860d3de65b44e38d
SHA512fb5a65f6261760ec78ff893aad56471b73c4b62c8790ed8216c6239da6db3d1fdc1ab32b1ec50c64186d11daf8f32ede6373d6fa9a3762ba25ee889a799e2894
-
memory/2784-43-0x0000000005C10000-0x0000000005C2E000-memory.dmpFilesize
120KB
-
memory/2784-66-0x0000000007700000-0x0000000007D7A000-memory.dmpFilesize
6.5MB
-
memory/2784-42-0x0000000005870000-0x0000000005BC4000-memory.dmpFilesize
3.3MB
-
memory/2784-76-0x00000000073E0000-0x00000000073E8000-memory.dmpFilesize
32KB
-
memory/2784-75-0x00000000073F0000-0x000000000740A000-memory.dmpFilesize
104KB
-
memory/2784-74-0x0000000007300000-0x0000000007314000-memory.dmpFilesize
80KB
-
memory/2784-73-0x00000000072F0000-0x00000000072FE000-memory.dmpFilesize
56KB
-
memory/2784-70-0x00000000072D0000-0x00000000072E1000-memory.dmpFilesize
68KB
-
memory/2784-69-0x0000000007330000-0x00000000073C6000-memory.dmpFilesize
600KB
-
memory/2784-15-0x0000000004800000-0x0000000004836000-memory.dmpFilesize
216KB
-
memory/2784-16-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/2784-17-0x00000000047F0000-0x0000000004800000-memory.dmpFilesize
64KB
-
memory/2784-68-0x0000000007130000-0x000000000713A000-memory.dmpFilesize
40KB
-
memory/2784-18-0x00000000047F0000-0x0000000004800000-memory.dmpFilesize
64KB
-
memory/2784-67-0x00000000070C0000-0x00000000070DA000-memory.dmpFilesize
104KB
-
memory/2784-64-0x0000000006DB0000-0x0000000006E53000-memory.dmpFilesize
652KB
-
memory/2784-22-0x0000000004E70000-0x0000000005498000-memory.dmpFilesize
6.2MB
-
memory/2784-24-0x0000000004CC0000-0x0000000004CE2000-memory.dmpFilesize
136KB
-
memory/2784-63-0x0000000006350000-0x000000000636E000-memory.dmpFilesize
120KB
-
memory/2784-26-0x00000000054A0000-0x0000000005506000-memory.dmpFilesize
408KB
-
memory/2784-53-0x0000000071280000-0x00000000712CC000-memory.dmpFilesize
304KB
-
memory/2784-28-0x0000000005700000-0x0000000005766000-memory.dmpFilesize
408KB
-
memory/2784-52-0x0000000006D70000-0x0000000006DA2000-memory.dmpFilesize
200KB
-
memory/2784-51-0x00000000047F0000-0x0000000004800000-memory.dmpFilesize
64KB
-
memory/2784-44-0x0000000005E00000-0x0000000005E4C000-memory.dmpFilesize
304KB
-
memory/2784-49-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/2784-50-0x00000000047F0000-0x0000000004800000-memory.dmpFilesize
64KB
-
memory/2784-79-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/3332-82-0x0000000008BC0000-0x0000000008C6D000-memory.dmpFilesize
692KB
-
memory/3332-86-0x0000000008BC0000-0x0000000008C6D000-memory.dmpFilesize
692KB
-
memory/3332-83-0x0000000008BC0000-0x0000000008C6D000-memory.dmpFilesize
692KB
-
memory/3332-80-0x0000000008A40000-0x0000000008AFC000-memory.dmpFilesize
752KB
-
memory/3332-37-0x0000000008A40000-0x0000000008AFC000-memory.dmpFilesize
752KB
-
memory/4404-20-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4404-36-0x0000000001020000-0x0000000001035000-memory.dmpFilesize
84KB
-
memory/4404-35-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4404-27-0x0000000001320000-0x000000000166A000-memory.dmpFilesize
3.3MB
-
memory/4456-47-0x0000000000550000-0x000000000057F000-memory.dmpFilesize
188KB
-
memory/4456-72-0x00000000024A0000-0x0000000002534000-memory.dmpFilesize
592KB
-
memory/4456-46-0x0000000000660000-0x000000000066C000-memory.dmpFilesize
48KB
-
memory/4456-65-0x0000000000550000-0x000000000057F000-memory.dmpFilesize
188KB
-
memory/4456-45-0x0000000000660000-0x000000000066C000-memory.dmpFilesize
48KB
-
memory/4456-48-0x0000000002770000-0x0000000002ABA000-memory.dmpFilesize
3.3MB
-
memory/4460-1-0x0000000000870000-0x000000000090C000-memory.dmpFilesize
624KB
-
memory/4460-13-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/4460-9-0x00000000068A0000-0x0000000006916000-memory.dmpFilesize
472KB
-
memory/4460-25-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/4460-8-0x0000000005590000-0x000000000559C000-memory.dmpFilesize
48KB
-
memory/4460-7-0x0000000005570000-0x0000000005582000-memory.dmpFilesize
72KB
-
memory/4460-6-0x00000000055D0000-0x000000000566C000-memory.dmpFilesize
624KB
-
memory/4460-5-0x0000000005310000-0x000000000531A000-memory.dmpFilesize
40KB
-
memory/4460-0-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/4460-2-0x0000000005830000-0x0000000005DD4000-memory.dmpFilesize
5.6MB
-
memory/4460-4-0x0000000005520000-0x0000000005530000-memory.dmpFilesize
64KB
-
memory/4460-21-0x0000000005520000-0x0000000005530000-memory.dmpFilesize
64KB
-
memory/4460-3-0x0000000005320000-0x00000000053B2000-memory.dmpFilesize
584KB