bf1f882e2a1d0e35207cd7cab867bffe933e134e43ff317acf2db538bd4d7210

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 858KB
Sample240402-qqn2dabd2v
SHA256 bf1f882e2a1d0e35207cd7cab867bffe933e134e43ff317acf2db538bd4d7210
MD5 61af9d6bd30dca0a81637bce9d679636
SHA1 e7633d0c57090b02b02b14a0f3b83894f42e225a
SHA512 1864cda0b33494f72a0f9ce779258fc4a14f232ab8a54fb5f521c7f3c45b931c43c99f44ab917247ddf9bd404360334ad7bdef8f0e76b7e769208403923b5689
SSDEEP 12288:aoatPGmMZcYFaGVienx6Ps8DIlDnOc6C4ETCiwjI/ovwU+21f8Q7w0sdWrnZrY4U:V+MtrVBnB1nLHGiwwovVZnnk
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 5096 set thread context of 4532	5096	file.exe	102
PID 4532 set thread context of 3164	4532	file.exe	56
PID 4532 set thread context of 1384	4532	file.exe	105
PID 1384 set thread context of 3164	1384	isoburn.exe	56
PID 1384 set thread context of 3552	1384	isoburn.exe	106

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	isoburn.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
5096	file.exe
5096	file.exe
5096	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
4532	file.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4532	file.exe
3164	Explorer.EXE
3164	Explorer.EXE
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe
1384	isoburn.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	file.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3164	Explorer.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4532	5096	file.exe	102
PID 5096 wrote to memory of 4532	5096	file.exe	102
PID 5096 wrote to memory of 4532	5096	file.exe	102
PID 5096 wrote to memory of 4532	5096	file.exe	102
PID 5096 wrote to memory of 4532	5096	file.exe	102
PID 5096 wrote to memory of 4532	5096	file.exe	102
PID 3164 wrote to memory of 1384	3164	Explorer.EXE	105
PID 3164 wrote to memory of 1384	3164	Explorer.EXE	105
PID 3164 wrote to memory of 1384	3164	Explorer.EXE	105
PID 1384 wrote to memory of 3552	1384	isoburn.exe	106
PID 1384 wrote to memory of 3552	1384	isoburn.exe	106

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4532
- C:\Windows\SysWOW64\isoburn.exe
  "C:\Windows\SysWOW64\isoburn.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-25-0x0000000000EF0000-0x0000000000F2F000-memory.dmp

Download

memory/1384-29-0x0000000002DD0000-0x0000000002E72000-memory.dmp

Download

memory/1384-28-0x0000000000EF0000-0x0000000000F2F000-memory.dmp

Download

memory/1384-26-0x0000000002DD0000-0x0000000002E72000-memory.dmp

Download

memory/1384-24-0x0000000003000000-0x000000000334A000-memory.dmp

Download

memory/1384-21-0x0000000000EF0000-0x0000000000F2F000-memory.dmp

Download

memory/1384-20-0x0000000000EF0000-0x0000000000F2F000-memory.dmp

Download

memory/3164-38-0x0000000008580000-0x000000000866C000-memory.dmp

Download

memory/3164-31-0x0000000008580000-0x000000000866C000-memory.dmp

Download

memory/3164-30-0x0000000008580000-0x000000000866C000-memory.dmp

Download

memory/3164-27-0x000000000D330000-0x000000001034C000-memory.dmp

Download

memory/3164-19-0x000000000D330000-0x000000001034C000-memory.dmp

Download

memory/3552-37-0x000001C91DFA0000-0x000001C91E0A0000-memory.dmp

Download

memory/4532-17-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4532-23-0x0000000001250000-0x0000000001273000-memory.dmp

Download

memory/4532-16-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4532-15-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4532-18-0x0000000001250000-0x0000000001273000-memory.dmp

Download

memory/4532-14-0x0000000001770000-0x0000000001ABA000-memory.dmp

Download

memory/4532-22-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4532-11-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5096-13-0x00000000744B0000-0x0000000074C60000-memory.dmp

Download

memory/5096-0-0x00000000744B0000-0x0000000074C60000-memory.dmp

Download

memory/5096-10-0x00000000092C0000-0x000000000934A000-memory.dmp

Download

memory/5096-9-0x0000000007E30000-0x0000000007E3C000-memory.dmp

Download

memory/5096-8-0x0000000007E20000-0x0000000007E2A000-memory.dmp

Download

memory/5096-7-0x0000000007DA0000-0x0000000007DB4000-memory.dmp

Download

memory/5096-6-0x0000000007E80000-0x0000000007F1C000-memory.dmp

Download

memory/5096-5-0x0000000007D20000-0x0000000007D2A000-memory.dmp

Download

memory/5096-4-0x0000000007DD0000-0x0000000007DE0000-memory.dmp

Download

memory/5096-3-0x0000000007B70000-0x0000000007C02000-memory.dmp

Download

memory/5096-2-0x0000000008060000-0x0000000008604000-memory.dmp

Download

memory/5096-1-0x0000000000BF0000-0x0000000000CC8000-memory.dmp

Download