4b0ee61b0c2873d1e86b99f48ddacae7ce51efc7272048827ae368b98cafe2be

Analysis

max time kernel
158s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 909KB
Sample240416-jgdqqaed21
SHA256 4b0ee61b0c2873d1e86b99f48ddacae7ce51efc7272048827ae368b98cafe2be
MD5 8ad33ef9b2c5ace2b195d8213525809d
SHA1 4dda6258af72ad6e2d70c61238baeecb8cd05ed5
SHA512 97839e01a01c8846159cdd02936bbe9d617cc3b7984d7d679e5bd95914d0a4a940ee2add292a53543fe9d4df4904e7090aace0488a3de9fddd1bf427d84c5392
SSDEEP 24576:Y1oG8je76qs4LXS+1k1z/hOwmRRhljKQv:SoG8jqs6S+X5RRhlH
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 4784	2808	file.exe	107
PID 4784 set thread context of 3428	4784	file.exe	56
PID 4784 set thread context of 3532	4784	file.exe	114
PID 3532 set thread context of 3428	3532	unlodctr.exe	56
PID 3532 set thread context of 4116	3532	unlodctr.exe	115

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	unlodctr.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2808	file.exe
2808	file.exe
2808	file.exe
2808	file.exe
2808	file.exe
2808	file.exe
2808	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
4784	file.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4784	file.exe
3428	Explorer.EXE
3428	Explorer.EXE
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe
3532	unlodctr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	file.exe
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3032	2808	file.exe	105
PID 2808 wrote to memory of 3032	2808	file.exe	105
PID 2808 wrote to memory of 3032	2808	file.exe	105
PID 2808 wrote to memory of 1448	2808	file.exe	106
PID 2808 wrote to memory of 1448	2808	file.exe	106
PID 2808 wrote to memory of 1448	2808	file.exe	106
PID 2808 wrote to memory of 4784	2808	file.exe	107
PID 2808 wrote to memory of 4784	2808	file.exe	107
PID 2808 wrote to memory of 4784	2808	file.exe	107
PID 2808 wrote to memory of 4784	2808	file.exe	107
PID 2808 wrote to memory of 4784	2808	file.exe	107
PID 2808 wrote to memory of 4784	2808	file.exe	107
PID 3428 wrote to memory of 3532	3428	Explorer.EXE	114
PID 3428 wrote to memory of 3532	3428	Explorer.EXE	114
PID 3428 wrote to memory of 3532	3428	Explorer.EXE	114
PID 3532 wrote to memory of 4116	3532	unlodctr.exe	115
PID 3532 wrote to memory of 4116	3532	unlodctr.exe	115

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4784
- C:\Windows\SysWOW64\unlodctr.exe
  "C:\Windows\SysWOW64\unlodctr.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2808-8-0x0000000002E80000-0x0000000002E88000-memory.dmp

Download

memory/2808-10-0x0000000009170000-0x00000000091FA000-memory.dmp

Download

memory/2808-2-0x0000000005AC0000-0x0000000006064000-memory.dmp

Download

memory/2808-3-0x0000000005610000-0x00000000056A2000-memory.dmp

Download

memory/2808-4-0x00000000059E0000-0x00000000059F0000-memory.dmp

Download

memory/2808-5-0x0000000005940000-0x000000000594A000-memory.dmp

Download

memory/2808-6-0x0000000008DE0000-0x0000000008E86000-memory.dmp

Download

memory/2808-7-0x0000000002E60000-0x0000000002E72000-memory.dmp

Download

memory/2808-1-0x0000000075260000-0x0000000075A10000-memory.dmp

Download

memory/2808-0-0x0000000000B40000-0x0000000000C24000-memory.dmp

Download

memory/2808-9-0x0000000002E90000-0x0000000002E9C000-memory.dmp

Download

memory/2808-11-0x0000000007110000-0x00000000071AC000-memory.dmp

Download

memory/2808-14-0x0000000075260000-0x0000000075A10000-memory.dmp

Download

memory/3428-39-0x0000000008610000-0x0000000008729000-memory.dmp

Download

memory/3428-31-0x0000000008610000-0x0000000008729000-memory.dmp

Download

memory/3428-30-0x0000000008610000-0x0000000008729000-memory.dmp

Download

memory/3428-28-0x000000000D300000-0x000000000E3BC000-memory.dmp

Download

memory/3428-20-0x000000000D300000-0x000000000E3BC000-memory.dmp

Download

memory/3532-25-0x0000000001B10000-0x0000000001E5A000-memory.dmp

Download

memory/3532-29-0x0000000001230000-0x000000000126F000-memory.dmp

Download

memory/3532-21-0x0000000001230000-0x000000000126F000-memory.dmp

Download

memory/3532-22-0x0000000001230000-0x000000000126F000-memory.dmp

Download

memory/3532-32-0x0000000001990000-0x0000000001A32000-memory.dmp

Download

memory/3532-27-0x0000000001990000-0x0000000001A32000-memory.dmp

Download

memory/3532-26-0x0000000001230000-0x000000000126F000-memory.dmp

Download

memory/4116-38-0x00000229531B0000-0x00000229532AD000-memory.dmp

Download

memory/4784-18-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4784-24-0x00000000016C0000-0x00000000016E3000-memory.dmp

Download

memory/4784-17-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4784-19-0x00000000016C0000-0x00000000016E3000-memory.dmp

Download

memory/4784-15-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4784-16-0x00000000016F0000-0x0000000001A3A000-memory.dmp

Download

memory/4784-23-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4784-12-0x0000000000400000-0x0000000000442000-memory.dmp

Download