5244d86acc75581ee5bb96d41b685062bbeaade00639c2aa8be9b402e969385a

General

Target

7.exe
Size

805KB
MD5

4c2e404e8f200fec75a42520c8a41d0b
SHA1

d3f6d79675e8a8dcba9e4cd254844ba314621d86
SHA256

5244d86acc75581ee5bb96d41b685062bbeaade00639c2aa8be9b402e969385a
SHA512

b45b320498b558099a1b994e8e3e7e62cbc924fad4b1dfc5d97259a2664540c2aa1069855f7e5a179ff5b7bf76bb168c8685de98d9c348f2b343966371cddb90
SSDEEP

12288:Se2aULcRTx7PyGrdItxqJ5/vHau+YVAXxJdT+BN8kQkgpIkqhb1xRqgbkieiO+RD:chWTx7PJdIaXv6u+YVABPSi4xG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

Processes:

SndVol.execharmap.exe

description	pid	process	target process
PID 5012 set thread context of 3360	5012	SndVol.exe	Explorer.EXE
PID 5012 set thread context of 2264	5012	SndVol.exe	charmap.exe
PID 2264 set thread context of 3360	2264	charmap.exe	Explorer.EXE
PID 2264 set thread context of 4888	2264	charmap.exe	Firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

charmap.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	charmap.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

7.exeSndVol.execharmap.exe

pid	process
4900	7.exe
4900	7.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
5012	SndVol.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

SndVol.exeExplorer.EXEcharmap.exe

pid process

5012 SndVol.exe
3360 Explorer.EXE
3360 Explorer.EXE
2264 charmap.exe
2264 charmap.exe
2264 charmap.exe
2264 charmap.exe

pid	process
5012	SndVol.exe
3360	Explorer.EXE
3360	Explorer.EXE
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe
2264	charmap.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	3360	Explorer.EXE
Token: SeCreatePagefilePrivilege	3360	Explorer.EXE
Token: SeShutdownPrivilege	3360	Explorer.EXE
Token: SeCreatePagefilePrivilege	3360	Explorer.EXE
Token: SeShutdownPrivilege	3360	Explorer.EXE
Token: SeCreatePagefilePrivilege	3360	Explorer.EXE
Token: SeShutdownPrivilege	3360	Explorer.EXE
Token: SeCreatePagefilePrivilege	3360	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

SndVol.exe

pid process

5012 SndVol.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

SndVol.exe

pid process

5012 SndVol.exe
5012 SndVol.exe

pid	process
5012	SndVol.exe

pid	process
5012	SndVol.exe
5012	SndVol.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7.exeExplorer.EXEcharmap.exe

description	pid	process	target process
PID 4900 wrote to memory of 5012	4900	7.exe	SndVol.exe
PID 4900 wrote to memory of 5012	4900	7.exe	SndVol.exe
PID 4900 wrote to memory of 5012	4900	7.exe	SndVol.exe
PID 4900 wrote to memory of 5012	4900	7.exe	SndVol.exe
PID 3360 wrote to memory of 2264	3360	Explorer.EXE	charmap.exe
PID 3360 wrote to memory of 2264	3360	Explorer.EXE	charmap.exe
PID 3360 wrote to memory of 2264	3360	Explorer.EXE	charmap.exe
PID 2264 wrote to memory of 4888	2264	charmap.exe	Firefox.exe
PID 2264 wrote to memory of 4888	2264	charmap.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\SndVol.exe
C:\Windows\System32\SndVol.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5012

C:\Windows\SysWOW64\charmap.exe
"C:\Windows\SysWOW64\charmap.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2264

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4460

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-7-0x0000000001010000-0x000000000104F000-memory.dmp

Filesize
252KB

Download
memory/2264-9-0x0000000001010000-0x000000000104F000-memory.dmp

Filesize
252KB

Download
memory/3360-6-0x000000000D0C0000-0x000000001036F000-memory.dmp

Filesize
50.7MB

Download
memory/3360-10-0x000000000D0C0000-0x000000001036F000-memory.dmp

Filesize
50.7MB

Download
memory/3360-11-0x0000000002FF0000-0x00000000030D2000-memory.dmp

Filesize
904KB

Download
memory/4888-17-0x0000021DC33B0000-0x0000021DC346F000-memory.dmp

Filesize
764KB

Download
memory/4900-0-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/4900-1-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/5012-2-0x00000000033F0000-0x00000000043F0000-memory.dmp

Filesize
16.0MB

Download
memory/5012-4-0x0000000016D90000-0x00000000170DA000-memory.dmp

Filesize
3.3MB

Download
memory/5012-5-0x00000000033F0000-0x00000000043F0000-memory.dmp

Filesize
16.0MB

Download
memory/5012-8-0x00000000033F0000-0x00000000043F0000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads