Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:47
Static task
static1
Behavioral task
behavioral1
Sample
96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe
Resource
win10v2004-20240508-en
General
-
Target
96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe
-
Size
1.1MB
-
MD5
80c0af09b3c1c54f3c5ea431e7740417
-
SHA1
e7acd710584244fa8e5f1fd9b6b4d6b096b513b4
-
SHA256
96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd
-
SHA512
654525952478a309ed58df9cea19ab53b37904df391c152ad97521bec22b95fcc40ac34ff101ad0cf7049501a3a7ca66de02237b79e1d7fcd3891751b0b94286
-
SSDEEP
24576:iAHnh+eWsN3skA4RV1Hom2KXMmHafurVuC5:lh+ZkldoPK8Yafuh
Malware Config
Signatures
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exesvchost.exesethc.exedescription pid process target process PID 4220 set thread context of 4820 4220 96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe svchost.exe PID 4820 set thread context of 3536 4820 svchost.exe Explorer.EXE PID 4820 set thread context of 1144 4820 svchost.exe sethc.exe PID 1144 set thread context of 3536 1144 sethc.exe Explorer.EXE PID 1144 set thread context of 1108 1144 sethc.exe Firefox.exe -
Processes:
sethc.exedescription ioc process Key created \Registry\User\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 sethc.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
svchost.exesethc.exepid process 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 4820 svchost.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exesvchost.exeExplorer.EXEsethc.exepid process 4220 96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe 4820 svchost.exe 3536 Explorer.EXE 3536 Explorer.EXE 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe 1144 sethc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exepid process 4220 96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe 4220 96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exepid process 4220 96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe 4220 96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3536 Explorer.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exeExplorer.EXEsethc.exedescription pid process target process PID 4220 wrote to memory of 4820 4220 96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe svchost.exe PID 4220 wrote to memory of 4820 4220 96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe svchost.exe PID 4220 wrote to memory of 4820 4220 96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe svchost.exe PID 4220 wrote to memory of 4820 4220 96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe svchost.exe PID 3536 wrote to memory of 1144 3536 Explorer.EXE sethc.exe PID 3536 wrote to memory of 1144 3536 Explorer.EXE sethc.exe PID 3536 wrote to memory of 1144 3536 Explorer.EXE sethc.exe PID 1144 wrote to memory of 1108 1144 sethc.exe Firefox.exe PID 1144 wrote to memory of 1108 1144 sethc.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe"C:\Users\Admin\AppData\Local\Temp\96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\96d5a8f60dd1a060ad1fb824d6dcad93533156606b6332e34c46c16ff88d74cd.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\sethc.exe"C:\Windows\SysWOW64\sethc.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aut46EC.tmpFilesize
265KB
MD57cd9be82c64408f8e3a2f21861cef2c9
SHA141d633723f2ad15e271a592a4438af107f351075
SHA256af66f0067f28b7a17375125281190ab146e9c173e84636cb935328d4147d6d41
SHA5128766d3e96391656324f9fc6c548a7b39db5bfb44662d9eb09dc85b330c34dfeda101360273221474b50b6202eb56b84d0a4119020c2de2fea36c7eec29c1c7c7
-
memory/1108-37-0x0000028D21350000-0x0000028D21451000-memory.dmpFilesize
1.0MB
-
memory/1144-26-0x0000000002A10000-0x0000000002AA9000-memory.dmpFilesize
612KB
-
memory/1144-20-0x0000000000C00000-0x0000000000C3F000-memory.dmpFilesize
252KB
-
memory/1144-38-0x0000000002A10000-0x0000000002AA9000-memory.dmpFilesize
612KB
-
memory/1144-36-0x0000000000C00000-0x0000000000C3F000-memory.dmpFilesize
252KB
-
memory/1144-25-0x0000000000C00000-0x0000000000C3F000-memory.dmpFilesize
252KB
-
memory/1144-24-0x0000000002BD0000-0x0000000002F1A000-memory.dmpFilesize
3.3MB
-
memory/1144-21-0x0000000000C00000-0x0000000000C3F000-memory.dmpFilesize
252KB
-
memory/3536-19-0x000000000CDD0000-0x000000000D1E8000-memory.dmpFilesize
4.1MB
-
memory/3536-27-0x0000000008C00000-0x0000000008CE8000-memory.dmpFilesize
928KB
-
memory/3536-39-0x0000000008C00000-0x0000000008CE8000-memory.dmpFilesize
928KB
-
memory/3536-29-0x000000000CDD0000-0x000000000D1E8000-memory.dmpFilesize
4.1MB
-
memory/3536-28-0x0000000008C00000-0x0000000008CE8000-memory.dmpFilesize
928KB
-
memory/4220-12-0x0000000001190000-0x0000000001194000-memory.dmpFilesize
16KB
-
memory/4820-18-0x0000000000F90000-0x0000000000FAA000-memory.dmpFilesize
104KB
-
memory/4820-13-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4820-17-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4820-14-0x0000000001600000-0x000000000194A000-memory.dmpFilesize
3.3MB
-
memory/4820-16-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4820-22-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4820-15-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4820-23-0x0000000000F90000-0x0000000000FAA000-memory.dmpFilesize
104KB