Overview

overview

7

Static

static

1

URLScan

urlscan

1

https://libertyinves...

windows10-1703-x64

4

https://libertyinves...

android-10-x64

7

Analysis

  • max time kernel
    134s
  • max time network
    142s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-05-2024 11:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://libertyinvestmentbank.com/cgi-bin/404.php?2-797967704b536932307464505473314a533077744c736c4d7a4e45724b74584c537933527a2f6331715377736941776f31382f4d53306d74304d736f7963304241413d3d-PbCetJ

Score
4/10
execution

Malware Config

Signatures

  • Drops file in Windows directory 6 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://libertyinvestmentbank.com/cgi-bin/404.php?2-797967704b536932307464505473314a533077744c736c4d7a4e45724b74584c537933527a2f6331715377736941776f31382f4d53306d74304d736f7963304241413d3d-PbCetJ"
    1⤵
      PID:2820
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1604
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\404.js"
        2⤵
          PID:1100
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4924
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1224
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies registry class
        PID:2936
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies registry class
        PID:528
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1404

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V28C7N3J\edgecompatviewlist[1].xml
        Filesize

        74KB

        MD5

        d4fc49dc14f63895d997fa4940f24378

        SHA1

        3efb1437a7c5e46034147cbbc8db017c69d02c31

        SHA256

        853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

        SHA512

        cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HQ1Q1KH7\404[1].js
        Filesize

        63KB

        MD5

        8daee3ca5ad784214eaaa6db37a75310

        SHA1

        536d40bea8df84eaa8b791fd4e873774ea0a8f97

        SHA256

        dc38bace4d23e08c8023e06510c57ca9b2659fb81ea07bf5f1fabdf155ae85b6

        SHA512

        f6fd4eddc2d7967ec08b38c83a380ad43a210abd19be21a834032f74d28dc22cd3dc2bba0dd49cf9a8106f5977819578e3247f4cd6457104c1990a14dc2eee6b

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\DIHW250H\favicon[1].ico
        Filesize

        758B

        MD5

        84cc977d0eb148166481b01d8418e375

        SHA1

        00e2461bcd67d7ba511db230415000aefbd30d2d

        SHA256

        bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

        SHA512

        f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HQ1Q1KH7\404[1].js
        Filesize

        8KB

        MD5

        ea353e88d4d5e01839231f501af146fc

        SHA1

        1b124118480bcafcbfe73683ce63b0698aa1b5bb

        SHA256

        d93ba50755aef9494e3b42bc9aa552d6fe8b482b945d9cea9201f9b3c39c308f

        SHA512

        c001f5a5868684e62149b63f1d4ea93a7771fe90b94bc71693942cfa810656d4b06c12714d2520cb57a126f050b75922da6c7664f9a6ca5a1c99b22862f72a53

        Download Submit

      • memory/528-78-0x00000215B6200000-0x00000215B6300000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1224-45-0x0000029BE5A40000-0x0000029BE5B40000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1404-194-0x00000183B3A20000-0x00000183B3A40000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1404-175-0x00000183C5180000-0x00000183C5280000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1404-155-0x00000183B43C0000-0x00000183B43E0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1404-147-0x00000183B38A0000-0x00000183B39A0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1404-146-0x00000183B3860000-0x00000183B3880000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1404-127-0x00000183A2F60000-0x00000183A3060000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1604-69-0x0000019368070000-0x0000019368071000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1604-0-0x0000019361420000-0x0000019361430000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1604-70-0x0000019368080000-0x0000019368081000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1604-35-0x00000193606E0000-0x00000193606E2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1604-16-0x0000019361520000-0x0000019361530000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2936-58-0x00000136558E0000-0x00000136559E0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/2936-66-0x0000013665CA0000-0x0000013665CA2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2936-64-0x0000013665AE0000-0x0000013665AE2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2936-61-0x0000013665AB0000-0x0000013665AB2000-memory.dmp

        Filesize

        8KB

        Download