Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 13:37

General

  • Target

    USD46k Swift_PDF.exe

  • Size

    659KB

  • MD5

    b2c97bdc5cdba659fcc2da66d2f80a8f

  • SHA1

    812541b4d56efd804b47fdae1630b69433419320

  • SHA256

    256194e31f5e3cdd00144320e30165ec54d77de265f5d959b22993b4ce124863

  • SHA512

    013abfed445d1d1868a65a9e632759d3c600c3c334cb001f6dd527557667e1bd3e95b07d4d650c8bb83cf5ebe9f8962c9a8be0b53562c880299f0fa7776f865d

  • SSDEEP

    12288:AYV6MorX7qzuC3QHO9FQVHPF51jgc1tcpHY+etwlcjM3c0Ib9:fBXu9HGaVHotetwlcuKb9

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Users\Admin\AppData\Local\Temp\USD46k Swift_PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\USD46k Swift_PDF.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\USD46k Swift_PDF.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:2508
    • C:\Windows\SysWOW64\setupugc.exe
      "C:\Windows\SysWOW64\setupugc.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bezzo

    Filesize

    267KB

    MD5

    7f90b70897582470c201796b1f5efa19

    SHA1

    b6619c8dfbc51aba1876eef95def633ac87993c4

    SHA256

    3978af8e0beb0c0a221219a4633d97a06b00726f8b1d8e9405f3c42e4a01d9c8

    SHA512

    09ff14207e239ebddf130292bf6d7fef453e969cf2bf1d2a3ae670e5ebf6e350562a505ee63d4c1bb2c8def34601f1b3dcd5b88f8cf6abdfddab364071b73748

  • C:\Users\Admin\AppData\Local\Temp\s83pr6.zip

    Filesize

    435KB

    MD5

    c42ec8f35c6a06666e6ad54471a2728b

    SHA1

    c3cc57a816927fa616616939b4b7a63c2322cfa1

    SHA256

    22bb304aab3ec7a51fc4dc7749f304bbe01c5ec014144fbc8f86012dc3b0708b

    SHA512

    6fe9a3c3f861663b6408fd5136d202835a89344072996dd65dda14fa04707662a26d0c6ed482fd0606a270943112d9effc07424af90621094f6fbb88c8ff7eae

  • \Users\Admin\AppData\Local\Temp\sqlite3.dll

    Filesize

    832KB

    MD5

    07fb6d31f37fb1b4164bef301306c288

    SHA1

    4cb41af6d63a07324ef6b18b1a1f43ce94e25626

    SHA256

    06ddf0a370af00d994824605a8e1307ba138f89b2d864539f0d19e8804edac02

    SHA512

    cab4a7c5805b80851aba5f2c9b001fabc1416f6648d891f49eacc81fe79287c5baa01306a42298da722750b812a4ea85388ffae9200dcf656dd1d5b5b9323353

  • memory/1112-28-0x0000000000160000-0x0000000000260000-memory.dmp

    Filesize

    1024KB

  • memory/1112-71-0x00000000043B0000-0x0000000004464000-memory.dmp

    Filesize

    720KB

  • memory/1112-32-0x0000000009450000-0x000000000AF7F000-memory.dmp

    Filesize

    27.2MB

  • memory/1112-31-0x00000000043B0000-0x0000000004464000-memory.dmp

    Filesize

    720KB

  • memory/1112-30-0x00000000043B0000-0x0000000004464000-memory.dmp

    Filesize

    720KB

  • memory/1112-21-0x0000000009450000-0x000000000AF7F000-memory.dmp

    Filesize

    27.2MB

  • memory/1712-12-0x0000000000160000-0x0000000000164000-memory.dmp

    Filesize

    16KB

  • memory/1712-15-0x00000000002C0000-0x0000000000437000-memory.dmp

    Filesize

    1.5MB

  • memory/1712-0-0x00000000002C0000-0x0000000000437000-memory.dmp

    Filesize

    1.5MB

  • memory/2500-29-0x0000000000970000-0x0000000000A0F000-memory.dmp

    Filesize

    636KB

  • memory/2500-69-0x0000000000090000-0x00000000000D0000-memory.dmp

    Filesize

    256KB

  • memory/2500-70-0x0000000061E00000-0x0000000061EBD000-memory.dmp

    Filesize

    756KB

  • memory/2500-26-0x0000000002330000-0x0000000002633000-memory.dmp

    Filesize

    3.0MB

  • memory/2500-27-0x0000000000090000-0x00000000000D0000-memory.dmp

    Filesize

    256KB

  • memory/2500-23-0x0000000000090000-0x00000000000D0000-memory.dmp

    Filesize

    256KB

  • memory/2500-22-0x0000000000090000-0x00000000000D0000-memory.dmp

    Filesize

    256KB

  • memory/2508-19-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2508-20-0x00000000001D0000-0x00000000001F0000-memory.dmp

    Filesize

    128KB

  • memory/2508-18-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2508-17-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2508-16-0x0000000000A00000-0x0000000000D03000-memory.dmp

    Filesize

    3.0MB

  • memory/2508-25-0x00000000001D0000-0x00000000001F0000-memory.dmp

    Filesize

    128KB

  • memory/2508-24-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2508-13-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB