Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/06/2024, 16:18
General
- Target PO 886060324.exe
- Size 976KB
- Sample240603-tsbevacb3x
- SHA256 3960ee46ae25e3141eb0a05b0caffafc7b40655ea178fc11eada45e590fd6e00
Malware Config
Signatures
- Suspicious use of SetThreadContext 5 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 886060324.exe"C:\Users\Admin\AppData\Local\Temp\PO 886060324.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 886060324.exe"C:\Users\Admin\AppData\Local\Temp\PO 886060324.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1484-24-0x00000000009B0000-0x00000000009EF000-memory.dmp
memory/1484-32-0x00000000009B0000-0x00000000009EF000-memory.dmp
memory/1484-30-0x0000000001740000-0x00000000017E4000-memory.dmp
memory/1484-29-0x00000000009B0000-0x00000000009EF000-memory.dmp
memory/1484-28-0x0000000001340000-0x000000000168A000-memory.dmp
memory/1484-25-0x00000000009B0000-0x00000000009EF000-memory.dmp
memory/1672-9-0x0000000006150000-0x0000000006166000-memory.dmp
memory/1672-1-0x0000000000C10000-0x0000000000D0A000-memory.dmp
memory/1672-8-0x00000000070F0000-0x0000000007196000-memory.dmp
memory/1672-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp
memory/1672-10-0x00000000063E0000-0x00000000063EE000-memory.dmp
memory/1672-11-0x00000000063F0000-0x0000000006400000-memory.dmp
memory/1672-12-0x0000000006C60000-0x0000000006CEA000-memory.dmp
memory/1672-13-0x0000000009580000-0x000000000961C000-memory.dmp
memory/1672-7-0x0000000006190000-0x00000000061A2000-memory.dmp
memory/1672-3-0x0000000005620000-0x00000000056B2000-memory.dmp
memory/1672-17-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/1672-5-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/1672-6-0x0000000005AD0000-0x0000000005ADA000-memory.dmp
memory/1672-4-0x00000000056C0000-0x0000000005A14000-memory.dmp
memory/1672-2-0x0000000005B30000-0x00000000060D4000-memory.dmp
memory/3404-31-0x000000000BF80000-0x000000000C5D2000-memory.dmp
memory/3404-23-0x000000000BF80000-0x000000000C5D2000-memory.dmp
memory/3404-33-0x0000000002860000-0x0000000002921000-memory.dmp
memory/3404-34-0x0000000002860000-0x0000000002921000-memory.dmp
memory/3404-42-0x0000000002860000-0x0000000002921000-memory.dmp
memory/3600-14-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3600-26-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3600-27-0x00000000020E0000-0x0000000002105000-memory.dmp
memory/3600-22-0x00000000020E0000-0x0000000002105000-memory.dmp
memory/3600-21-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3600-20-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3600-19-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3600-18-0x00000000016A0000-0x00000000019EA000-memory.dmp
memory/3600-16-0x0000000000400000-0x0000000000443000-memory.dmp
memory/4564-41-0x0000024AD3A50000-0x0000024AD3B17000-memory.dmp