84c514f841b26e888b56a0baa77c5ecd7e49ce270845ab35806016e468ff6d1b

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
Size

1.1MB
MD5

14e46bbab699b36b4dd13c1534c9d6cf
SHA1

aa8cb619778e5086de63ef93d3aea6f9863d4fb8
SHA256

d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c
SHA512

d6d14206a972ccee542acb66e9ccd12d256db1a325cdaefeffeac34fd38b68ddc3ec5a04587c55c2172edcb4779a064d83006858f99a31704e70e2a4b11d978c
SSDEEP

24576:JAHnh+eWsN3skA4RV1Hom2KXMmHar7kekao2D4TOGeAhsP5:Qh+ZkldoPK8YaPLDUDhA

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4036 set thread context of 3508	4036	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	86
PID 3508 set thread context of 3368	3508	svchost.exe	56
PID 3508 set thread context of 1952	3508	svchost.exe	100
PID 1952 set thread context of 3368	1952	whoami.exe	56
PID 1952 set thread context of 752	1952	whoami.exe	110

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	whoami.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
3508	svchost.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
4036	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
3508	svchost.exe
3368	Explorer.EXE
3368	Explorer.EXE
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe
1952	whoami.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4036	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
4036	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4036	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
4036	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3368	Explorer.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 3508	4036	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	86
PID 4036 wrote to memory of 3508	4036	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	86
PID 4036 wrote to memory of 3508	4036	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	86
PID 4036 wrote to memory of 3508	4036	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	86
PID 3368 wrote to memory of 1952	3368	Explorer.EXE	100
PID 3368 wrote to memory of 1952	3368	Explorer.EXE	100
PID 3368 wrote to memory of 1952	3368	Explorer.EXE	100
PID 1952 wrote to memory of 752	1952	whoami.exe	110
PID 1952 wrote to memory of 752	1952	whoami.exe	110

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
  "C:\Users\Admin\AppData\Local\Temp\d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3508
- C:\Windows\SysWOW64\whoami.exe
  "C:\Windows\SysWOW64\whoami.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut4C8A.tmp

Filesize
268KB

MD5
740d19aa118d963b587d80fe480f8844

SHA1
271d9eebf24bb1b8986871bedd19d87e8b1ab62f

SHA256
37162e911e48eeb3599f6411be0c988580e2fefb6465f520f0573ed4753d19c2

SHA512
b354cd62a5e48578501901dab7cc2fd5023cad4ac8fe5df3683fd6a3dc80b2810379acefb711971fca843e5b10c8fca77ac50bab9ae6ff3403cf45ef8716bb5d

Download Submit
memory/752-37-0x000001D0DB760000-0x000001D0DB867000-memory.dmp

Filesize
1.0MB

Download
memory/1952-26-0x0000000002B40000-0x0000000002BE1000-memory.dmp

Filesize
644KB

Download
memory/1952-24-0x0000000002D30000-0x000000000307A000-memory.dmp

Filesize
3.3MB

Download
memory/1952-27-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Filesize
256KB

Download
memory/1952-25-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Filesize
256KB

Download
memory/1952-20-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Filesize
256KB

Download
memory/1952-21-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Filesize
256KB

Download
memory/3368-30-0x0000000002BA0000-0x0000000002C50000-memory.dmp

Filesize
704KB

Download
memory/3368-29-0x0000000002BA0000-0x0000000002C50000-memory.dmp

Filesize
704KB

Download
memory/3368-28-0x0000000002BA0000-0x0000000002C50000-memory.dmp

Filesize
704KB

Download
memory/3508-23-0x00000000017A0000-0x00000000017C2000-memory.dmp

Filesize
136KB

Download
memory/3508-22-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3508-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3508-19-0x00000000017A0000-0x00000000017C2000-memory.dmp

Filesize
136KB

Download
memory/3508-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3508-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3508-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3508-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3508-15-0x0000000001900000-0x0000000001C4A000-memory.dmp

Filesize
3.3MB

Download
memory/4036-12-0x0000000000B30000-0x0000000000B34000-memory.dmp

Filesize
16KB

Download