2ad14bdb7164ff738c6d2e78ab2ee12ab5322471c2fdb656afaa24a765aa0d62

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Maersk_Quotation034865374.exe
Size 708KB
Sample240606-sn3g4agg87
SHA256 2ad14bdb7164ff738c6d2e78ab2ee12ab5322471c2fdb656afaa24a765aa0d62
MD5 133c5b656d5c84c1bafc1c3972f60227
SHA1 638b911c288bda69c639ead240c2f03533e61356
SHA512 c1eef2df9abf65082dfc0aab1a2d405df88f3a245aeae4074a9d9ca9e817af0def43cc898318209f3f7f85ff9645ed0d6465bee6868d5349ce9d38dc01d16ae7
SSDEEP 12288:yFy2iNStcYjo++nce9YHnIDvJVhpf5rK+nj1uwJF6SYBLDD/275Y:yFy1Mc2+AHIDvJVFZjNF6XBLDD
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2652	powershell.exe
3032	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 2564	1368	Maersk_Quotation034865374.exe	35
PID 2564 set thread context of 1148	2564	Maersk_Quotation034865374.exe	20
PID 2564 set thread context of 1744	2564	Maersk_Quotation034865374.exe	38
PID 1744 set thread context of 1148	1744	relog.exe	20

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1368	Maersk_Quotation034865374.exe
1368	Maersk_Quotation034865374.exe
1368	Maersk_Quotation034865374.exe
1368	Maersk_Quotation034865374.exe
1368	Maersk_Quotation034865374.exe
1368	Maersk_Quotation034865374.exe
1368	Maersk_Quotation034865374.exe
1368	Maersk_Quotation034865374.exe
1368	Maersk_Quotation034865374.exe
2652	powershell.exe
3032	powershell.exe
2564	Maersk_Quotation034865374.exe
2564	Maersk_Quotation034865374.exe
2564	Maersk_Quotation034865374.exe
2564	Maersk_Quotation034865374.exe
2564	Maersk_Quotation034865374.exe
2564	Maersk_Quotation034865374.exe
2564	Maersk_Quotation034865374.exe
2564	Maersk_Quotation034865374.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe
1744	relog.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2564	Maersk_Quotation034865374.exe
1148	Explorer.EXE
1148	Explorer.EXE
1744	relog.exe
1744	relog.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	Maersk_Quotation034865374.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2652	1368	Maersk_Quotation034865374.exe	28
PID 1368 wrote to memory of 2652	1368	Maersk_Quotation034865374.exe	28
PID 1368 wrote to memory of 2652	1368	Maersk_Quotation034865374.exe	28
PID 1368 wrote to memory of 2652	1368	Maersk_Quotation034865374.exe	28
PID 1368 wrote to memory of 3032	1368	Maersk_Quotation034865374.exe	30
PID 1368 wrote to memory of 3032	1368	Maersk_Quotation034865374.exe	30
PID 1368 wrote to memory of 3032	1368	Maersk_Quotation034865374.exe	30
PID 1368 wrote to memory of 3032	1368	Maersk_Quotation034865374.exe	30
PID 1368 wrote to memory of 2792	1368	Maersk_Quotation034865374.exe	32
PID 1368 wrote to memory of 2792	1368	Maersk_Quotation034865374.exe	32
PID 1368 wrote to memory of 2792	1368	Maersk_Quotation034865374.exe	32
PID 1368 wrote to memory of 2792	1368	Maersk_Quotation034865374.exe	32
PID 1368 wrote to memory of 2532	1368	Maersk_Quotation034865374.exe	34
PID 1368 wrote to memory of 2532	1368	Maersk_Quotation034865374.exe	34
PID 1368 wrote to memory of 2532	1368	Maersk_Quotation034865374.exe	34
PID 1368 wrote to memory of 2532	1368	Maersk_Quotation034865374.exe	34
PID 1368 wrote to memory of 2564	1368	Maersk_Quotation034865374.exe	35
PID 1368 wrote to memory of 2564	1368	Maersk_Quotation034865374.exe	35
PID 1368 wrote to memory of 2564	1368	Maersk_Quotation034865374.exe	35
PID 1368 wrote to memory of 2564	1368	Maersk_Quotation034865374.exe	35
PID 1368 wrote to memory of 2564	1368	Maersk_Quotation034865374.exe	35
PID 1368 wrote to memory of 2564	1368	Maersk_Quotation034865374.exe	35
PID 1368 wrote to memory of 2564	1368	Maersk_Quotation034865374.exe	35
PID 1148 wrote to memory of 1744	1148	Explorer.EXE	38
PID 1148 wrote to memory of 1744	1148	Explorer.EXE	38
PID 1148 wrote to memory of 1744	1148	Explorer.EXE	38
PID 1148 wrote to memory of 1744	1148	Explorer.EXE	38

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe
  "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SxJsrFUbTx.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SxJsrFUbTx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp75EB.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe
    "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
    3⤵
    PID:2532
- - C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe
    "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2564
- C:\Windows\SysWOW64\relog.exe
  "C:\Windows\SysWOW64\relog.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp75EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp75EB.tmp
Size 1KB
SHA256 f121e0e2b9203aa2c7ca5dbd9b1b048eada3331c44e5387aafcabdff3408d2d8
MD5 5bc4f705a38bef458752b7475ba22a6d
SHA1 c79bd9853f005065376b3df988ab626b86ccaccd
SHA512 94eee793f7347333e0e1485a11140923a9dea36bedfb81cf27eb63aae5a5036d5213d4f10100c8bca540174901d7b9e9f4a544b2d66278bba72f2f7c6bdb5c1a
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 055d25c0d55f13e66f104b65798c4c2c86455233549df40238f0d719c874a526
MD5 ecc6475e6f5ba09db253065de66c4e1e
SHA1 b89dcbf7538e3af7a03de629e6b689106367f027
SHA512 4e17dec445a6012922f175cdfa34a9cc118c251e330e1f013df1c689a3857a6c8f5159b96c244d90a7361cbf2ba2edd3a81091b9cfff2f4ed44917fee68a738c
SSDEEP 96:SvJaCdM8rnqvsqvJCwoDvJaCdM8rnqvsEHyqvJCworI8fUQHYgdg7DEXlUVC:EPPUoVPPAHnorIDuC7DEZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1148-27-0x00000000003A0000-0x00000000004A0000-memory.dmp

Download

memory/1368-4-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/1368-25-0x0000000074760000-0x0000000074E4E000-memory.dmp

Download

memory/1368-5-0x0000000000AF0000-0x0000000000B00000-memory.dmp

Download

memory/1368-6-0x0000000004C90000-0x0000000004D1A000-memory.dmp

Download

memory/1368-3-0x0000000000BB0000-0x0000000000BC6000-memory.dmp

Download

memory/1368-2-0x0000000074760000-0x0000000074E4E000-memory.dmp

Download

memory/1368-1-0x0000000001330000-0x00000000013E8000-memory.dmp

Download

memory/1368-0-0x000000007476E000-0x000000007476F000-memory.dmp

Download

memory/1744-28-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/1744-29-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/2564-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2564-21-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2564-24-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2564-26-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2564-19-0x0000000000400000-0x0000000000443000-memory.dmp

Download