2ad14bdb7164ff738c6d2e78ab2ee12ab5322471c2fdb656afaa24a765aa0d62

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Maersk_Quotation034865374.exe
Size 708KB
Sample240606-sn3g4agg87
SHA256 2ad14bdb7164ff738c6d2e78ab2ee12ab5322471c2fdb656afaa24a765aa0d62
MD5 133c5b656d5c84c1bafc1c3972f60227
SHA1 638b911c288bda69c639ead240c2f03533e61356
SHA512 c1eef2df9abf65082dfc0aab1a2d405df88f3a245aeae4074a9d9ca9e817af0def43cc898318209f3f7f85ff9645ed0d6465bee6868d5349ce9d38dc01d16ae7
SSDEEP 12288:yFy2iNStcYjo++nce9YHnIDvJVhpf5rK+nj1uwJF6SYBLDD/275Y:yFy1Mc2+AHIDvJVFZjNF6XBLDD
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
448	powershell.exe
4572	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Maersk_Quotation034865374.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3176 set thread context of 4664	3176	Maersk_Quotation034865374.exe	106
PID 4664 set thread context of 3488	4664	Maersk_Quotation034865374.exe	56
PID 4664 set thread context of 4364	4664	Maersk_Quotation034865374.exe	110
PID 4364 set thread context of 3488	4364	relog.exe	56
PID 4364 set thread context of 1372	4364	relog.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1676	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	relog.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
448	powershell.exe
448	powershell.exe
4572	powershell.exe
4572	powershell.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
4572	powershell.exe
3176	Maersk_Quotation034865374.exe
3176	Maersk_Quotation034865374.exe
448	powershell.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4664	Maersk_Quotation034865374.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4664	Maersk_Quotation034865374.exe
3488	Explorer.EXE
3488	Explorer.EXE
4364	relog.exe
4364	relog.exe
4364	relog.exe
4364	relog.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	Maersk_Quotation034865374.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3488	Explorer.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 448	3176	Maersk_Quotation034865374.exe	96
PID 3176 wrote to memory of 448	3176	Maersk_Quotation034865374.exe	96
PID 3176 wrote to memory of 448	3176	Maersk_Quotation034865374.exe	96
PID 3176 wrote to memory of 4572	3176	Maersk_Quotation034865374.exe	98
PID 3176 wrote to memory of 4572	3176	Maersk_Quotation034865374.exe	98
PID 3176 wrote to memory of 4572	3176	Maersk_Quotation034865374.exe	98
PID 3176 wrote to memory of 1676	3176	Maersk_Quotation034865374.exe	100
PID 3176 wrote to memory of 1676	3176	Maersk_Quotation034865374.exe	100
PID 3176 wrote to memory of 1676	3176	Maersk_Quotation034865374.exe	100
PID 3176 wrote to memory of 3328	3176	Maersk_Quotation034865374.exe	102
PID 3176 wrote to memory of 3328	3176	Maersk_Quotation034865374.exe	102
PID 3176 wrote to memory of 3328	3176	Maersk_Quotation034865374.exe	102
PID 3176 wrote to memory of 908	3176	Maersk_Quotation034865374.exe	103
PID 3176 wrote to memory of 908	3176	Maersk_Quotation034865374.exe	103
PID 3176 wrote to memory of 908	3176	Maersk_Quotation034865374.exe	103
PID 3176 wrote to memory of 5020	3176	Maersk_Quotation034865374.exe	104
PID 3176 wrote to memory of 5020	3176	Maersk_Quotation034865374.exe	104
PID 3176 wrote to memory of 5020	3176	Maersk_Quotation034865374.exe	104
PID 3176 wrote to memory of 3820	3176	Maersk_Quotation034865374.exe	105
PID 3176 wrote to memory of 3820	3176	Maersk_Quotation034865374.exe	105
PID 3176 wrote to memory of 3820	3176	Maersk_Quotation034865374.exe	105
PID 3176 wrote to memory of 4664	3176	Maersk_Quotation034865374.exe	106
PID 3176 wrote to memory of 4664	3176	Maersk_Quotation034865374.exe	106
PID 3176 wrote to memory of 4664	3176	Maersk_Quotation034865374.exe	106
PID 3176 wrote to memory of 4664	3176	Maersk_Quotation034865374.exe	106
PID 3176 wrote to memory of 4664	3176	Maersk_Quotation034865374.exe	106
PID 3176 wrote to memory of 4664	3176	Maersk_Quotation034865374.exe	106
PID 3488 wrote to memory of 4364	3488	Explorer.EXE	110
PID 3488 wrote to memory of 4364	3488	Explorer.EXE	110
PID 3488 wrote to memory of 4364	3488	Explorer.EXE	110
PID 4364 wrote to memory of 1372	4364	relog.exe	119
PID 4364 wrote to memory of 1372	4364	relog.exe	119

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe
  "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SxJsrFUbTx.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SxJsrFUbTx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp976D.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe
    "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
    3⤵
    PID:3328
- - C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe
    "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
    3⤵
    PID:908
- - C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe
    "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
    3⤵
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe
    "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe
    "C:\Users\Admin\AppData\Local\Temp\Maersk_Quotation034865374.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4664
- C:\Windows\SysWOW64\relog.exe
  "C:\Windows\SysWOW64\relog.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 c8805df781f3cdd947938c0ef78404d48c0a26c2f7166becfe81dce1b1422ab8
MD5 1c3a1d9c475fd3e7f6fc2a982dd4f1ef
SHA1 cc78555cb114d0451ee37fd3e0c43c2e0ccd50c5
SHA512 88dde7a86752a5b281116f808052c923871333674f07ed0ff1486a218f30be5f5d3c54a165af665a049c55145a03f5397e14f8b2d774c4e294c14b131403e26d
SSDEEP 384:2sf+BC9i+OrIBXi6x2Jk+o9oYTVK6seYLME/B03SoZafYSgojEDkSQ0gdMtkKhD:TfirsdxrjoYTVNgrqSFW2ED/Cm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_jomw4via.dbo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jomw4via.dbo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmp976D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp976D.tmp
Size 1KB
SHA256 e98954e7f9d11a9a5278f025c1845f95847142266bca16842f94984d2b25d4db
MD5 d2a71ed3cb0bbfa1e039270777519cb3
SHA1 ae27e2a70edec7821f8c7f279f1c97a30006b810
SHA512 4cf5049c3f728c4ab810f3d883e9dac1a9179a5676f1d380124071c01d728575fc8d151070531b4740c2f64d03fa8bb50ec5ee21e10c0e28c028c0ed9b76ce3b
MD5 SHA1 SHA512

Submit Download

memory/448-79-0x0000000007400000-0x0000000007411000-memory.dmp

Download

memory/448-75-0x0000000007840000-0x0000000007EBA000-memory.dmp

Download

memory/448-76-0x0000000007200000-0x000000000721A000-memory.dmp

Download

memory/448-65-0x00000000755E0000-0x000000007562C000-memory.dmp

Download

memory/448-77-0x0000000007270000-0x000000000727A000-memory.dmp

Download

memory/448-39-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/448-78-0x0000000007480000-0x0000000007516000-memory.dmp

Download

memory/448-89-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/448-15-0x0000000002620000-0x0000000002656000-memory.dmp

Download

memory/448-17-0x00000000050D0000-0x00000000056F8000-memory.dmp

Download

memory/448-18-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/448-80-0x0000000007430000-0x000000000743E000-memory.dmp

Download

memory/448-21-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/1372-101-0x000001ED44160000-0x000001ED4425C000-memory.dmp

Download

memory/3176-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

Download

memory/3176-5-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Download

memory/3176-3-0x0000000005A60000-0x0000000005AF2000-memory.dmp

Download

memory/3176-6-0x0000000007040000-0x0000000007056000-memory.dmp

Download

memory/3176-4-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/3176-2-0x0000000005F70000-0x0000000006514000-memory.dmp

Download

memory/3176-48-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/3176-7-0x0000000006C30000-0x0000000006C3E000-memory.dmp

Download

memory/3176-16-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

Download

memory/3176-10-0x0000000009460000-0x00000000094FC000-memory.dmp

Download

memory/3176-8-0x0000000006C40000-0x0000000006C50000-memory.dmp

Download

memory/3176-1-0x0000000000F60000-0x0000000001018000-memory.dmp

Download

memory/3176-9-0x0000000006CB0000-0x0000000006D3A000-memory.dmp

Download

memory/3488-94-0x0000000002C40000-0x0000000002D18000-memory.dmp

Download

memory/4364-93-0x0000000000DC0000-0x0000000000DFF000-memory.dmp

Download

memory/4364-92-0x0000000000DC0000-0x0000000000DFF000-memory.dmp

Download

memory/4572-20-0x0000000005310000-0x0000000005376000-memory.dmp

Download

memory/4572-83-0x00000000078F0000-0x00000000078F8000-memory.dmp

Download

memory/4572-64-0x00000000074B0000-0x0000000007553000-memory.dmp

Download

memory/4572-52-0x0000000006840000-0x0000000006872000-memory.dmp

Download

memory/4572-51-0x00000000068A0000-0x00000000068EC000-memory.dmp

Download

memory/4572-50-0x00000000062A0000-0x00000000062BE000-memory.dmp

Download

memory/4572-49-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/4572-81-0x0000000007810000-0x0000000007824000-memory.dmp

Download

memory/4572-82-0x0000000007910000-0x000000000792A000-memory.dmp

Download

memory/4572-63-0x0000000006800000-0x000000000681E000-memory.dmp

Download

memory/4572-47-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/4572-38-0x0000000005CE0000-0x0000000006034000-memory.dmp

Download

memory/4572-90-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/4572-45-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/4572-22-0x0000000005430000-0x0000000005496000-memory.dmp

Download

memory/4572-53-0x00000000755E0000-0x000000007562C000-memory.dmp

Download

memory/4572-19-0x00000000051F0000-0x0000000005212000-memory.dmp

Download

memory/4664-44-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4664-91-0x0000000000400000-0x0000000000443000-memory.dmp

Download