Analysis
- max time kernel
128s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
09/06/2024, 15:58
General
- Target 0f399d1b3a7c6dd28867095c2bdb2098.exe
- Size 1.1MB
- Sample240609-tevassch47
- SHA256 a49d396f7f272b32af4ef12abb52d5bc92ff2c97ca09b1d79436e13f1b9bf192
Malware Config
Signatures
- Suspicious use of SetThreadContext 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 59 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f399d1b3a7c6dd28867095c2bdb2098.exe"C:\Users\Admin\AppData\Local\Temp\0f399d1b3a7c6dd28867095c2bdb2098.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\0f399d1b3a7c6dd28867095c2bdb2098.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\netbtugc.exe"C:\Windows\SysWOW64\netbtugc.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3888,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
autE196.tmp
memory/584-12-0x0000000004280000-0x0000000004284000-memory.dmp
memory/3524-19-0x000000000DA30000-0x000000000F6E1000-memory.dmp
memory/3524-37-0x0000000008D70000-0x0000000008E8B000-memory.dmp
memory/3524-30-0x0000000008D70000-0x0000000008E8B000-memory.dmp
memory/3524-29-0x0000000008D70000-0x0000000008E8B000-memory.dmp
memory/3524-27-0x000000000DA30000-0x000000000F6E1000-memory.dmp
memory/3928-26-0x00000000016D0000-0x0000000001770000-memory.dmp
memory/3928-28-0x0000000001100000-0x000000000113F000-memory.dmp
memory/3928-20-0x0000000001100000-0x000000000113F000-memory.dmp
memory/3928-21-0x0000000001100000-0x000000000113F000-memory.dmp
memory/3928-25-0x0000000001100000-0x000000000113F000-memory.dmp
memory/3928-24-0x0000000001940000-0x0000000001C8A000-memory.dmp
memory/4496-22-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4496-23-0x0000000000FC0000-0x0000000000FE1000-memory.dmp
memory/4496-18-0x0000000000FC0000-0x0000000000FE1000-memory.dmp
memory/4496-16-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4496-17-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4496-15-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4496-14-0x0000000001800000-0x0000000001B4A000-memory.dmp
memory/4496-13-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4788-36-0x00000236A3120000-0x00000236A31F5000-memory.dmp