9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
Size 1.2MB
Sample240613-bxptxsshkn
SHA256 9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e
MD5 ced282825c35f5b6f1636db49a9b0eed
SHA1 ca652bbc91e75329f594ac49dbb5c8ef17b0cf5e
SHA512 f4a694958b202a57d468cc10c92a76e8073593a4ef3ef9cb7b88e2e3666aa6c54189f0466151ebbb1996ad52511f22f60bfc327156dc01ac7a9669b1e78604f6
SSDEEP 24576:sAHnh+eWsN3skA4RV1Hom2KXMmHajufvrl+F6vylagx+Q8M5:Lh+ZkldoPK8Yajufvrllvuf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
4944	name.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023274-15.dat	autoit_exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 1608	4944	name.exe	90
PID 1608 set thread context of 3332	1608	svchost.exe	56
PID 1608 set thread context of 212	1608	svchost.exe	100
PID 212 set thread context of 3332	212	recover.exe	56
PID 212 set thread context of 2304	212	recover.exe	101

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	recover.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	recover.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
1608	svchost.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
4944	name.exe
1608	svchost.exe
3332	Explorer.EXE
3332	Explorer.EXE
212	recover.exe
212	recover.exe
212	recover.exe
212	recover.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4972	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
4972	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
4972	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
4944	name.exe
4944	name.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4972	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
4972	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
4972	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
4944	name.exe
4944	name.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4944	4972	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe	89
PID 4972 wrote to memory of 4944	4972	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe	89
PID 4972 wrote to memory of 4944	4972	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe	89
PID 4944 wrote to memory of 1608	4944	name.exe	90
PID 4944 wrote to memory of 1608	4944	name.exe	90
PID 4944 wrote to memory of 1608	4944	name.exe	90
PID 4944 wrote to memory of 1608	4944	name.exe	90
PID 3332 wrote to memory of 212	3332	Explorer.EXE	100
PID 3332 wrote to memory of 212	3332	Explorer.EXE	100
PID 3332 wrote to memory of 212	3332	Explorer.EXE	100
PID 212 wrote to memory of 2304	212	recover.exe	101
PID 212 wrote to memory of 2304	212	recover.exe	101

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
  "C:\Users\Admin\AppData\Local\Temp\9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Users\Admin\AppData\Local\directory\name.exe
    "C:\Users\Admin\AppData\Local\Temp\9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1608
- C:\Windows\SysWOW64\recover.exe
  "C:\Windows\SysWOW64\recover.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut47E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut47E1.tmp
Size 265KB
SHA256 45c4cb71b90bdbb261f010786c8e15fba3925ba9501e6c11f05fe9aa5b007183
MD5 b3b4f2970910321f284f5a7801189863
SHA1 d0a53f03383a74b8e760f416c69f914e8bf7eac0
SHA512 4700d83cd40ef0566f74a5038599c78f88661e33fe67b91a18ff9510be0de58e5d155f17fe44439b208740c73265ff7c5ded312fdb0da1257d66fb1b20333a89
SSDEEP 6144:FqLkx6/f0sWqUaKMuWeQO0McQNzAB3v9bClaYwmM:FikMH0NqyJYOTcQNzm3vt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ultraradicalism

Path C:\Users\Admin\AppData\Local\Temp\ultraradicalism
Size 265KB
SHA256 5befc129a1224d41728031630ea155a04ee3a41a97e1b9faf0d35f1f1e10ecd9
MD5 32b18cc50634a80087a888e2c64c8f88
SHA1 7b658169ede2ed220001af1288a2def42bef93da
SHA512 0698b46e0badd9de15443528ccc39f69c5b4d1ac03306250ebb272a5f39bfc63ebeb7931a85337ab8af85e0acb8cf84da3f7f7afce932d521f8ebbbaa14eef67
SSDEEP 3072:2vEf7VuV0M52QSr10HTgfBcmv9TnYsYqJs/1PaY9lCXoMWM:1O0McQNzAB3v9bClaYwmM
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.exe

Path C:\Users\Admin\AppData\Local\directory\name.exe
Size 1.2MB
SHA256 9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e
MD5 ced282825c35f5b6f1636db49a9b0eed
SHA1 ca652bbc91e75329f594ac49dbb5c8ef17b0cf5e
SHA512 f4a694958b202a57d468cc10c92a76e8073593a4ef3ef9cb7b88e2e3666aa6c54189f0466151ebbb1996ad52511f22f60bfc327156dc01ac7a9669b1e78604f6
SSDEEP 24576:sAHnh+eWsN3skA4RV1Hom2KXMmHajufvrl+F6vylagx+Q8M5:Lh+ZkldoPK8Yajufvrllvuf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-50-0x0000000001230000-0x000000000126F000-memory.dmp

Download

memory/212-42-0x0000000001230000-0x000000000126F000-memory.dmp

Download

memory/212-39-0x0000000001230000-0x000000000126F000-memory.dmp

Download

memory/212-38-0x0000000001230000-0x000000000126F000-memory.dmp

Download

memory/1608-36-0x0000000001920000-0x000000000193D000-memory.dmp

Download

memory/1608-35-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1608-34-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1608-33-0x0000000001B00000-0x0000000001E4A000-memory.dmp

Download

memory/1608-32-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1608-40-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1608-41-0x0000000001920000-0x000000000193D000-memory.dmp

Download

memory/1608-31-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2304-51-0x0000014AD7340000-0x0000014AD73FE000-memory.dmp

Download

memory/3332-37-0x000000000D1B0000-0x000000000FFE7000-memory.dmp

Download

memory/3332-43-0x0000000007C00000-0x0000000007D0C000-memory.dmp

Download

memory/3332-44-0x000000000D1B0000-0x000000000FFE7000-memory.dmp

Download

memory/4972-12-0x0000000002130000-0x0000000002134000-memory.dmp

Download