Overview

overview

4

Static

static

3

mapper.exe

windows10-1703-x64

4

Analysis

  • max time kernel
    52s
  • max time network
    45s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05-07-2024 19:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mapper.exe

  • Size

    107KB

  • MD5

    d63c0a558ae60ae055d8f2aae1d0a494

  • SHA1

    51ed78431c44402abcea6913ecf845e1662777ba

  • SHA256

    779411d073c1aaefc7df224c9e972fd3ea848944b7fa92412c5cd71da512a729

  • SHA512

    c2f421be696ac398d158a9da6fe6586b7bd1f528bc94f7b295d65f12d515584c4d78cb901ae667c925f60182e62815fe8c64b95c6806f95cd2facfd4db52f55b

  • SSDEEP

    3072:Yppjdz7eqQfZ8G7A5G390uDmJTQSaMm5/6lWOax9gg:YppjdPsZ8qqWlQWx3

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mapper.exe
    "C:\Users\Admin\AppData\Local\Temp\mapper.exe"
    1⤵
      PID:2168
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:216
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:2020
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      PID:2624
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:976
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1092
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:2604
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:364
      • C:\Users\Admin\AppData\Local\Temp\mapper.exe
        "C:\Users\Admin\AppData\Local\Temp\mapper.exe"
        1⤵
          PID:4508
        • C:\Users\Admin\AppData\Local\Temp\mapper.exe
          "C:\Users\Admin\AppData\Local\Temp\mapper.exe"
          1⤵
            PID:192
          • C:\Users\Admin\AppData\Local\Temp\mapper.exe
            "C:\Users\Admin\AppData\Local\Temp\mapper.exe"
            1⤵
              PID:4424
            • C:\Users\Admin\AppData\Local\Temp\mapper.exe
              "C:\Users\Admin\AppData\Local\Temp\mapper.exe"
              1⤵
                PID:3196

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
                Filesize

                512KB

                MD5

                7fa52878a9507f0a04ec2428dceb55d5

                SHA1

                cd57a8b478af5a94a666d587b0c17ba147a784cb

                SHA256

                05f1e5a5a13de0bb92be6abd210bc2293a1b932cf64e5fd2b82d5beb82309fd6

                SHA512

                bc02377972bfff35638d4c65366ab0d82858fa847f5936fd8e04795a43ae43244210aa9e61024f0b5e7252cc47bd59081f40b68eaa22dac612c3a5d8ced30e06

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
                Filesize

                8KB

                MD5

                305492bfd9f2e748461797ec95d17420

                SHA1

                ac1c33bf65caeb16d57d74b16f06e3086938b37c

                SHA256

                e5716459a992242ad3246765b7de2b261d48d08c76f0d84fbde9ca9712ed503c

                SHA512

                3cb63e9f55b03051db3d4babd50e8762f22db8272bb46c5ec1ee8f906c043a3958af6fabff28475a7c22b406072f863c4a5b3746f5f0ad167fbf78f82e4effa7

                Download Submit

              • memory/216-0-0x000002936D120000-0x000002936D130000-memory.dmp

                Filesize

                64KB

                Download

              • memory/216-16-0x000002936D220000-0x000002936D230000-memory.dmp

                Filesize

                64KB

                Download

              • memory/216-35-0x000002936A6F0000-0x000002936A6F2000-memory.dmp

                Filesize

                8KB

                Download

              • memory/216-39-0x0000029371450000-0x0000029371452000-memory.dmp

                Filesize

                8KB

                Download

              • memory/216-46-0x000002936A6E0000-0x000002936A6E1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/216-42-0x000002936C400000-0x000002936C401000-memory.dmp

                Filesize

                4KB

                Download