Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
29/07/2024, 13:06
General
- Target project_Emert Industrial Sdn Bhd [Rfq n.º 20240729]2400120887000033208 sample 131009800 img .exe
- Size 698KB
- Sample240729-qb4hhstfjd
- SHA256 77ac5b15d78e58b7ed803e93aa16e4742ab0b6c1eb4e0b5c8a93f3799ed00e18
Malware Config
Signatures
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\project_Emert Industrial Sdn Bhd [Rfq n.º 20240729]2400120887000033208 sample 131009800 img .exe"C:\Users\Admin\AppData\Local\Temp\project_Emert Industrial Sdn Bhd [Rfq n.º 20240729]2400120887000033208 sample 131009800 img .exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\project_Emert Industrial Sdn Bhd [Rfq n.º 20240729]2400120887000033208 sample 131009800 img .exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\project_Emert Industrial Sdn Bhd [Rfq n.º 20240729]2400120887000033208 sample 131009800 img .exe"C:\Users\Admin\AppData\Local\Temp\project_Emert Industrial Sdn Bhd [Rfq n.º 20240729]2400120887000033208 sample 131009800 img .exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\fc.exe"C:\Windows\SysWOW64\fc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_sbotapd5.dkv.ps1
memory/1016-9-0x0000000005C00000-0x0000000005C8A000-memory.dmp
memory/1016-1-0x0000000000040000-0x00000000000F4000-memory.dmp
memory/1016-2-0x0000000005020000-0x00000000055C4000-memory.dmp
memory/1016-3-0x0000000004A70000-0x0000000004B02000-memory.dmp
memory/1016-4-0x0000000004B60000-0x0000000004B6A000-memory.dmp
memory/1016-5-0x0000000074E70000-0x0000000075620000-memory.dmp
memory/1016-6-0x00000000072A0000-0x0000000007346000-memory.dmp
memory/1016-7-0x0000000004C50000-0x0000000004C62000-memory.dmp
memory/1016-0-0x0000000074E7E000-0x0000000074E7F000-memory.dmp
memory/1016-8-0x0000000004C60000-0x0000000004C6E000-memory.dmp
memory/1016-10-0x00000000097B0000-0x000000000984C000-memory.dmp
memory/1016-14-0x0000000074E70000-0x0000000075620000-memory.dmp
memory/1160-84-0x000001B19C8A0000-0x000001B19C993000-memory.dmp
memory/1664-68-0x0000000000590000-0x00000000005CF000-memory.dmp
memory/1664-69-0x0000000000590000-0x00000000005CF000-memory.dmp
memory/1664-77-0x0000000000E70000-0x0000000000F0B000-memory.dmp
memory/1664-75-0x0000000000590000-0x00000000005CF000-memory.dmp
memory/1664-74-0x0000000000E70000-0x0000000000F0B000-memory.dmp
memory/1664-73-0x0000000000590000-0x00000000005CF000-memory.dmp
memory/1664-72-0x0000000000F80000-0x00000000012CA000-memory.dmp
memory/1740-48-0x0000000006CB0000-0x0000000006D53000-memory.dmp
memory/1740-58-0x0000000007150000-0x000000000716A000-memory.dmp
memory/1740-32-0x0000000005510000-0x0000000005864000-memory.dmp
memory/1740-33-0x0000000005AC0000-0x0000000005ADE000-memory.dmp
memory/1740-34-0x0000000005B70000-0x0000000005BBC000-memory.dmp
memory/1740-36-0x0000000070D10000-0x0000000070D5C000-memory.dmp
memory/1740-35-0x0000000006080000-0x00000000060B2000-memory.dmp
memory/1740-22-0x00000000053A0000-0x0000000005406000-memory.dmp
memory/1740-47-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/1740-49-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/1740-50-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/1740-46-0x00000000060C0000-0x00000000060DE000-memory.dmp
memory/1740-52-0x0000000006DF0000-0x0000000006E0A000-memory.dmp
memory/1740-51-0x0000000007430000-0x0000000007AAA000-memory.dmp
memory/1740-53-0x0000000006E60000-0x0000000006E6A000-memory.dmp
memory/1740-54-0x0000000007090000-0x0000000007126000-memory.dmp
memory/1740-55-0x0000000007010000-0x0000000007021000-memory.dmp
memory/1740-56-0x0000000007040000-0x000000000704E000-memory.dmp
memory/1740-57-0x0000000007050000-0x0000000007064000-memory.dmp
memory/1740-20-0x0000000004A00000-0x0000000004A22000-memory.dmp
memory/1740-59-0x0000000007130000-0x0000000007138000-memory.dmp
memory/1740-62-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/1740-15-0x0000000074EFE000-0x0000000074EFF000-memory.dmp
memory/1740-17-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/1740-16-0x0000000000D10000-0x0000000000D46000-memory.dmp
memory/1740-18-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/1740-19-0x0000000004D70000-0x0000000005398000-memory.dmp
memory/1740-21-0x0000000004C20000-0x0000000004C86000-memory.dmp
memory/3588-76-0x0000000002D50000-0x0000000002E01000-memory.dmp
memory/4876-66-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4876-70-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4876-71-0x00000000010D0000-0x00000000010EC000-memory.dmp
memory/4876-67-0x00000000010D0000-0x00000000010EC000-memory.dmp
memory/4876-65-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4876-64-0x0000000001210000-0x000000000155A000-memory.dmp
memory/4876-63-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4876-13-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4876-11-0x0000000000400000-0x0000000000442000-memory.dmp