ebbe8ce97106c2b4caddd85bf02f28030340778f1ceee76ab80f4129058d5f0a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Booking_56012.exe
Size

206KB
MD5

83120f5a0cd8bcd617591ec021206a9c
SHA1

ca22698f2d51237c73251f96bf20debdcafd07b9
SHA256

0c9481d5e13d3244edc461205c3bdc7a5819302335e45127528f0724234774a8
SHA512

7e53d703b0f717ce499fd5ed0844cee005913bf3445add48cd32bada0f6bd0594996d2a362e534d8cc3881a61e889ff5e9e0ea7841e8fe62262f6f54a61972f2
SSDEEP

3072:K/nRNnCDDRvLGmrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/oPYm21KLbDoU1sNj:ystvLGtELbMUTKZj

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5896	dociv.exe

Loads dropped DLL 6 IoCs

pid	Process
1252	Booking_56012.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\ioiob = "C:\\Users\\Admin\\AppData\\Roaming\\ioiob.exe"	Booking_56012.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\ioiozb = "C:\\Users\\Admin\\AppData\\Roaming\\ioiozb.exe"	dociv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5996	1252	WerFault.exe	29
4064	5896	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Booking_56012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dociv.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1252	Booking_56012.exe
5896	dociv.exe
5896	dociv.exe
5896	dociv.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	Booking_56012.exe
Token: SeDebugPrivilege	5896	dociv.exe
Token: SeDebugPrivilege	1252	Booking_56012.exe
Token: SeDebugPrivilege	5896	dociv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 5896	1252	Booking_56012.exe	30
PID 1252 wrote to memory of 5896	1252	Booking_56012.exe	30
PID 1252 wrote to memory of 5896	1252	Booking_56012.exe	30
PID 1252 wrote to memory of 5896	1252	Booking_56012.exe	30
PID 1252 wrote to memory of 5996	1252	Booking_56012.exe	31
PID 1252 wrote to memory of 5996	1252	Booking_56012.exe	31
PID 1252 wrote to memory of 5996	1252	Booking_56012.exe	31
PID 1252 wrote to memory of 5996	1252	Booking_56012.exe	31
PID 5896 wrote to memory of 4064	5896	dociv.exe	34
PID 5896 wrote to memory of 4064	5896	dociv.exe	34
PID 5896 wrote to memory of 4064	5896	dociv.exe	34
PID 5896 wrote to memory of 4064	5896	dociv.exe	34

C:\Users\Admin\AppData\Local\Temp\Booking_56012.exe
"C:\Users\Admin\AppData\Local\Temp\Booking_56012.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\dociv.exe
  "C:\Users\Admin\AppData\Local\Temp\dociv.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 1176
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:4064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 1336
  2⤵
  - Program crash
  PID:5996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dociv.exe

Filesize
206KB

MD5
a9b2a704f9a861444e03cf570636b20c

SHA1
941a008f6cfd986f5b347b7f9a0624d780c05dca

SHA256
7225299b238bb77d77f2497b588469fb1dde1b385ac5da8cc8a3449b8c422d07

SHA512
c19c3008ee28d259e344cd3a2f4ae7aef8627b3f27daf49049080bf18146a6b07276a5488ae4dbed1dd216f73c5585a43a647ab6fffe65a08673d0264091d668

Download Submit
memory/1252-0-0x000000007497E000-0x000000007497F000-memory.dmp

Filesize
4KB

Download
memory/1252-1-0x0000000000040000-0x0000000000076000-memory.dmp

Filesize
216KB

Download
memory/1252-2-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/1252-3-0x0000000005BD0000-0x0000000005CD4000-memory.dmp

Filesize
1.0MB

Download
memory/1252-4-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-5-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-7-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-9-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-11-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-27-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-45-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-51-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-57-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-13-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-15-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-17-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-19-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-21-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-23-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-25-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-1080-0x0000000004280000-0x00000000042CC000-memory.dmp

Filesize
304KB

Download
memory/1252-1079-0x0000000005260000-0x00000000052DE000-memory.dmp

Filesize
504KB

Download
memory/1252-1078-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/1252-67-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-65-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-63-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-61-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-59-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-55-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-53-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-1091-0x0000000004DA0000-0x0000000004DF4000-memory.dmp

Filesize
336KB

Download
memory/1252-49-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-47-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-43-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-41-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-39-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-37-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-35-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-33-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-31-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-29-0x0000000005BD0000-0x0000000005CCE000-memory.dmp

Filesize
1016KB

Download
memory/1252-1093-0x000000007497E000-0x000000007497F000-memory.dmp

Filesize
4KB

Download
memory/1252-1094-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/5896-1089-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/5896-1090-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/5896-1088-0x0000000000E40000-0x0000000000E76000-memory.dmp

Filesize
216KB

Download
memory/5896-1095-0x0000000005C80000-0x0000000005E02000-memory.dmp

Filesize
1.5MB

Download
memory/5896-2170-0x0000000006010000-0x000000000610C000-memory.dmp

Filesize
1008KB

Download
memory/5896-2171-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/5896-2178-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download