Analysis
-
max time kernel
145s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 04:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe
Resource
win7-20240220-en
General
-
Target
2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe
-
Size
699KB
-
MD5
fbf01e7b1520736595417ae322402ecf
-
SHA1
235a8c1bc504e09dc7a0d48382d45392076dada0
-
SHA256
c4215902948729d99513b7969979667aca3d05d45300989448b52769163c990b
-
SHA512
ad2d158e3c133fdb9452c753513ad7f0b2daf7fca930f55108ade37d21ab37f8d5fba31e4b7efbd4c476f504efb3a5b3ce4686cb268dc0103471deb85de4d840
-
SSDEEP
12288:FMzQsCZBCotU1/Em1fo2vvOTbD9ZRPHc7iNkkcJLXjpZ+KdAAkkR:FbdUEefnvsDLpcGcJLTSYAm
Malware Config
Extracted
formbook
4.1
dd20
unblurd.com
docu-zign.com
randijpaulsen.com
angsabet.com
sedatelynx.com
opiumcore.store
thelordismysaviormerch.com
mindstudio.support
waterbygraceteam.com
furnitureinspiredbythesea.com
amablanca.com
hespelerdental.com
arcalid.net
balajinursingbureau.online
caixias.shop
solingen-buergerstiftung.com
194916.top
6travel-insurance.xyz
xn--fiqp9b17y.xn--czr694b
syntixi.trade
dataaudit.xyz
judgefever.com
agapornis.pet
sparkasse-banking-service.app
holylandmerch.com
synive.com
knittingbyangela.com
keytorapidweightloss.com
maradesarrollos.store
asherveer.com
kalame.info
khuwezu.top
myfreebd.com
jeepcherokeedeals.xyz
pointschauds.net
narae.xyz
nsivyyu.top
vetlinx360.com
1709frankford.com
checchintrasportilogistica.com
grupoagrarius.com
themasternoi.com
wurdsspeledrong.com
xn--diseafacil-w9a.com
playtoown.shop
butrikl.xyz
amazonpublisherservice.com
belihape.com
ajaysilverpalace.in
geredehanhotel.com
cruises-11028.bond
catering-57592.bond
haloogi.com
compasstransportaion.com
713952.site
downloadfirekirin.xyz
soapcoverr.store
wellnesswomenassociation.com
nortiapro.com
trustedoakllc.info
canadasimnigeria.com
aiappsreviews.com
dct15.com
venenciadorapp.com
fight4yourhappiness.com
Signatures
-
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2868-6-0x0000000000570000-0x000000000057C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2396-25-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2772-30-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2548 powershell.exe 2604 powershell.exe 2604 powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exeRegSvcs.exeNETSTAT.EXEdescription pid process target process PID 2868 set thread context of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2396 set thread context of 1084 2396 RegSvcs.exe Explorer.EXE PID 2772 set thread context of 1084 2772 NETSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 2772 NETSTAT.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exepowershell.exepowershell.exeRegSvcs.exeNETSTAT.EXEpid process 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe 2604 powershell.exe 2548 powershell.exe 2396 RegSvcs.exe 2396 RegSvcs.exe 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE 2772 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeNETSTAT.EXEpid process 2396 RegSvcs.exe 2396 RegSvcs.exe 2396 RegSvcs.exe 2772 NETSTAT.EXE 2772 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exepowershell.exepowershell.exeRegSvcs.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe Token: SeDebugPrivilege 2604 powershell.exe Token: SeDebugPrivilege 2548 powershell.exe Token: SeDebugPrivilege 2396 RegSvcs.exe Token: SeDebugPrivilege 2772 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 2868 wrote to memory of 2604 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe powershell.exe PID 2868 wrote to memory of 2604 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe powershell.exe PID 2868 wrote to memory of 2604 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe powershell.exe PID 2868 wrote to memory of 2604 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe powershell.exe PID 2868 wrote to memory of 2548 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe powershell.exe PID 2868 wrote to memory of 2548 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe powershell.exe PID 2868 wrote to memory of 2548 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe powershell.exe PID 2868 wrote to memory of 2548 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe powershell.exe PID 2868 wrote to memory of 2680 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe schtasks.exe PID 2868 wrote to memory of 2680 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe schtasks.exe PID 2868 wrote to memory of 2680 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe schtasks.exe PID 2868 wrote to memory of 2680 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe schtasks.exe PID 2868 wrote to memory of 2632 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2632 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2632 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2632 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2632 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2632 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2632 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 2868 wrote to memory of 2396 2868 2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe RegSvcs.exe PID 1084 wrote to memory of 2772 1084 Explorer.EXE NETSTAT.EXE PID 1084 wrote to memory of 2772 1084 Explorer.EXE NETSTAT.EXE PID 1084 wrote to memory of 2772 1084 Explorer.EXE NETSTAT.EXE PID 1084 wrote to memory of 2772 1084 Explorer.EXE NETSTAT.EXE PID 2772 wrote to memory of 1528 2772 NETSTAT.EXE cmd.exe PID 2772 wrote to memory of 1528 2772 NETSTAT.EXE cmd.exe PID 2772 wrote to memory of 1528 2772 NETSTAT.EXE cmd.exe PID 2772 wrote to memory of 1528 2772 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-06-24_fbf01e7b1520736595417ae322402ecf_hiddentear.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VsAqHSKubQRZuY.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VsAqHSKubQRZuY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp475C.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp475C.tmpFilesize
1KB
MD5c2df6e460dd00a63b8120813f3b23370
SHA1a776a4b00eb80b2798258bab6f1d6845ab4368e8
SHA256d9799dd26598f455b2f1ec1ea71f0da36cab95e35b8c0c6eae21e91e07f2676e
SHA512c6ec3cbfb7d7f114ca9298a885a7f3c587ee0a42096527dd02b23248eb436c82322065ab2a63703ac71aec83e94013c5000f3fe7964d2addad55261a6f0b14a7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5df48cd3f99c088843a233590a6d3446d
SHA1fddb89bd6fe995d5a42502692a42f5c266ae5594
SHA2569284b18a1d9cd470959a1320a0c93e7667b830dc94174d27df2a6073bff3715d
SHA512d0082da94ed947d9cc7f462ccb255c5e83ff957e665fec74501f49f9e475d99522c86dd0beb0ec59d32dca69149d41495a9b57fb8b8ff45d770436240c46cf3b
-
memory/1084-35-0x0000000004080000-0x0000000004142000-memory.dmpFilesize
776KB
-
memory/1084-28-0x0000000002FE0000-0x00000000030E0000-memory.dmpFilesize
1024KB
-
memory/2396-25-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2396-21-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2396-22-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2396-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2772-30-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2772-29-0x0000000000770000-0x0000000000779000-memory.dmpFilesize
36KB
-
memory/2868-4-0x00000000004B0000-0x00000000004C2000-memory.dmpFilesize
72KB
-
memory/2868-26-0x0000000074610000-0x0000000074CFE000-memory.dmpFilesize
6.9MB
-
memory/2868-0-0x000000007461E000-0x000000007461F000-memory.dmpFilesize
4KB
-
memory/2868-2-0x0000000074610000-0x0000000074CFE000-memory.dmpFilesize
6.9MB
-
memory/2868-5-0x0000000000520000-0x0000000000528000-memory.dmpFilesize
32KB
-
memory/2868-3-0x0000000002050000-0x00000000020DE000-memory.dmpFilesize
568KB
-
memory/2868-7-0x0000000005290000-0x0000000005306000-memory.dmpFilesize
472KB
-
memory/2868-6-0x0000000000570000-0x000000000057C000-memory.dmpFilesize
48KB
-
memory/2868-1-0x0000000000340000-0x00000000003F2000-memory.dmpFilesize
712KB