Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 13:33
Behavioral task
behavioral1
Sample
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe
Resource
win7-20240508-en
General
-
Target
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe
-
Size
14.4MB
-
MD5
36c5b406543fc52d5ee8736ed82000b0
-
SHA1
c598a2683493a8c5161dba2901cf2e01de6bb56a
-
SHA256
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453
-
SHA512
7f93e1ba840d6521bbad22951c409c67db916b3362d75f5937b756434bddcf3dc910ac0354385fa3bc753710fa99a4822affa2fc1e087cdf1c9a948978574a23
-
SSDEEP
393216:0TPL5gUBKn5vtQxy6eOuhi2+k66/F8up3:0TPL5g5vtQxy6etimgup
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3108-12-0x0000000004350000-0x00000000043C2000-memory.dmp upx behavioral2/memory/3108-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3108-15-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Processes:
resource yara_rule behavioral2/memory/3108-0-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-11-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-56-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-57-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-58-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-59-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-61-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-62-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-63-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-64-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-66-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-67-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-69-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral2/memory/3108-70-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\IESettingSync 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exepid process 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exedescription pid process Token: SeDebugPrivilege 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exepid process 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3108 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe"C:\Users\Admin\AppData\Local\Temp\39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3108-0-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-1-0x00000000010AB000-0x00000000013C5000-memory.dmpFilesize
3.1MB
-
memory/3108-3-0x00000000027E0000-0x00000000027E1000-memory.dmpFilesize
4KB
-
memory/3108-2-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/3108-6-0x00000000040F0000-0x00000000040F1000-memory.dmpFilesize
4KB
-
memory/3108-5-0x00000000040E0000-0x00000000040E1000-memory.dmpFilesize
4KB
-
memory/3108-7-0x0000000004100000-0x0000000004101000-memory.dmpFilesize
4KB
-
memory/3108-4-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/3108-8-0x0000000004110000-0x0000000004111000-memory.dmpFilesize
4KB
-
memory/3108-11-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-12-0x0000000004350000-0x00000000043C2000-memory.dmpFilesize
456KB
-
memory/3108-21-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-51-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-56-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-55-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-53-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-49-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-47-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-43-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-42-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-37-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-35-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-33-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-32-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-29-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-27-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-26-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-57-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-23-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-45-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-39-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-19-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-17-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-14-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-13-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-58-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-15-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3108-59-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-61-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-62-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-63-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-64-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-66-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-67-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-69-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-70-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3108-71-0x00000000010AB000-0x00000000013C5000-memory.dmpFilesize
3.1MB