890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645

Analysis

max time kernel
1174s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mercurial.exe
Size

3.2MB
MD5

a9477b3e21018b96fc5d2264d4016e65
SHA1

493fa8da8bf89ea773aeb282215f78219a5401b7
SHA256

890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
SHA512

66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c
SSDEEP

98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 11 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/5060-6-0x0000000005C50000-0x0000000005C6C000-memory.dmp	agile_net
behavioral2/memory/5060-7-0x0000000005EC0000-0x0000000005EE0000-memory.dmp	agile_net
behavioral2/memory/5060-8-0x0000000005EE0000-0x0000000005F00000-memory.dmp	agile_net
behavioral2/memory/5060-10-0x0000000005F10000-0x0000000005F24000-memory.dmp	agile_net
behavioral2/memory/5060-9-0x0000000005F00000-0x0000000005F10000-memory.dmp	agile_net
behavioral2/memory/5060-11-0x0000000005F20000-0x0000000005F8E000-memory.dmp	agile_net
behavioral2/memory/5060-15-0x0000000006040000-0x000000000604E000-memory.dmp	agile_net
behavioral2/memory/5060-14-0x0000000006020000-0x000000000602E000-memory.dmp	agile_net
behavioral2/memory/5060-13-0x0000000005FE0000-0x0000000006016000-memory.dmp	agile_net
behavioral2/memory/5060-12-0x0000000005FA0000-0x0000000005FBE000-memory.dmp	agile_net
behavioral2/memory/5060-16-0x00000000069B0000-0x0000000006AFA000-memory.dmp	agile_net

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2096 5060 WerFault.exe Mercurial.exe
3560 5060 WerFault.exe Mercurial.exe

pid	pid_target	process	target process
2096	5060	WerFault.exe	Mercurial.exe
3560	5060	WerFault.exe	Mercurial.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426178159"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9053c8e253cdda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007bd2b5d2c6d91e4f8f2c8e8b7d41a41500000000020000000000106600000001000020000000c70a07bf3f86b1da24c4fc54947878451a912bbe9aa3fc6f11518018568c831c000000000e8000000002000020000000824f9adffc3740f7232a3a467940e7ebe68067558db60e473835f883221393e02000000011b37256365cc0d953985ed7a705848abdcba7670caaadc4a735f045050e372940000000f293389cb38c28d0490a1f43b7c6982e208b1e87572e50634c69026d8cde8c89136a6b0164e448ed526c54f357911551016dba97ec474f6e7bf7b6afca86e69f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007bd2b5d2c6d91e4f8f2c8e8b7d41a41500000000020000000000106600000001000020000000d398a6ac4bfde69d6559e529fd807ed5c569d96ab2805c5dea75281a4b50974e000000000e80000000020000200000004e3f254d6d24e200d3fa440b35256c9c00a193779adeab113fbf049871dc929220000000f567aae3ed7c07e0bdf4c5220f00c797f969283d9f3981291cbd3af1fa5787f74000000096ee3bb39852dce2f1adc8c0a0a38683ff540d5cf3f05dbcd54edfd2b41417fa3817975061eae7b930246a80d5074ab9f6f8bb62b92a6f36bdcf16e471a5dbe5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 800ecde253cdda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0DE532AE-3947-11EF-BCA5-F2AC8AF4D319} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Mercurial.exe

pid process

5060 Mercurial.exe
5060 Mercurial.exe
5060 Mercurial.exe
5060 Mercurial.exe
5060 Mercurial.exe
5060 Mercurial.exe
5060 Mercurial.exe
5060 Mercurial.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Mercurial.exe

description pid process

Token: SeDebugPrivilege 5060 Mercurial.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4944 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

4944 iexplore.exe
4944 iexplore.exe
1848 IEXPLORE.EXE
1848 IEXPLORE.EXE
1848 IEXPLORE.EXE
1848 IEXPLORE.EXE

pid	process
5060	Mercurial.exe
5060	Mercurial.exe
5060	Mercurial.exe
5060	Mercurial.exe
5060	Mercurial.exe
5060	Mercurial.exe
5060	Mercurial.exe
5060	Mercurial.exe

description	pid	process
Token: SeDebugPrivilege	5060	Mercurial.exe

pid	process
4944	iexplore.exe

pid	process
4944	iexplore.exe
4944	iexplore.exe
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 4944 wrote to memory of 1848	4944	iexplore.exe	IEXPLORE.EXE
PID 4944 wrote to memory of 1848	4944	iexplore.exe	IEXPLORE.EXE
PID 4944 wrote to memory of 1848	4944	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1504
2⤵
- Program crash
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1544
2⤵
- Program crash
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5060 -ip 5060
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5060 -ip 5060
1⤵
PID:836

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\UnblockOptimize.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
PID:2596

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\JoinTest.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4944 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1848

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5060-0-0x00000000753BE000-0x00000000753BF000-memory.dmp

Filesize
4KB

Download
memory/5060-1-0x0000000000F00000-0x000000000123A000-memory.dmp

Filesize
3.2MB

Download
memory/5060-2-0x0000000006250000-0x00000000067F4000-memory.dmp

Filesize
5.6MB

Download
memory/5060-3-0x0000000005CA0000-0x0000000005D32000-memory.dmp

Filesize
584KB

Download
memory/5060-5-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/5060-4-0x0000000005C40000-0x0000000005C4A000-memory.dmp

Filesize
40KB

Download
memory/5060-6-0x0000000005C50000-0x0000000005C6C000-memory.dmp

Filesize
112KB

Download
memory/5060-7-0x0000000005EC0000-0x0000000005EE0000-memory.dmp

Filesize
128KB

Download
memory/5060-8-0x0000000005EE0000-0x0000000005F00000-memory.dmp

Filesize
128KB

Download
memory/5060-10-0x0000000005F10000-0x0000000005F24000-memory.dmp

Filesize
80KB

Download
memory/5060-9-0x0000000005F00000-0x0000000005F10000-memory.dmp

Filesize
64KB

Download
memory/5060-11-0x0000000005F20000-0x0000000005F8E000-memory.dmp

Filesize
440KB

Download
memory/5060-15-0x0000000006040000-0x000000000604E000-memory.dmp

Filesize
56KB

Download
memory/5060-14-0x0000000006020000-0x000000000602E000-memory.dmp

Filesize
56KB

Download
memory/5060-13-0x0000000005FE0000-0x0000000006016000-memory.dmp

Filesize
216KB

Download
memory/5060-12-0x0000000005FA0000-0x0000000005FBE000-memory.dmp

Filesize
120KB

Download
memory/5060-16-0x00000000069B0000-0x0000000006AFA000-memory.dmp

Filesize
1.3MB

Download
memory/5060-17-0x0000000006B60000-0x0000000006C76000-memory.dmp

Filesize
1.1MB

Download
memory/5060-18-0x00000000061C0000-0x00000000061F0000-memory.dmp

Filesize
192KB

Download
memory/5060-19-0x0000000009660000-0x0000000009668000-memory.dmp

Filesize
32KB

Download
memory/5060-20-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/5060-21-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/5060-22-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads