Task
task1
Task
task2
Task
task3
Task
task4
Task
task5
Task
task6
Task
task7
Task
task8
Task
task9
Task
task10
General
-
Target
test.zip
-
Sample
190809-b9e7y9szpa
-
SHA256
72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5
Score
N/A
Malware Config
Signatures
-
Loads dropped DLL 1 TTPs
-
Drops file in system dir 2 IoCs
description C:\Program Files (x86)\SinTech\TextEdit.exe C:\Program Files (x86)\SinTech\TextEdit.exe.config -
Adds Run entry to start application 2 TTPs 1 IoCs
description \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run (CreateKeyEx) -
Modifies Internet Explorer settings 1 TTPs 12 IoCs
description \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\main (CreateKeyEx) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no" \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Recovery (CreateKeyEx) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2" \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main (CreateKeyEx) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown = "1" \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown_TIMESTAMP = 232ab69ccc22d401 \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShown = "1" \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShownTime = f84268cb0c09d401 \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOncePerInstallCompleted = "1" \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceCompletionTime = f84268cb0c09d401 -
Suspicious use of WriteProcessMemory 1 TTPs 3 IoCs
description pid Process PID 968 wrote to memory of 2508 2508 Process not Found PID 968 wrote to memory of 2620 2620 Process not Found PID 968 wrote to memory of 3904 3904 Process not Found -
Executes dropped EXE 1 TTPs
-
Creates new service 1 TTPs
-
Suspicious use of WriteProcessMemory 1 TTPs 4 IoCs
description pid Process PID 2620 wrote to memory of 3624 3624 Process not Found PID 2620 wrote to memory of 3648 3648 Process not Found PID 2620 wrote to memory of 3704 3704 Process not Found PID 2620 wrote to memory of 3932 3932 Process not Found -
Launches SC.exe
-
Modifies Windows Firewall 1 TTPs
-
Modifies Windows Firewall 1 TTPs
-
Executes dropped EXE 1 TTPs
-
Suspicious use of SetWindowsHookEx 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs
-
Suspicious registry modification 3 IoCs
description \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" -
Modifies Internet Explorer settings 1 TTPs 24 IoCs
description \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Main (CreateKeyEx) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Main\Isolation (DeleteValueKey) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing (CreateKeyEx) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\BrowserEmulation (CreateKeyEx) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\VersionManager (CreateKeyEx) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3092779893" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "30756635" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy (CreateKeyEx) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive (CreateKeyEx) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Recovery (CreateKeyEx) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B116C23-BAB5-11E9-8757-6E552F59B539} = "0" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch (CreateKeyEx) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery (CreateKeyEx) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00000000-0000-0000-0000-000000000000} (DeleteValueKey) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1" -
Malicious domain 2 IoCs
description rl.ammyy.com www.kitai.jp -
Suspicious use of WriteProcessMemory 1 TTPs 1 IoCs
description pid Process PID 4048 wrote to memory of 3128 3128 Process not Found -
Suspicious use of SetWindowsHookEx 1 TTPs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
description \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Main (CreateKeyEx) \REGISTRY\USER\S-1-5-21-4159699222-2363879890-816855548-1000\Software\Microsoft\Internet Explorer\Toolbar (CreateKeyEx) -
Suspicious use of SetWindowsHookEx 1 TTPs
-
Suspicious use of FindShellTrayWindow 1 TTPs
-
Uses Task Scheduler COM API 1 TTPs
-
flawedammy family