Task
task1
Task
task2
Task
task3
Task
task4
Task
task5
Task
task6
Task
task7
Task
task8
Task
task9
Task
task10
General
-
Target
test.zip
-
Sample
190821-b2h8n5wv9n
-
SHA256
72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5
Score
N/A
Malware Config
Signatures
-
Loads dropped DLL 1 TTPs
-
Drops file in system dir 2 IoCs
description C:\Program Files (x86)\SinTech\TextEdit.exe C:\Program Files (x86)\SinTech\TextEdit.exe.config -
Adds Run entry to start application 2 TTPs 1 IoCs
description \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run (CreateKeyEx) -
Modifies Internet Explorer settings 1 TTPs 12 IoCs
description \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\main (CreateKeyEx) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no" \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Recovery (CreateKeyEx) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2" \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main (CreateKeyEx) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown = "1" \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown_TIMESTAMP = 232ab69ccc22d401 \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShown = "1" \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShownTime = f84268cb0c09d401 \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOncePerInstallCompleted = "1" \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceCompletionTime = f84268cb0c09d401 -
Suspicious use of WriteProcessMemory 1 TTPs 3 IoCs
description pid Process PID 3492 wrote to memory of 4056 4056 Process not Found PID 3492 wrote to memory of 3952 3952 Process not Found PID 3492 wrote to memory of 1788 1788 Process not Found -
Executes dropped EXE 1 TTPs
-
Creates new service 1 TTPs
-
Suspicious use of WriteProcessMemory 1 TTPs 4 IoCs
description pid Process PID 3952 wrote to memory of 4092 4092 Process not Found PID 3952 wrote to memory of 2352 2352 Process not Found PID 3952 wrote to memory of 2288 2288 Process not Found PID 3952 wrote to memory of 2488 2488 Process not Found -
Launches SC.exe
-
Modifies Windows Firewall 1 TTPs
-
Modifies Windows Firewall 1 TTPs
-
Executes dropped EXE 1 TTPs
-
Modifies Internet Explorer settings 1 TTPs 24 IoCs
description \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Main (CreateKeyEx) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Main\Isolation (DeleteValueKey) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing (CreateKeyEx) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation (CreateKeyEx) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\VersionManager (CreateKeyEx) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2628359541" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "30758960" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy (CreateKeyEx) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive (CreateKeyEx) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Recovery (CreateKeyEx) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F57554F-C41C-11E9-8039-D69CD698D417} = "0" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch (CreateKeyEx) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery (CreateKeyEx) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00000000-0000-0000-0000-000000000000} (DeleteValueKey) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1" -
Suspicious use of SetWindowsHookEx 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs
-
Malicious domain 2 IoCs
description rl.ammyy.com www.kitai.jp -
Suspicious registry modification 3 IoCs
description \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" -
Suspicious use of WriteProcessMemory 1 TTPs 1 IoCs
description pid Process PID 4016 wrote to memory of 3344 3344 Process not Found -
Suspicious use of SetWindowsHookEx 1 TTPs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
description \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Main (CreateKeyEx) \REGISTRY\USER\S-1-5-21-2995773282-378168649-2823822635-1000\Software\Microsoft\Internet Explorer\Toolbar (CreateKeyEx) -
Suspicious use of SetWindowsHookEx 1 TTPs
-
Suspicious use of FindShellTrayWindow 1 TTPs
-
Uses Task Scheduler COM API 1 TTPs
-
flawedammy family