Analysis
-
max time kernel
135s -
max time network
148s -
resource
win10v191014
Task
task1
Sample
a038cf5f99d17df1e223aaf2f5f80b4b4a440a4e.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
a038cf5f99d17df1e223aaf2f5f80b4b4a440a4e.exe
Resource
win10v191014
0 signatures
General
-
Target
a038cf5f99d17df1e223aaf2f5f80b4b4a440a4e
-
Sample
191018-7wl797zm62
-
SHA256
ba6af8e68fc67d929a1567eef3a86c1ba481f4f55ee203a17b4e0ee81ec58f41
Score
N/A
Malware Config
Extracted
Family
ursnif
Botnet
1000
C2
http://weekends-estate.xyz
Attributes
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
1.320669898e+09
-
dga_season
10
-
dga_tlds
com
ru
org
-
dns_servers
107.174.86.134
107.175.127.22
rsa_pubkey.base64
1
AAgAANbmcBjNV5tiTgWcPhRrJgQb0kYFfNBWiuaU1J/dJsUiz22VcOLdUDhcUyPN2+UzuwTaogL0vmF9dmRYMI9x6oN/BuzJHLUNqZ/gNh+m2JOChNoIfEGh3N/ijmoEyzeSWf6w7TUqNKZbAAO3TqtXbZ2uKNxL/EHMkS2Ga4fTWv0DlleQejqdZMAKWVnDf8c51Goj2tatdUCuKVfECoOg1QzfXu6NBqT0l3aQ+85KMqaoaIZSf+Sqfy5k0geIgEn7DLO+iGf9gh6xPLQkXX0Z9uMT9GUnz559bt/meLxxF2YsLvQlRl/v8Avr+Kb6BIoetITREEBoDXFbwyhJNrPa2qEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAB
serpent.plain
1
YQiUrgpfMGxlbXo6
Signatures
-
Drops file in system dir 5 IoCs
description ioc pid Process File opened for modification C:\Windows\Debug\ESE.TXT 4044 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 4044 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 4044 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 4044 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 4044 svchost.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 4580 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 4580 svchost.exe -
ursnif family
-
description ioc pid Process Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79EA3D4F-F1DD-11E9-BD7F-DA387AC80F0B} = "0" 5092 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 5092 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1330121685" 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30770666" 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1330121685" 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30770666" 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" 5092 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa00000000020000000000106600000001000020000000e36e6c2d4012041d10c15af1357059cf7bc54b773f72d97fb4bf5f0472da5f16000000000e80000000020000200000006d1524fcbecb08cfa2bda454a10b53037d471ffd243503bfe53eec7e95b70aa2200000009ad7b3dad627be34152acd715fcc6617e5bf28cea15ea6ba9d84353759b74abe40000000fcda36126f8d8695d9cfb06f321854a3f8f354043cab4808bd3ef6c77be86490ec1cb5cc8708e71a38b590f38ca0e3deb26153163251a0eca5426daee9a279ca 5092 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303a5c5bea85d501 5092 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa00000000020000000000106600000001000020000000c9ae37e4caaf9debeffb342297ac92b254541156aa06ea4414fd9a8abdede687000000000e8000000002000020000000395eb79b0bb598927774b0e2f760ed611b24716d8ef9353be77c41426a2cf3aa200000009ac45adb3bb4b1d837eac06f70e92608cdc5a21a713685b47478652f610f72394000000063ed15f66ee04259594ee124b90d8df85136362c2f5b62ac208d32d41a8191351e81f4d8cb0af12dfe9788890917eadf8df70cc7f5c3ab3afdc8dc4eb5a4af2a 5092 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a47d5bea85d501 5092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 4644 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F30D3E1-F1DD-11E9-BD7F-DA387AC80F0B} = "0" 4644 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 4644 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 4644 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 4644 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa000000000200000000001066000000010000200000004cc7bd57fa4653322412101470fbfdef030f22886fb1231ff3cd653053415d25000000000e8000000002000020000000faa1db6a7f85ed3ad89894d180e0c4ad748500a4ed042e67876dca368887251420000000b6e141b0dac58277b82c047c705f99df4d331aafda28e92b1ae3894d2357d9f24000000094a51c1932ef83230f9a469186b4a18b280546a6deacf16c30fa3460dbc3c3c10bf0f236e31546b7472012fb0ee07a50f303fd6050d005108e21f1a7d23ab841 4644 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e041a262ea85d501 4644 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 4644 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 540 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC9ED2C2-F1DD-11E9-BD7F-DA387AC80F0B} = "0" 540 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 540 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 540 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 540 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa00000000020000000000106600000001000020000000241e465519c65e7bf0a34de7f938e15e5c11bb6b4c877d3176b72d853e1c9b9f000000000e80000000020000200000005d8f826923730a1163d4958bcbe458713bb780ed64dd90f83ac07ced2b9b56a720000000710c6e5f364a51e5b09b09784c9c87097ef68acd273819b4adca3ca84d8988f34000000084da1a820279009d54ead24330aaac715b6de2d3d7ed68f016e4773d77677032d6afd2541095eb5f0d2718dad5c43b97020321303be1e91e49e44c2c8dafac2f 540 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10327970ea85d501 540 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 540 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 1292 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA5B7F80-F1DD-11E9-BD7F-DA387AC80F0B} = "0" 1292 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 1292 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 1292 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 1292 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa00000000020000000000106600000001000020000000f8ac0b8205a3fc249f82a8f0c916da698cb8a2d9dbb69459c2ad296d38acfc8a000000000e800000000200002000000064b1bcf9c5570e6423efa9ee80b461f11e46d321078af076b214f74d8eb01d58200000007043ed962cf8782277c0cdc3ebe34d343d4ca4d85b425564643b83d2d00ade2240000000dcdbbaefe1822fd64911b74d9ba39ca7223ec530f0de7a9d3a066241713c206012f91490eaf0bf65845b7d602c0f3f488a6570fc0f41cba37d265dafd0082713 1292 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e9167eea85d501 1292 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 1292 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5092 wrote to memory of 2568 5092 iexplore.exe 73 PID 4644 wrote to memory of 4740 4644 iexplore.exe 77 PID 540 wrote to memory of 708 540 iexplore.exe 86 PID 1292 wrote to memory of 1528 1292 iexplore.exe 88 -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5092 iexplore.exe 2568 IEXPLORE.EXE 4644 iexplore.exe 4740 IEXPLORE.EXE 540 iexplore.exe 708 IEXPLORE.EXE 1292 iexplore.exe 1528 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 5092 iexplore.exe 4644 iexplore.exe 540 iexplore.exe 1292 iexplore.exe -
Modifies service 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance\PerfMMFileName = "Global\\MMF_BITS6818ef39-6ee8-46b7-ba2d-3815d554287b" 4044 svchost.exe -
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
description ioc pid Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 4228 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 4228 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a038cf5f99d17df1e223aaf2f5f80b4b4a440a4e.exe"C:\Users\Admin\AppData\Local\Temp\a038cf5f99d17df1e223aaf2f5f80b4b4a440a4e.exe"1⤵PID:4928
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:5092
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5092 CREDAT:82945 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:2568
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in system dir
- Modifies service
PID:4044
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:1772
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:4644
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4644 CREDAT:82945 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:4740
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:4228
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:4600
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:4580
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:540
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:540 CREDAT:82945 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:708
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:1292
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:82945 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:1528
Network
-
3.4kB 70.0kB 46 17
-
4.2kB 9.8kB 17 11
-
4.7kB 87.8kB 59 25
-
2.0kB 26.0kB 26 9
-
-
3.4kB 71.1kB 46 16
-
3.4kB 71.1kB 46 16
-
2.2kB 7.0kB 11 6
-
85 B 147 B 1 1
DNS Request
nexus.officeapps.live.com
DNS Response
52.109.88.39
-
79 B 144 B 1 1
DNS Request
weekends-estate.xyz
-
76 B 171 B 1 1
DNS Request
go.microsoft.com
DNS Response
23.66.21.99
-
79 B 144 B 1 1
DNS Request
weekends-estate.xyz
-
120 B 1
-
79 B 79 B 1 1
DNS Request
weekends-estate.xyz
-
82 B 164 B 1 1
DNS Request
iecvlist.microsoft.com
DNS Response
72.21.81.200
-
76 B 283 B 1 1
DNS Request
fs.microsoft.com
DNS Response
104.81.140.70
-
440 B 4
-
90 B 155 B 1 1
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.109.76.31
-
76 B 171 B 1 1
DNS Request
go.microsoft.com
DNS Response
23.66.21.99
-
76 B 171 B 1 1
DNS Request
go.microsoft.com
DNS Response
23.66.21.99
-
79 B 144 B 1 1
DNS Request
weekends-estate.xyz
-
76 B 171 B 1 1
DNS Request
go.microsoft.com
DNS Response
23.66.21.99
-
79 B 144 B 1 1
DNS Request
weekends-estate.xyz
-
1.4kB 8
-
79 B 144 B 1 1
DNS Request
weekends-estate.xyz
-
79 B 144 B 1 1
DNS Request
weekends-estate.xyz
-
-
79 B 144 B 1 1
DNS Request
weekends-estate.xyz
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1089
- T1031