Analysis
-
max time kernel
145s -
max time network
152s -
resource
win10v191014
Task
task1
Sample
9193eaeff8fff6c8b09dc370b9e60ddab5b121a3.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
9193eaeff8fff6c8b09dc370b9e60ddab5b121a3.exe
Resource
win10v191014
0 signatures
General
-
Target
9193eaeff8fff6c8b09dc370b9e60ddab5b121a3
-
Sample
191018-z54frb66pa
-
SHA256
5c2f4f2893dadc75178da674dddc8c5375fa4242c76c0d99ff5f973c2822b7e6
Score
N/A
Malware Config
Extracted
Family
ursnif
Botnet
1000
C2
http://weekends-estate.xyz
Attributes
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
1.320669898e+09
-
dga_season
10
-
dga_tlds
com
ru
org
-
dns_servers
107.174.86.134
107.175.127.22
rsa_pubkey.base64
serpent.plain
Signatures
-
description ioc pid Process Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78A7EA9B-F1DD-11E9-BD7F-FE51693A2DE0} = "0" 5116 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 5116 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1311325457" 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30770666" 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1311325457" 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30770666" 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" 5116 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa00000000020000000000106600000001000020000000dc2867c1a8dd3bd58ed2eb5618d919bf1d5a0c37846a9a1dc616245c5d48c365000000000e80000000020000200000001a1b9620da8b35d41e669a851de400adeed554da9c87c1ec8f444692868b46482000000063dcba9d814dd2f6002cdc5b9d48d701ae9fb9f458893eaaa5e04cd6c9b0ed1940000000efd006fc8cf78061eef8d6409f9c846aadb08d75f99fd5ea109a800029f9dd01a3b9f64243bab20a25369350f63981d16ac85bc0f203e552771f5472afbdf1cf 5116 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a8195aea85d501 5116 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa000000000200000000001066000000010000200000009e99d01fa9500b5e305ea8fc02d40ba6ca9bceefa0a6366ce0a43375f3ca0b7d000000000e80000000020000200000007b8a302cd8a4b5006d61d62b1c311973ee982eaef54a267e562a7c7d2f8971572000000064e5d6248f5a4f18cf6e71043a2fb76455567ff7a3ecb2b8adedae93eb5f8b314000000046a8491b429ac70a1443ef982f263520c8fdea18b7985d6bc6831f3b2c88fdc6c00510267f0232e3073549d6163314bbcc9dcd17632ccd5c283d12c02a79d76a 5116 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0833d5aea85d501 5116 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 2472 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9DEE41D0-F1DD-11E9-BD7F-FE51693A2DE0} = "0" 2472 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 2472 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 2472 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 2472 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa000000000200000000001066000000010000200000006d57c21302e89941703401b9ee013723e6e2d3fc874872244119101968b4f3dc000000000e8000000002000020000000e7626e95ba26dd84506f0b3bf9236c2decedd4321c0f15904cca8db0afcfc66920000000a9fe758819a453af621fb74e0c45e97897325a90f2bef5f9f7f0ff91e103e6b54000000088b203abad07b25505a1a1deb32c335c381b73ded6c9db5caf35cbf68268346fcbad69804187d21551ca72476b563db6e2dc0f4600f46a2182b518013fd01b23 2472 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1040a761ea85d501 2472 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 2472 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 3392 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB898E29-F1DD-11E9-BD7F-FE51693A2DE0} = "0" 3392 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 3392 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 3392 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 3392 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa000000000200000000001066000000010000200000004e8a90808fb51e1d7391a11734f673361fdb2f1eaf236b3dd20aa36e6ba5a99b000000000e80000000020000200000001773b5d52cb8198a5c918a974b25387b73e59f6cbbdff5a6048f0eb28ff9f21f200000005ab0650d41078af7bd05da6e9c53c15e8a33c2887fc32bf93ecfeb99351c096e40000000da9e3be9609928120f6b00f2f488ba158fad7ec12e9210b057f64c626787804dd8e29f56421378ad7493812fb6abf117bb1728d65257ef6a50ab9bc2a0d9d8de 3392 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03c406fea85d501 3392 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 3392 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 952 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B93F130A-F1DD-11E9-BD7F-FE51693A2DE0} = "0" 952 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 952 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 952 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 952 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa00000000020000000000106600000001000020000000aae4fb7d457975d81590faadaa5adb49dcfd36fae7176044c984fa674bea43bc000000000e8000000002000020000000750705b7680508af359ba8a45992589eda7ee8ed7791cd6e694d26cb6563b79820000000fb7cdac40459b377b8bcc4980182149a7fbd879e65767b0ef0c2b5458eac031b400000003bc64ee2503de9b1525f90259dee52b3152b0c818c1ccc3badb98d7b6222a9f7674c2b23db92cec9ec83a657946bd365a23f24fe72ff1b5564409e451bee2985 952 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2077a97cea85d501 952 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 952 iexplore.exe -
Modifies service 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance\PerfMMFileName = "Global\\MMF_BITS8bc558f7-da04-4aec-aba1-f6e8c5299860" 4492 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 5116 iexplore.exe 2472 iexplore.exe 3392 iexplore.exe 952 iexplore.exe -
Drops file in system dir 5 IoCs
description ioc pid Process File opened for modification C:\Windows\Debug\ESE.TXT 4492 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 4492 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 4492 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 4492 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 4492 svchost.exe -
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
description ioc pid Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 4216 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 4216 svchost.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 3732 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 3732 svchost.exe -
ursnif family
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5116 wrote to memory of 1696 5116 iexplore.exe 73 PID 2472 wrote to memory of 4540 2472 iexplore.exe 83 PID 3392 wrote to memory of 424 3392 iexplore.exe 85 PID 952 wrote to memory of 1324 952 iexplore.exe 87 -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5116 iexplore.exe 1696 IEXPLORE.EXE 2472 iexplore.exe 4540 IEXPLORE.EXE 3392 iexplore.exe 424 IEXPLORE.EXE 952 iexplore.exe 1324 IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\9193eaeff8fff6c8b09dc370b9e60ddab5b121a3.exe"C:\Users\Admin\AppData\Local\Temp\9193eaeff8fff6c8b09dc370b9e60ddab5b121a3.exe"1⤵PID:4904
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:5116
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5116 CREDAT:82945 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:1696
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Modifies service
- Drops file in system dir
PID:4492
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:1604
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:4216
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:4108
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:3732
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:2472
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:82945 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:4540
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:3392
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3392 CREDAT:82945 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:424
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:952
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:82945 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:1324
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1031
- T1089