Overview

overview

9

task1

 

9

task2

 

9

Analysis

  • max time kernel
    126s
  • max time network
    128s
  • resource
    win7v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e49c6973ddcc601cfb85b451e122903b1a9c036c8baafc35cb327f76b998c537

  • Sample

    191028-1w9b61jzc2

  • SHA256

    e49c6973ddcc601cfb85b451e122903b1a9c036c8baafc35cb327f76b998c537

Score
N/A

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 13 IoCs
    adwarespyware
  • Deletes itself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Deletes shadow copies 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in system dir 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Drops Office document 20 IoCs
    dropperexploitermaldoc
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Modifies control panel 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e49c6973ddcc601cfb85b451e122903b1a9c036c8baafc35cb327f76b998c537.exe
    "C:\Users\Admin\AppData\Local\Temp\e49c6973ddcc601cfb85b451e122903b1a9c036c8baafc35cb327f76b998c537.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • Sets desktop wallpaper using registry
    • Drops Office document
    • Modifies control panel
    PID:1184
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:452
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {49E536CB-B20A-4E9D-842B-749ECCB93F6F} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1124
  • C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
    1⤵
    • Deletes shadow copies
    PID:1232
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-6645852501490751141442250007-11559683051625916568-133025947013938712551168422448"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:596
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k swprv
    1⤵
      PID:276
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\asasin.htm
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1164
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Drops file in system dir
      • Suspicious use of FindShellTrayWindow
      PID:232
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\e49c6973ddcc601cfb85b451e122903b1a9c036c8baafc35cb327f76b998c537.exe"
      1⤵
      • Deletes itself
      PID:1792
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "2063053404-2854132222099762677-45583753-1949206537-75580183817319469623359341"
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2044
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:2
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1808

    Network

    MITRE ATT&CK Enterprise v15

    MITRE ATT&CK Additional techniques

    • T1107

    Replay Monitor

    Loading Replay Monitor...

    Downloads