Analysis
-
max time kernel
143s -
max time network
150s -
resource
win10v191014
Task
task1
Sample
0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
Resource
win7v191014
0 signatures
Task
task2
Sample
0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
Resource
win10v191014
0 signatures
Task
task3
Sample
0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
Resource
win7v191014
0 signatures
Task
task4
Sample
0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
Resource
win10v191014
0 signatures
Task
task5
Sample
91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win7v191014
0 signatures
Task
task6
Sample
91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win10v191014
0 signatures
Task
task7
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7v191014
0 signatures
Task
task8
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v191014
0 signatures
Task
task9
Sample
fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win7v191014
0 signatures
Task
task10
Sample
fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win10v191014
0 signatures
General
-
Target
Supergevaarlijkk.zip
-
Sample
191029-p1j1431a9n
-
SHA256
6cd246cd910e33eaee00e3d138bc49fcf85562b5f8c394d4b092372d25cc0eac
Score
N/A
Malware Config
Signatures
-
Drops file in system dir 7 IoCs
description ioc pid Process File created C:\Program Files (x86)\SinTech\TextEdit.exe 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe File created C:\Program Files (x86)\SinTech\TextEdit.exe.config 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe File opened for modification C:\Windows\Debug\ESE.TXT 3428 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 3428 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 3428 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 3428 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 3428 svchost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4728 iexplore.exe -
description ioc pid Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\Blob = 5c000000010000000400000000080000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020b000000010000005c00000047006f006f0067006c00650020005400720075007300740020005300650072007600690063006500730020002d00200047006c006f00620061006c005300690067006e00200052006f006f0074002000430041002d005200320000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0620000000100000020000000ca42dd41745fd0b81eb902362cf9d8bf719da1bd1b1efc946f5b4c99f42c1b9e1400000001000000140000009be20757671c1ec06a06de59b49a2ddfdc19862e1d000000010000001000000073621e116224668780b2d2bee454e52e03000000010000001400000075e0abb6138512271c04f85fddde38e4b7242efe2000000001000000be030000308203ba308202a2a003020102020b0400000000010f8626e60d300d06092a864886f70d0101050500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3036313231353038303030305a170d3231313231353038303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a6cf240ebe2e6f28994542c4ab3e21549b0bd37f8470fa12b3cbbf875fc67f86d3b2305cd6fdadf17bdce5f86096099210f5d053defb7b7e7388ac52887b4aa6ca49a65ea8a78c5a11bc7a82ebbe8ce9b3ac962507974a992a072fb41e77bf8a0fb5027c1b96b8c5b93a2cbcd612b9eb597de2d006865f5e496ab5395e8834ecbc780c0898846ca8cd4bb4a07d0c794df0b82dcb21cad56c5b7de1a02984a1f9d39449cb24629120bcdd0bd5d9ccf9ea270a2b7391c69d1bacc8cbe8e0a0f42f908b4dfbb0361bf6197a85e06df26113885c9fe0930a51978a5aceafabd5f7aa09aa60bddcd95fdf72a960135e0001c94afa3fa4ea070321028e82ca03c29b8f0203010001a3819c308199300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604149be20757671c1ec06a06de59b49a2ddfdc19862e30360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742d72322e63726c301f0603551d230418301680149be20757671c1ec06a06de59b49a2ddfdc19862e300d06092a864886f70d01010505000382010100998153871c68978691ece04ab8440bab81ac274fd6c1b81c4378b30c9afcea2c3c6e611b4d4b29f59f051d26c1b8e983006245b6a90893b9a9334b189ac2f887884edbdd71341ac154da463fe0d32aab6d5422f53a62cd206fba2989d7dd91eed35ca23ea15b41f5dfe564432de9d539abd2a2dfb78bd0c080191c45c02d8ce8f82da4745649c505b54f15de6e44783987a87ebbf3791891bbf46f9dc1f08c358c5d01fbc36db9ef446d7946317e0afea982c1ffefab6e20c450c95f9d4d9b178c0ce501c9a0416a7353faa550b46e250ffb4c18f4fd52d98e69b1e8110fde88d8fb1d49f7aade95cf2078c26012db25408c6afc7e4238406412f79e81e1932e 4672 IEXPLORE.EXE -
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
description ioc pid Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 396 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 396 svchost.exe -
flawedammy family
-
Launches SC.exe 1 IoCs
pid Process 2928 sc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3712 wlanspeed.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 1860 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 1860 svchost.exe -
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no" 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2" 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown = "1" 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown_TIMESTAMP = 232ab69ccc22d401 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShown = "1" 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShownTime = f84268cb0c09d401 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOncePerInstallCompleted = "1" 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceCompletionTime = f84268cb0c09d401 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F72AC19-FA7B-11E9-BD7F-42BFF2011378} = "0" 4728 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 4728 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 4728 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1443503412" 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30772872" 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1443503412" 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30772872" 4728 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" 4728 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c36c9cdac63c12448d84f1a7215689fa00000000020000000000106600000001000020000000757b785e4c73d7fcca5dc8a3f0bcad08db0360c725477d725bd97bc7967c4009000000000e8000000002000020000000f38e41f21af9c50d8695808ac3b982331cd25b3e16c3d61d66ca458a1111e86f200000009998afebacf11dbc2fd7c14b4557c9eb2f1e35163860e68d0244e8c1d8c6349540000000fd35044da8503c8b54099698fae493734edaa759bc20010c003b9fb5fa49cdc89a41f357a79e29f40cba35b7f92950352e1733bb805f5f85844c843ee8c03bc4 4728 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90c5b759888ed501 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1518816252" 4672 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30772872" 4672 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1703659957" 4008 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30772872" 4008 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" 4728 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "279139380" 4728 iexplore.exe -
Creates new service 1 TTPs 1 IoCs
pid Process 1008 sc.exe -
Windows firewall usage 2 IoCs
pid Process 2904 netsh.exe 4080 netsh.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 2904 netsh.exe 4080 netsh.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3712 wlanspeed.exe 4728 iexplore.exe 4672 IEXPLORE.EXE 4008 IEXPLORE.EXE -
Loads dropped DLL 1 IoCs
pid Process 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SinTech client = "C:\\Program Files (x86)\\SinTech\\TextEdit.exe" 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5016 wrote to memory of 4104 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 74 PID 5016 wrote to memory of 4300 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 75 PID 4300 wrote to memory of 1008 4300 cmd.exe 77 PID 4300 wrote to memory of 2928 4300 cmd.exe 78 PID 4300 wrote to memory of 2904 4300 cmd.exe 79 PID 4300 wrote to memory of 4080 4300 cmd.exe 80 PID 5016 wrote to memory of 3712 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 81 PID 4728 wrote to memory of 4672 4728 iexplore.exe 83 PID 5016 wrote to memory of 4428 5016 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 84 PID 3856 wrote to memory of 4408 3856 SppExtComObj.exe 86 PID 4728 wrote to memory of 4008 4728 iexplore.exe 88 -
Executes dropped EXE 3 IoCs
pid Process 4104 TextEdit.exe 3712 wlanspeed.exe 4428 outst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe"C:\Users\Admin\AppData\Local\Temp\fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe"1⤵
- Drops file in system dir
- Modifies Internet Explorer settings
- Loads dropped DLL
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:5016
-
C:\Program Files (x86)\SinTech\TextEdit.exe"C:\Program Files (x86)\SinTech\TextEdit.exe"1⤵
- Executes dropped EXE
PID:4104
-
C:\Windows\SysWOW64\cmd.execmd /c sc create Wlanspeed binpath= "C:\ProgramData\Wlanspeed\wlanspeed.exe -service" start= auto displayname= "Wlanspeed" & sc description Wlanspeed "Wlanspeed service" && netsh advfirewall firewall add rule name="Wlanspeed" dir=in action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe" && netsh advfirewall firewall add rule name="Wlanspeed" dir=out action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4300
-
C:\Windows\SysWOW64\sc.exesc create Wlanspeed binpath= "C:\ProgramData\Wlanspeed\wlanspeed.exe -service" start= auto displayname= "Wlanspeed"1⤵
- Creates new service
PID:1008
-
C:\Windows\SysWOW64\sc.exesc description Wlanspeed "Wlanspeed service"1⤵
- Launches SC.exe
PID:2928
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Wlanspeed" dir=in action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"1⤵
- Windows firewall usage
- Modifies Windows Firewall
PID:2904
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Wlanspeed" dir=out action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"1⤵
- Windows firewall usage
- Modifies Windows Firewall
PID:4080
-
C:\ProgramData\Wlanspeed\wlanspeed.exe"C:\ProgramData\Wlanspeed\wlanspeed.exe" -getid -nogui1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:3712
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4728 CREDAT:82945 /prefetch:21⤵
- Modifies system certificate store
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4672
-
C:\ProgramData\Wlanspeed\outst.exe"C:\ProgramData\Wlanspeed\outst.exe" -outid1⤵
- Executes dropped EXE
PID:4428
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:3856
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:4408
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4728 CREDAT:82948 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4008
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in system dir
PID:3428
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:3720
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:396
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:1860
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:1952
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1130
- T1089
- T1050
- T1031
- T1060