Resubmissions
02-12-2019 09:09
191202-3peefk1fgj 1025-11-2019 09:33
191125-mlb76vzzln 013-11-2019 08:52
191113-bdf8dc3pq6 013-11-2019 07:11
191113-f1dft78f6s 013-11-2019 07:10
191113-591nb65hbx 030-10-2019 14:27
191030-9pe7klare6 0Analysis
-
max time kernel
146s -
max time network
144s -
resource
win7v191014
Task
task1
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v191014
0 signatures
Task
task3
Sample
fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win7v191014
0 signatures
Task
task4
Sample
fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win10v191014
0 signatures
General
-
Target
test.zip
-
Sample
191030-9pe7klare6
-
SHA256
72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5
Score
N/A
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1136 wrote to memory of 844 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 27 PID 1136 wrote to memory of 1288 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 28 PID 1288 wrote to memory of 1332 1288 cmd.exe 30 PID 1288 wrote to memory of 1740 1288 cmd.exe 31 PID 1288 wrote to memory of 1472 1288 cmd.exe 32 PID 1288 wrote to memory of 1036 1288 cmd.exe 33 PID 1136 wrote to memory of 1976 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 34 PID 1740 wrote to memory of 1472 1740 iexplore.exe 37 PID 1740 wrote to memory of 2176 1740 iexplore.exe 39 PID 1136 wrote to memory of 2224 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 40 PID 2412 wrote to memory of 2468 2412 iexplore.exe 42 PID 2412 wrote to memory of 2616 2412 iexplore.exe 44 -
Creates new service 1 TTPs 1 IoCs
pid Process 1332 sc.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 1472 netsh.exe 1036 netsh.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1976 wlanspeed.exe -
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Check_Associations = "no" 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\NoProtectedModeBanner = "1" 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\IE8RunOnceLastShown = "1" 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\IE8RunOnceLastShown_TIMESTAMP = 8afe20f63237d401 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\IE8TourShown = "1" 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\IE8TourShownTime = 0c8ab1fc3237d401 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2" 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe Set value (int) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 1740 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C51530D1-FB29-11E9-9DE7-FA4FF8E008F1} = "0" 1740 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 1740 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 1740 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 1740 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 1740 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 1740 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" 2412 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D246EFF1-FB29-11E9-9DE7-FA4FF8E008F1} = "0" 2412 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 2412 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" 2412 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" 2412 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 2412 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" 2412 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" 2412 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009aa4f4faf1a8e341b8de4356d522d0ee00000000020000000000106600000001000020000000b91e73f0206e4848b55f040606ab16faec259626b179ee2b639893b2b31a5f54000000000e8000000002000020000000fb10fb4cd67687afa3b7144c09de921f4a4417394dbfd94c4b63e32e60c17f282000000074192f10a7717d435d6ff37c667d4b67e70a54fa8beab42b260010d6028cbe6c40000000018becee85a6ad0081cf5f288b4fb0397d93a5468ee8299f57957e4ea581aa04a055caaa59591951498fd650c6f8ded586a3da2c7bc6a5170ee1ee25dddf5a09 2412 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30300099368fd501 2412 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009aa4f4faf1a8e341b8de4356d522d0ee0000000002000000000010660000000100002000000021432fb2bc6ae69f0bf52ab40ef4ecac8736a1d1dcf4e4cbeb704848abded70f000000000e80000000020000200000009c4e4519a08e277ea52289767f4557a68b3e3a5581e0d0bd05b504cfdf2b9c2c900000004f98e675d5bf1eed3d4192b981ae4f46a59fb1f011f2bc47cdbb6272bfc3b4226ed379b1b33673e35e21181c9a52c1826667726a327ecbcf32e1bb35e8282d0447be3dcacb20482464986aec7b2d03498c456c9ea7b401b2f268f198876ac0870c2bf4b577a5ec7e0414bc08d5455bccbe9fe493bf2f5422c70c0dc7e1fbe3f842c14bf590b99fb4bbb33330c13551de4000000029908dbf4baeac68e933b854d827c534db2810a66ad2fd2ee7f85b0128bee93183be7fb5039d5557a842432277425460dce88b9f08eb02cbf2e240a6cdae9b93 2412 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" 2412 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "279214240" 2412 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1264 conhost.exe 1976 wlanspeed.exe 1740 iexplore.exe 1472 IEXPLORE.EXE 2176 IEXPLORE.EXE 2412 iexplore.exe 2468 IEXPLORE.EXE 2616 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1740 iexplore.exe 2412 iexplore.exe -
Loads dropped DLL 1 IoCs
pid Process 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe -
Launches SC.exe 1 IoCs
pid Process 1740 sc.exe -
Windows firewall usage 2 IoCs
pid Process 1472 netsh.exe 1036 netsh.exe -
flawedammy family
-
Drops file in system dir 2 IoCs
description ioc pid Process File created C:\Program Files (x86)\SinTech\TextEdit.exe 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe File created C:\Program Files (x86)\SinTech\TextEdit.exe.config 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SinTech client = "C:\\Program Files (x86)\\SinTech\\TextEdit.exe" 1136 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe -
Executes dropped EXE 3 IoCs
pid Process 844 TextEdit.exe 1976 wlanspeed.exe 2224 outst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe"C:\Users\Admin\AppData\Local\Temp\fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe"1⤵
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Loads dropped DLL
- Drops file in system dir
- Adds Run entry to start application
PID:1136
-
C:\Program Files (x86)\SinTech\TextEdit.exe"C:\Program Files (x86)\SinTech\TextEdit.exe"1⤵
- Executes dropped EXE
PID:844
-
C:\Windows\SysWOW64\cmd.execmd /c sc create Wlanspeed binpath= "C:\ProgramData\Wlanspeed\wlanspeed.exe -service" start= auto displayname= "Wlanspeed" & sc description Wlanspeed "Wlanspeed service" && netsh advfirewall firewall add rule name="Wlanspeed" dir=in action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe" && netsh advfirewall firewall add rule name="Wlanspeed" dir=out action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1288
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1102977607461903157-123113329-7779327265908737251670542360-14339442551971359344"1⤵
- Suspicious use of SetWindowsHookEx
PID:1264
-
C:\Windows\SysWOW64\sc.exesc create Wlanspeed binpath= "C:\ProgramData\Wlanspeed\wlanspeed.exe -service" start= auto displayname= "Wlanspeed"1⤵
- Creates new service
PID:1332
-
C:\Windows\SysWOW64\sc.exesc description Wlanspeed "Wlanspeed service"1⤵
- Launches SC.exe
PID:1740
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Wlanspeed" dir=in action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"1⤵
- Modifies Windows Firewall
- Windows firewall usage
PID:1472
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Wlanspeed" dir=out action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"1⤵
- Modifies Windows Firewall
- Windows firewall usage
PID:1036
-
C:\ProgramData\Wlanspeed\wlanspeed.exe"C:\ProgramData\Wlanspeed\wlanspeed.exe" -getid -nogui1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1976
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:1740
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:1472
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:865286 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:2176
-
C:\ProgramData\Wlanspeed\outst.exe"C:\ProgramData\Wlanspeed\outst.exe" -outid1⤵
- Executes dropped EXE
PID:2224
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:2412
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:2468
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275462 /prefetch:21⤵
- Suspicious use of SetWindowsHookEx
PID:2616
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1050
- T1031
- T1060