Overview

overview

6

Static

static

https://trackloft.si...

windows10_x64

Analysis

  • max time kernel
    124s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10v200217
  • submitted
    02-04-2020 12:26

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    https://trackloft.site/itb?sub_id1=297

  • Sample

    200402-cmljkk4pxn

Score
6/10
persistence

Malware Config

Signatures

  • Modifies system certificate store 19 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Modifies data under HKEY_USERS 93 IoCs
  • Modifies Winlogon 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 74 IoCs
    adwarespyware

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://trackloft.site/itb?sub_id1=297
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of FindShellTrayWindow
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    PID:3996
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3996 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      PID:3492
  • C:\Windows\system32\osk.exe
    "C:\Windows\system32\osk.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:860
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1304
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1572
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0 /state0:0xa3b3b055 /state1:0x41c64e6d
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Modifies data under HKEY_USERS
    • Modifies Winlogon
    PID:364
  • C:\Windows\system32\atbroker.exe
    atbroker.exe
    1⤵
    • Modifies data under HKEY_USERS
    PID:752
  • C:\Windows\system32\atbroker.exe
    atbroker.exe
    1⤵
    • Modifies data under HKEY_USERS
    PID:2880
  • C:\Windows\system32\atbroker.exe
    atbroker.exe
    1⤵
    • Modifies data under HKEY_USERS
    PID:500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9749B98FBE8668DA06415B7D59E68352
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C65B8FBF5FA1FF1A814B758E452B1A52
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9749B98FBE8668DA06415B7D59E68352
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C65B8FBF5FA1FF1A814B758E452B1A52
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\5UPFW6I9.cookie
    Download Submit