Analysis
-
max time kernel
60s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
30-06-2020 06:56
Static task
static1
Behavioral task
behavioral1
Sample
10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe
Resource
win7
General
-
Target
10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe
-
Size
1.4MB
-
MD5
cb2c94881fae75774b495548bc9e90f7
-
SHA1
8411fd9c37200436f94a0459c0205b43d2c06a6c
-
SHA256
10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e
-
SHA512
cc4b2e0d704e78bd14edcec0ff6d76f791a40b4a4e416d5a78cfc0b1948a25ebfe7f15a2d1d520e15e5b87c39c3f6c22ab9a22d7e959f110991a86290b79f1c5
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exedescription pid process target process PID 1544 set thread context of 1604 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
MSBuild.exepid process 1604 MSBuild.exe 1604 MSBuild.exe 1604 MSBuild.exe 1604 MSBuild.exe 1604 MSBuild.exe 1604 MSBuild.exe 1604 MSBuild.exe 1604 MSBuild.exe 1604 MSBuild.exe 1604 MSBuild.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for installed software on the system 1 TTPs 30 IoCs
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName MSBuild.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName MSBuild.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName MSBuild.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName MSBuild.exe -
Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
-
Modifies service 2 TTPs 5 IoCs
Processes:
netsh.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.execmd.exeMSBuild.exedescription pid process target process PID 1544 wrote to memory of 1604 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 1544 wrote to memory of 1604 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 1544 wrote to memory of 1604 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 1544 wrote to memory of 1604 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 1544 wrote to memory of 1604 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 1544 wrote to memory of 1604 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 1544 wrote to memory of 1604 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 1544 wrote to memory of 1604 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 1544 wrote to memory of 1604 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe MSBuild.exe PID 1544 wrote to memory of 1052 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe cmd.exe PID 1544 wrote to memory of 1052 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe cmd.exe PID 1544 wrote to memory of 1052 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe cmd.exe PID 1544 wrote to memory of 1052 1544 10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe cmd.exe PID 1052 wrote to memory of 1744 1052 cmd.exe choice.exe PID 1052 wrote to memory of 1744 1052 cmd.exe choice.exe PID 1052 wrote to memory of 1744 1052 cmd.exe choice.exe PID 1052 wrote to memory of 1744 1052 cmd.exe choice.exe PID 1604 wrote to memory of 1892 1604 MSBuild.exe netsh.exe PID 1604 wrote to memory of 1892 1604 MSBuild.exe netsh.exe PID 1604 wrote to memory of 1892 1604 MSBuild.exe netsh.exe PID 1604 wrote to memory of 1892 1604 MSBuild.exe netsh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1052 cmd.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com 1 api.ipify.org 2 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1604 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe"C:\Users\Admin\AppData\Local\Temp\10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profiles3⤵
- Modifies service
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e.exe"2⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 13⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-4-0x0000000000000000-mapping.dmp
-
memory/1544-5-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1604-0-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1604-1-0x0000000000496F8E-mapping.dmp
-
memory/1604-2-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1604-3-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1744-6-0x0000000000000000-mapping.dmp
-
memory/1892-7-0x0000000000000000-mapping.dmp