Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 06:10
Static task
static1
Behavioral task
behavioral1
Sample
mazx.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
mazx.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
mazx.exe
-
Size
313KB
-
MD5
ce868e50711384f6932917ceab7b3349
-
SHA1
65254c5c5b67524cbc73d8e5f5755a24451f7fd5
-
SHA256
15c4fa85cbc2c692575d38601a56e49a52a23d74a2dce110bf17beadf46672bb
-
SHA512
e64b224fd9d60cc70a74b35dfd5869cbbbea44d1cde26a71c1a9a55dc5f226a0c409a9583c97c4115acc4c6d00a072d827162d32977386268789483ce8e89810
Score
10/10
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
Processes:
colorcpl.exedescription ioc process File opened for modification C:\Program Files (x86)\Pcx4\ms8pxlgd.exe colorcpl.exe -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
mazx.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 3848 wrote to memory of 2620 3848 mazx.exe mazx.exe PID 3848 wrote to memory of 2620 3848 mazx.exe mazx.exe PID 3848 wrote to memory of 2620 3848 mazx.exe mazx.exe PID 3848 wrote to memory of 2620 3848 mazx.exe mazx.exe PID 3848 wrote to memory of 2620 3848 mazx.exe mazx.exe PID 3848 wrote to memory of 2620 3848 mazx.exe mazx.exe PID 2996 wrote to memory of 2872 2996 Explorer.EXE colorcpl.exe PID 2996 wrote to memory of 2872 2996 Explorer.EXE colorcpl.exe PID 2996 wrote to memory of 2872 2996 Explorer.EXE colorcpl.exe PID 2872 wrote to memory of 3724 2872 colorcpl.exe cmd.exe PID 2872 wrote to memory of 3724 2872 colorcpl.exe cmd.exe PID 2872 wrote to memory of 3724 2872 colorcpl.exe cmd.exe PID 2872 wrote to memory of 3928 2872 colorcpl.exe cmd.exe PID 2872 wrote to memory of 3928 2872 colorcpl.exe cmd.exe PID 2872 wrote to memory of 3928 2872 colorcpl.exe cmd.exe PID 2872 wrote to memory of 3452 2872 colorcpl.exe Firefox.exe PID 2872 wrote to memory of 3452 2872 colorcpl.exe Firefox.exe PID 2872 wrote to memory of 3452 2872 colorcpl.exe Firefox.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
mazx.exemazx.execolorcpl.exedescription pid process target process PID 3848 set thread context of 2620 3848 mazx.exe mazx.exe PID 2620 set thread context of 2996 2620 mazx.exe Explorer.EXE PID 2872 set thread context of 2996 2872 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
mazx.execolorcpl.exepid process 2620 mazx.exe 2620 mazx.exe 2620 mazx.exe 2620 mazx.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
mazx.execolorcpl.exepid process 2620 mazx.exe 2620 mazx.exe 2620 mazx.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
mazx.execolorcpl.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2620 mazx.exe Token: SeDebugPrivilege 2872 colorcpl.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
colorcpl.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer colorcpl.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
colorcpl.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZFDH_RY0AN = "C:\\Program Files (x86)\\Pcx4\\ms8pxlgd.exe" colorcpl.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\mazx.exe"C:\Users\Admin\AppData\Local\Temp\mazx.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\mazx.exe"C:\Users\Admin\AppData\Local\Temp\mazx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- System policy modification
- Adds Run entry to policy start application
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mazx.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
C:\Users\Admin\AppData\Roaming\307QQPQQ\307logim.jpeg
-
C:\Users\Admin\AppData\Roaming\307QQPQQ\307logrf.ini
-
C:\Users\Admin\AppData\Roaming\307QQPQQ\307logrg.ini
-
C:\Users\Admin\AppData\Roaming\307QQPQQ\307logri.ini
-
C:\Users\Admin\AppData\Roaming\307QQPQQ\307logrv.ini
-
memory/2620-1-0x000000000041E320-mapping.dmp
-
memory/2620-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2872-5-0x00000000003A0000-0x00000000003B9000-memory.dmpFilesize
100KB
-
memory/2872-10-0x0000000005AB0000-0x0000000005B60000-memory.dmpFilesize
704KB
-
memory/2872-7-0x00000000058B0000-0x0000000005958000-memory.dmpFilesize
672KB
-
memory/2872-4-0x00000000003A0000-0x00000000003B9000-memory.dmpFilesize
100KB
-
memory/2872-3-0x0000000000000000-mapping.dmp
-
memory/3452-11-0x0000000000000000-mapping.dmp
-
memory/3452-12-0x00007FF6A8DD0000-0x00007FF6A8E63000-memory.dmpFilesize
588KB
-
memory/3452-13-0x00007FF6A8DD0000-0x00007FF6A8E63000-memory.dmpFilesize
588KB
-
memory/3452-14-0x00007FF6A8DD0000-0x00007FF6A8E63000-memory.dmpFilesize
588KB
-
memory/3724-6-0x0000000000000000-mapping.dmp
-
memory/3928-8-0x0000000000000000-mapping.dmp