Analysis
- max time kernel
148s - max time network
144s - platform
windows10_x64 - resource
win10v200430 - submitted
30/06/2020, 06:10
Static task
static1
Behavioral task
behavioral1
Sample
mazx.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
mazx.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target mazx.exe
- Size 313KB
- Sample200630-mfkmrd2yes
- SHA256 15c4fa85cbc2c692575d38601a56e49a52a23d74a2dce110bf17beadf46672bb
- MD5 ce868e50711384f6932917ceab7b3349
- SHA1 65254c5c5b67524cbc73d8e5f5755a24451f7fd5
- SHA512 e64b224fd9d60cc70a74b35dfd5869cbbbea44d1cde26a71c1a9a55dc5f226a0c409a9583c97c4115acc4c6d00a072d827162d32977386268789483ce8e89810
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Pcx4\ms8pxlgd.exe colorcpl.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3848 wrote to memory of 2620 3848 mazx.exe 72 PID 3848 wrote to memory of 2620 3848 mazx.exe 72 PID 3848 wrote to memory of 2620 3848 mazx.exe 72 PID 3848 wrote to memory of 2620 3848 mazx.exe 72 PID 3848 wrote to memory of 2620 3848 mazx.exe 72 PID 3848 wrote to memory of 2620 3848 mazx.exe 72 PID 2996 wrote to memory of 2872 2996 Explorer.EXE 73 PID 2996 wrote to memory of 2872 2996 Explorer.EXE 73 PID 2996 wrote to memory of 2872 2996 Explorer.EXE 73 PID 2872 wrote to memory of 3724 2872 colorcpl.exe 74 PID 2872 wrote to memory of 3724 2872 colorcpl.exe 74 PID 2872 wrote to memory of 3724 2872 colorcpl.exe 74 PID 2872 wrote to memory of 3928 2872 colorcpl.exe 76 PID 2872 wrote to memory of 3928 2872 colorcpl.exe 76 PID 2872 wrote to memory of 3928 2872 colorcpl.exe 76 PID 2872 wrote to memory of 3452 2872 colorcpl.exe 78 PID 2872 wrote to memory of 3452 2872 colorcpl.exe 78 PID 2872 wrote to memory of 3452 2872 colorcpl.exe 78 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3848 set thread context of 2620 3848 mazx.exe 72 PID 2620 set thread context of 2996 2620 mazx.exe 56 PID 2872 set thread context of 2996 2872 colorcpl.exe 56 - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2620 mazx.exe 2620 mazx.exe 2620 mazx.exe 2620 mazx.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2620 mazx.exe 2620 mazx.exe 2620 mazx.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe 2872 colorcpl.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2620 mazx.exe Token: SeDebugPrivilege 2872 colorcpl.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer colorcpl.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZFDH_RY0AN = "C:\\Program Files (x86)\\Pcx4\\ms8pxlgd.exe" colorcpl.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\mazx.exe"C:\Users\Admin\AppData\Local\Temp\mazx.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\mazx.exe"C:\Users\Admin\AppData\Local\Temp\mazx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- System policy modification
- Adds Run entry to policy start application
PID:2872 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mazx.exe"3⤵PID:3724
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3928
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3452
-
-