Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
30-06-2020 13:47
Static task
static1
Behavioral task
behavioral1
Sample
PO8397234.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO8397234.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
PO8397234.exe
-
Size
293KB
-
MD5
38bcdd78a3aa9a815e7c5b09ffcafa1a
-
SHA1
125cab05a33197836b43307160177917027d9f96
-
SHA256
d2e60c3bec22bb8dc8e990920648725abd8ffdc1925dee26ed8c8187dd7504c1
-
SHA512
cbaedc53feb55139e952187bcfe3cd74461591419b31babd5124567cec04aedefbf6b7dad21dcc4aedac47ee5aec0a8e3762e9ba34ab44ceaef58a883c34e186
Score
10/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO8397234.exePO8397234.exewlanext.exedescription pid process target process PID 240 set thread context of 1848 240 PO8397234.exe PO8397234.exe PID 1848 set thread context of 1304 1848 PO8397234.exe Explorer.EXE PID 1728 set thread context of 1304 1728 wlanext.exe Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO8397234.exewlanext.exedescription pid process Token: SeDebugPrivilege 1848 PO8397234.exe Token: SeDebugPrivilege 1728 wlanext.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1752 cmd.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE -
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
wlanext.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wlanext.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JPXX3LNHN2Y = "C:\\Program Files (x86)\\Mkv1hb\\win1b7p.exe" wlanext.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
PO8397234.exeExplorer.EXEwlanext.exedescription pid process target process PID 240 wrote to memory of 1848 240 PO8397234.exe PO8397234.exe PID 240 wrote to memory of 1848 240 PO8397234.exe PO8397234.exe PID 240 wrote to memory of 1848 240 PO8397234.exe PO8397234.exe PID 240 wrote to memory of 1848 240 PO8397234.exe PO8397234.exe PID 240 wrote to memory of 1848 240 PO8397234.exe PO8397234.exe PID 240 wrote to memory of 1848 240 PO8397234.exe PO8397234.exe PID 240 wrote to memory of 1848 240 PO8397234.exe PO8397234.exe PID 1304 wrote to memory of 1728 1304 Explorer.EXE wlanext.exe PID 1304 wrote to memory of 1728 1304 Explorer.EXE wlanext.exe PID 1304 wrote to memory of 1728 1304 Explorer.EXE wlanext.exe PID 1304 wrote to memory of 1728 1304 Explorer.EXE wlanext.exe PID 1728 wrote to memory of 1752 1728 wlanext.exe cmd.exe PID 1728 wrote to memory of 1752 1728 wlanext.exe cmd.exe PID 1728 wrote to memory of 1752 1728 wlanext.exe cmd.exe PID 1728 wrote to memory of 1752 1728 wlanext.exe cmd.exe PID 1728 wrote to memory of 1708 1728 wlanext.exe Firefox.exe PID 1728 wrote to memory of 1708 1728 wlanext.exe Firefox.exe PID 1728 wrote to memory of 1708 1728 wlanext.exe Firefox.exe PID 1728 wrote to memory of 1708 1728 wlanext.exe Firefox.exe PID 1728 wrote to memory of 1708 1728 wlanext.exe Firefox.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
PO8397234.exewlanext.exepid process 1848 PO8397234.exe 1848 PO8397234.exe 1848 PO8397234.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
wlanext.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wlanext.exe -
Processes:
wlanext.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wlanext.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
PO8397234.exewlanext.exepid process 1848 PO8397234.exe 1848 PO8397234.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe 1728 wlanext.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
wlanext.exedescription ioc process File opened for modification C:\Program Files (x86)\Mkv1hb\win1b7p.exe wlanext.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\PO8397234.exe"C:\Users\Admin\AppData\Local\Temp\PO8397234.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO8397234.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- System policy modification
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO8397234.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/240-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1708-15-0x0000000000000000-mapping.dmp
-
memory/1708-16-0x000000013F190000-0x000000013F223000-memory.dmpFilesize
588KB
-
memory/1728-4-0x0000000000000000-mapping.dmp
-
memory/1728-5-0x0000000000C30000-0x0000000000C46000-memory.dmpFilesize
88KB
-
memory/1728-7-0x0000000000AB0000-0x0000000000C2D000-memory.dmpFilesize
1.5MB
-
memory/1728-8-0x00000000754B0000-0x000000007560C000-memory.dmpFilesize
1.4MB
-
memory/1728-14-0x0000000003A10000-0x0000000003B8F000-memory.dmpFilesize
1.5MB
-
memory/1752-6-0x0000000000000000-mapping.dmp
-
memory/1848-2-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1848-3-0x000000000041C160-mapping.dmp