Analysis
- max time kernel
149s - max time network
122s - platform
windows7_x64 - resource
win7 - submitted
01/07/2020, 17:54
Static task
static1
Behavioral task
behavioral1
Sample
PO8973274.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO8973274.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target PO8973274.exe
- Size 406KB
- Sample200701-fpf73wneh2
- SHA256 7c110f7a45aba8f26ba0eb32c024ea55598ec54d9ceda6cf13272a31d2cc6da0
- MD5 969965b7bdf5b6736963b4222747611a
- SHA1 462939760dabc080adde3a2c650187c2278a15c4
- SHA512 9e8b56d915986245517f6f481de1d04102197d4dfe17c5611289a148889282a4a2ff0f0ab8502fdb89d2dc51b4ab2d6e9bf20cdf289ebeef3de98da7d4836141
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 336 vbc.exe 336 vbc.exe 336 vbc.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe 1040 wuapp.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 336 vbc.exe Token: SeDebugPrivilege 1040 wuapp.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 336 vbc.exe 336 vbc.exe 336 vbc.exe 336 vbc.exe 1040 wuapp.exe 1040 wuapp.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1464 wrote to memory of 336 1464 PO8973274.exe 24 PID 1464 wrote to memory of 336 1464 PO8973274.exe 24 PID 1464 wrote to memory of 336 1464 PO8973274.exe 24 PID 1464 wrote to memory of 336 1464 PO8973274.exe 24 PID 1464 wrote to memory of 336 1464 PO8973274.exe 24 PID 1464 wrote to memory of 336 1464 PO8973274.exe 24 PID 1464 wrote to memory of 336 1464 PO8973274.exe 24 PID 1228 wrote to memory of 1040 1228 Explorer.EXE 25 PID 1228 wrote to memory of 1040 1228 Explorer.EXE 25 PID 1228 wrote to memory of 1040 1228 Explorer.EXE 25 PID 1228 wrote to memory of 1040 1228 Explorer.EXE 25 PID 1228 wrote to memory of 1040 1228 Explorer.EXE 25 PID 1228 wrote to memory of 1040 1228 Explorer.EXE 25 PID 1228 wrote to memory of 1040 1228 Explorer.EXE 25 PID 1040 wrote to memory of 1516 1040 wuapp.exe 26 PID 1040 wrote to memory of 1516 1040 wuapp.exe 26 PID 1040 wrote to memory of 1516 1040 wuapp.exe 26 PID 1040 wrote to memory of 1516 1040 wuapp.exe 26 - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1464 set thread context of 336 1464 PO8973274.exe 24 PID 336 set thread context of 1228 336 vbc.exe 20 PID 336 set thread context of 1228 336 vbc.exe 20 PID 1040 set thread context of 1228 1040 wuapp.exe 20 - Uses the VBS compiler for execution 1 TTPs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\PO8973274.exe"C:\Users\Admin\AppData\Local\Temp\PO8973274.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1464 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:336
-
-
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1040 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:1516
-
-