Analysis
-
max time kernel
129s -
max time network
117s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 18:57
General
-
Target
ZWSTt.exe
-
Size
1.1MB
-
MD5
20e64b93aca0efbe72c29ecb1bf0b83f
-
SHA1
6d30fd63bfe8df6f57e7de64084bc4dc76be4126
-
SHA256
1630f3fabf80e99d1990176b5736835496bdbd74610d1e43eefd7088e2529a6e
-
SHA512
046ace67eee709a9e260ee55d2509e99dca2aac41effc660df0cf3c93a38e09f47aad71f22a3acc2a2defcc06acbc5c266441b263e0c1507803ec0ef08069c5b
Score
8/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Checks for installed software on the system 1 TTPs 28 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Executes dropped EXE 3 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Adds Run entry to start application 2 TTPs 2 IoCs
-
Suspicious use of WriteProcessMemory 60021 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZWSTt.exe"C:\Users\Admin\AppData\Local\Temp\ZWSTt.exe"1⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c <nul set /p ="M" > services.com & type pNwYgA.com >> services.com & del pNwYgA.com & certutil -decode tZBC.com J & services.com J & ping 127.0.0.1 -n 32⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\certutil.execertutil -decode tZBC.com J3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\services.comservices.com J3⤵
- Suspicious use of SendNotifyMessage
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\services.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\services.com J4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SendNotifyMessage
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\services.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\services.com5⤵
- Checks for installed software on the system
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 13246⤵
- Program crash
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB