Analysis
- max time kernel
147s - max time network
135s - platform
windows7_x64 - resource
win7 - submitted
08/07/2020, 10:27
Static task
static1
Behavioral task
behavioral1
Sample
UPDATED S.O.A..exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
UPDATED S.O.A..exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target UPDATED S.O.A..exe
- Size 796KB
- Sample200708-v6hnslypfe
- SHA256 37299afa1d46a1aa02b7b06a39d41d876f454047527e406e7cbcb659833de728
- MD5 37abe07d477f8fd134cd1c4f7bde592d
- SHA1 12f091feb8be7dc754ee73090c8bbcce5d82c4d3
- SHA512 34ba619d7ebd7ffd77cad9445c05f5447a69e3984d2111f88829db3413427b41d68bb7464440ef2cf750830763a2cd088ef22e04bb68b1d2cf1a3782eaaacf03
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1108 set thread context of 1020 1108 UPDATED S.O.A..exe 24 PID 1020 set thread context of 1284 1020 RegSvcs.exe 20 PID 748 set thread context of 1284 748 chkdsk.exe 20 - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mvzd0q8\msmbiplx.exe chkdsk.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JPWDVZIX_JQ = "C:\\Program Files (x86)\\Mvzd0q8\\msmbiplx.exe" chkdsk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run chkdsk.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1108 wrote to memory of 1020 1108 UPDATED S.O.A..exe 24 PID 1108 wrote to memory of 1020 1108 UPDATED S.O.A..exe 24 PID 1108 wrote to memory of 1020 1108 UPDATED S.O.A..exe 24 PID 1108 wrote to memory of 1020 1108 UPDATED S.O.A..exe 24 PID 1108 wrote to memory of 1020 1108 UPDATED S.O.A..exe 24 PID 1108 wrote to memory of 1020 1108 UPDATED S.O.A..exe 24 PID 1108 wrote to memory of 1020 1108 UPDATED S.O.A..exe 24 PID 1108 wrote to memory of 1020 1108 UPDATED S.O.A..exe 24 PID 1108 wrote to memory of 1020 1108 UPDATED S.O.A..exe 24 PID 1108 wrote to memory of 1020 1108 UPDATED S.O.A..exe 24 PID 1284 wrote to memory of 748 1284 Explorer.EXE 25 PID 1284 wrote to memory of 748 1284 Explorer.EXE 25 PID 1284 wrote to memory of 748 1284 Explorer.EXE 25 PID 1284 wrote to memory of 748 1284 Explorer.EXE 25 PID 748 wrote to memory of 1072 748 chkdsk.exe 26 PID 748 wrote to memory of 1072 748 chkdsk.exe 26 PID 748 wrote to memory of 1072 748 chkdsk.exe 26 PID 748 wrote to memory of 1072 748 chkdsk.exe 26 PID 748 wrote to memory of 1628 748 chkdsk.exe 31 PID 748 wrote to memory of 1628 748 chkdsk.exe 31 PID 748 wrote to memory of 1628 748 chkdsk.exe 31 PID 748 wrote to memory of 1628 748 chkdsk.exe 31 PID 748 wrote to memory of 1628 748 chkdsk.exe 31 - Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1108 UPDATED S.O.A..exe 1020 RegSvcs.exe 1020 RegSvcs.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1020 RegSvcs.exe 1020 RegSvcs.exe 1020 RegSvcs.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe 748 chkdsk.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer chkdsk.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1108 UPDATED S.O.A..exe Token: SeDebugPrivilege 1020 RegSvcs.exe Token: SeDebugPrivilege 748 chkdsk.exe Token: SeShutdownPrivilege 1284 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
- Checks whether UAC is enabled
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\UPDATED S.O.A..exe"C:\Users\Admin\AppData\Local\Temp\UPDATED S.O.A..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Drops file in Program Files directory
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Modifies Internet Explorer settings
- System policy modification
- Suspicious use of AdjustPrivilegeToken
PID:748 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1072
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1628
-
-