Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
09/07/2020, 11:06
Static task
static1
Behavioral task
behavioral1
Sample
fletë pagese.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fletë pagese.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
fletë pagese.exe
-
Size
649KB
-
MD5
f536c98ef869e3a9d1d6776edbee76b1
-
SHA1
0876c67101f3f146e293199971596a5b47123a4c
-
SHA256
7f261df83598926b168c3515bde5a345dba7828d5bcbdedff5fc55cd16ec23a8
-
SHA512
b26ab3b4c4d0117cca7e38f0e4b0d3f530888b776cf7b6f0e2fabb48af632ca678a509211e8797c928429071abf1b7667f2174a2aaacdf71bdd2a755650b11ae
Score
8/10
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wuapp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\6LFHZLUHO8_X = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" wuapp.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1652 ieinstal.exe 1652 ieinstal.exe 1652 ieinstal.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1652 ieinstal.exe 1652 ieinstal.exe 1652 ieinstal.exe 1652 ieinstal.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Adds Run entry to policy start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wuapp.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wuapp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1652 2044 fletë pagese.exe 26 PID 2044 wrote to memory of 1652 2044 fletë pagese.exe 26 PID 2044 wrote to memory of 1652 2044 fletë pagese.exe 26 PID 2044 wrote to memory of 1652 2044 fletë pagese.exe 26 PID 2044 wrote to memory of 1652 2044 fletë pagese.exe 26 PID 2044 wrote to memory of 1652 2044 fletë pagese.exe 26 PID 2044 wrote to memory of 1652 2044 fletë pagese.exe 26 PID 2044 wrote to memory of 1652 2044 fletë pagese.exe 26 PID 2044 wrote to memory of 1652 2044 fletë pagese.exe 26 PID 2044 wrote to memory of 1652 2044 fletë pagese.exe 26 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 27 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 27 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 27 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 27 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 27 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 27 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 27 PID 1516 wrote to memory of 1176 1516 wuapp.exe 28 PID 1516 wrote to memory of 1176 1516 wuapp.exe 28 PID 1516 wrote to memory of 1176 1516 wuapp.exe 28 PID 1516 wrote to memory of 1176 1516 wuapp.exe 28 PID 1516 wrote to memory of 1176 1516 wuapp.exe 28 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1652 ieinstal.exe Token: SeDebugPrivilege 1516 wuapp.exe Token: SeShutdownPrivilege 1256 Explorer.EXE Token: SeShutdownPrivilege 1256 Explorer.EXE -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1652 set thread context of 1256 1652 ieinstal.exe 20 PID 1652 set thread context of 1256 1652 ieinstal.exe 20 PID 1516 set thread context of 1256 1516 wuapp.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\fletë pagese.exe"C:\Users\Admin\AppData\Local\Temp\fletë pagese.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1652
-
-
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1516 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1176
-
-