Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 11:06
Static task
static1
Behavioral task
behavioral1
Sample
fletë pagese.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fletë pagese.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
fletë pagese.exe
-
Size
649KB
-
MD5
f536c98ef869e3a9d1d6776edbee76b1
-
SHA1
0876c67101f3f146e293199971596a5b47123a4c
-
SHA256
7f261df83598926b168c3515bde5a345dba7828d5bcbdedff5fc55cd16ec23a8
-
SHA512
b26ab3b4c4d0117cca7e38f0e4b0d3f530888b776cf7b6f0e2fabb48af632ca678a509211e8797c928429071abf1b7667f2174a2aaacdf71bdd2a755650b11ae
Score
8/10
Malware Config
Signatures
-
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
wuapp.exedescription ioc process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wuapp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\6LFHZLUHO8_X = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" wuapp.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
ieinstal.exewuapp.exepid process 1652 ieinstal.exe 1652 ieinstal.exe 1652 ieinstal.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
ieinstal.exewuapp.exepid process 1652 ieinstal.exe 1652 ieinstal.exe 1652 ieinstal.exe 1652 ieinstal.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe 1516 wuapp.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Adds Run entry to policy start application 2 TTPs 1 IoCs
Processes:
wuapp.exedescription ioc process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wuapp.exe -
Processes:
wuapp.exedescription ioc process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wuapp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
fletë pagese.exeExplorer.EXEwuapp.exedescription pid process target process PID 2044 wrote to memory of 1652 2044 fletë pagese.exe ieinstal.exe PID 2044 wrote to memory of 1652 2044 fletë pagese.exe ieinstal.exe PID 2044 wrote to memory of 1652 2044 fletë pagese.exe ieinstal.exe PID 2044 wrote to memory of 1652 2044 fletë pagese.exe ieinstal.exe PID 2044 wrote to memory of 1652 2044 fletë pagese.exe ieinstal.exe PID 2044 wrote to memory of 1652 2044 fletë pagese.exe ieinstal.exe PID 2044 wrote to memory of 1652 2044 fletë pagese.exe ieinstal.exe PID 2044 wrote to memory of 1652 2044 fletë pagese.exe ieinstal.exe PID 2044 wrote to memory of 1652 2044 fletë pagese.exe ieinstal.exe PID 2044 wrote to memory of 1652 2044 fletë pagese.exe ieinstal.exe PID 1256 wrote to memory of 1516 1256 Explorer.EXE wuapp.exe PID 1256 wrote to memory of 1516 1256 Explorer.EXE wuapp.exe PID 1256 wrote to memory of 1516 1256 Explorer.EXE wuapp.exe PID 1256 wrote to memory of 1516 1256 Explorer.EXE wuapp.exe PID 1256 wrote to memory of 1516 1256 Explorer.EXE wuapp.exe PID 1256 wrote to memory of 1516 1256 Explorer.EXE wuapp.exe PID 1256 wrote to memory of 1516 1256 Explorer.EXE wuapp.exe PID 1516 wrote to memory of 1176 1516 wuapp.exe Firefox.exe PID 1516 wrote to memory of 1176 1516 wuapp.exe Firefox.exe PID 1516 wrote to memory of 1176 1516 wuapp.exe Firefox.exe PID 1516 wrote to memory of 1176 1516 wuapp.exe Firefox.exe PID 1516 wrote to memory of 1176 1516 wuapp.exe Firefox.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ieinstal.exewuapp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1652 ieinstal.exe Token: SeDebugPrivilege 1516 wuapp.exe Token: SeShutdownPrivilege 1256 Explorer.EXE Token: SeShutdownPrivilege 1256 Explorer.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ieinstal.exewuapp.exedescription pid process target process PID 1652 set thread context of 1256 1652 ieinstal.exe Explorer.EXE PID 1652 set thread context of 1256 1652 ieinstal.exe Explorer.EXE PID 1516 set thread context of 1256 1516 wuapp.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\fletë pagese.exe"C:\Users\Admin\AppData\Local\Temp\fletë pagese.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologim.jpeg
-
C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologrf.ini
-
C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologri.ini
-
C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologrv.ini
-
memory/1176-6-0x0000000000000000-mapping.dmp
-
memory/1176-7-0x000000013F370000-0x000000013F403000-memory.dmpFilesize
588KB
-
memory/1516-2-0x0000000000000000-mapping.dmp
-
memory/1516-3-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/1516-4-0x0000000003980000-0x0000000003AE1000-memory.dmpFilesize
1.4MB
-
memory/1516-5-0x0000000003980000-0x0000000003AE1000-memory.dmpFilesize
1.4MB
-
memory/1652-1-0x0000000000000000-mapping.dmp
-
memory/2044-0-0x0000000010410000-0x000000001043D000-memory.dmpFilesize
180KB