Analysis
- max time kernel
149s - max time network
148s - platform
windows7_x64 - resource
win7 - submitted
10/07/2020, 13:34
Static task
static1
Behavioral task
behavioral1
Sample
FedExs AWB#5305323204643.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
FedExs AWB#5305323204643.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target FedExs AWB#5305323204643.exe
- Size 327KB
- Sample200710-3l3dvmv5j6
- SHA256 82a761b4157d1fa4e99dbf36c0f30935b19a1dd9875e330d81a70877aa07bc8a
- MD5 4d535bf4723300864190a972b1d4f9ad
- SHA1 eeb49ecc3842af963b1ab9eb017c5d672ea7fb37
- SHA512 7991bcb4756e291d3618db2e1010a763bf3227e4015d160d9fd122d1ad401d67dc8cd1884dbf4f2853a29ceab1dd277e9c1b1526b941554586af608ba53c5f0b
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1060 set thread context of 1452 1060 FedExs AWB#5305323204643.exe 25 PID 1452 set thread context of 1324 1452 FedExs AWB#5305323204643.exe 20 PID 908 set thread context of 1324 908 control.exe 20 - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer control.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1440 1060 FedExs AWB#5305323204643.exe 24 PID 1060 wrote to memory of 1440 1060 FedExs AWB#5305323204643.exe 24 PID 1060 wrote to memory of 1440 1060 FedExs AWB#5305323204643.exe 24 PID 1060 wrote to memory of 1440 1060 FedExs AWB#5305323204643.exe 24 PID 1060 wrote to memory of 1452 1060 FedExs AWB#5305323204643.exe 25 PID 1060 wrote to memory of 1452 1060 FedExs AWB#5305323204643.exe 25 PID 1060 wrote to memory of 1452 1060 FedExs AWB#5305323204643.exe 25 PID 1060 wrote to memory of 1452 1060 FedExs AWB#5305323204643.exe 25 PID 1060 wrote to memory of 1452 1060 FedExs AWB#5305323204643.exe 25 PID 1060 wrote to memory of 1452 1060 FedExs AWB#5305323204643.exe 25 PID 1060 wrote to memory of 1452 1060 FedExs AWB#5305323204643.exe 25 PID 1324 wrote to memory of 908 1324 Explorer.EXE 26 PID 1324 wrote to memory of 908 1324 Explorer.EXE 26 PID 1324 wrote to memory of 908 1324 Explorer.EXE 26 PID 1324 wrote to memory of 908 1324 Explorer.EXE 26 PID 908 wrote to memory of 788 908 control.exe 27 PID 908 wrote to memory of 788 908 control.exe 27 PID 908 wrote to memory of 788 908 control.exe 27 PID 908 wrote to memory of 788 908 control.exe 27 PID 908 wrote to memory of 1864 908 control.exe 32 PID 908 wrote to memory of 1864 908 control.exe 32 PID 908 wrote to memory of 1864 908 control.exe 32 PID 908 wrote to memory of 1864 908 control.exe 32 PID 908 wrote to memory of 1864 908 control.exe 32 - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1060 FedExs AWB#5305323204643.exe Token: SeDebugPrivilege 1452 FedExs AWB#5305323204643.exe Token: SeDebugPrivilege 908 control.exe Token: SeShutdownPrivilege 1324 Explorer.EXE - Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1060 FedExs AWB#5305323204643.exe 1060 FedExs AWB#5305323204643.exe 1452 FedExs AWB#5305323204643.exe 1452 FedExs AWB#5305323204643.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe - Deletes itself 1 IoCs
pid Process 788 cmd.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Nmrb00rg8\ThumbCacheohltq4ix.exe control.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1452 FedExs AWB#5305323204643.exe 1452 FedExs AWB#5305323204643.exe 1452 FedExs AWB#5305323204643.exe 908 control.exe 908 control.exe 908 control.exe 908 control.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JXH4VZIX_FP = "C:\\Program Files (x86)\\Nmrb00rg8\\ThumbCacheohltq4ix.exe" control.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run control.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\FedExs AWB#5305323204643.exe"C:\Users\Admin\AppData\Local\Temp\FedExs AWB#5305323204643.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\FedExs AWB#5305323204643.exe"{path}"3⤵PID:1440
-
-
C:\Users\Admin\AppData\Local\Temp\FedExs AWB#5305323204643.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1452
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- System policy modification
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Adds Run entry to policy start application
PID:908 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\FedExs AWB#5305323204643.exe"3⤵
- Deletes itself
PID:788
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1864
-
-