Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10v200430 - submitted
10/07/2020, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
R7566091253.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
R7566091253.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target R7566091253.exe
- Size 816KB
- Sample200710-tpvq9vqf6x
- SHA256 67586cd711a0de6176d2df1bde9bf36f024f893328ae9c447bdf5e636e99502b
- MD5 045898722f8be5ddea3bbd6532878cbe
- SHA1 3c4f5196619e53c35c05cf8ace20cfbb2400cda1
- SHA512 b881d43c40b9b1b2e273ff988acbd6c44e01ee8d5abfc4b7bed9f7e47def8d9308e619464e2970c0c68b0e23d4b78c0250daef2c68ed994b8ea09cc08900017b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1612 set thread context of 1712 1612 R7566091253.exe 68 PID 1712 set thread context of 2952 1712 R7566091253.exe 56 PID 952 set thread context of 2952 952 systray.exe 56 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Whpxx\regsvcgfih.exe systray.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer systray.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\UX0LZLFPZDN = "C:\\Program Files (x86)\\Whpxx\\regsvcgfih.exe" systray.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1612 R7566091253.exe 1612 R7566091253.exe 1712 R7566091253.exe 1712 R7566091253.exe 1712 R7566091253.exe 1712 R7566091253.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe 952 systray.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1712 1612 R7566091253.exe 68 PID 1612 wrote to memory of 1712 1612 R7566091253.exe 68 PID 1612 wrote to memory of 1712 1612 R7566091253.exe 68 PID 2952 wrote to memory of 952 2952 Explorer.EXE 69 PID 2952 wrote to memory of 952 2952 Explorer.EXE 69 PID 2952 wrote to memory of 952 2952 Explorer.EXE 69 PID 952 wrote to memory of 1736 952 systray.exe 70 PID 952 wrote to memory of 1736 952 systray.exe 70 PID 952 wrote to memory of 1736 952 systray.exe 70 PID 952 wrote to memory of 3820 952 systray.exe 76 PID 952 wrote to memory of 3820 952 systray.exe 76 PID 952 wrote to memory of 3820 952 systray.exe 76 - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1612 R7566091253.exe 1712 R7566091253.exe 1712 R7566091253.exe 1712 R7566091253.exe 952 systray.exe 952 systray.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1712 R7566091253.exe Token: SeDebugPrivilege 952 systray.exe Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE Token: SeShutdownPrivilege 2952 Explorer.EXE Token: SeCreatePagefilePrivilege 2952 Explorer.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2952 Explorer.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2952 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\R7566091253.exe"C:\Users\Admin\AppData\Local\Temp\R7566091253.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\R7566091253.exe"C:\Users\Admin\AppData\Local\Temp\R7566091253.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System policy modification
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:952 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\R7566091253.exe"3⤵PID:1736
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3820
-
-