Analysis
-
max time kernel
149s -
max time network
75s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 06:55
Static task
static1
Behavioral task
behavioral1
Sample
OWewuLXgD9xZMH3.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
OWewuLXgD9xZMH3.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
OWewuLXgD9xZMH3.exe
-
Size
520KB
-
MD5
5a83382b7cccb625dd0d0d2c5a4ce567
-
SHA1
6de62d0acecb88e3e15946590d9efef511f4edf8
-
SHA256
f5a9d50fd4952841488946dbb42d9022dd2d27a2ff0dc8b6ff01e26a303c4d6f
-
SHA512
ad53189a4a7d10a3623a9c66547955caa2721bcfa654a42f334477cef9960f65729891adca16d1fa34093e68e8597cf9dbe10b3eabf82dd7c8639a3e475f9074
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
OWewuLXgD9xZMH3.exeOWewuLXgD9xZMH3.exewscript.exedescription pid process target process PID 1088 wrote to memory of 1448 1088 OWewuLXgD9xZMH3.exe schtasks.exe PID 1088 wrote to memory of 1448 1088 OWewuLXgD9xZMH3.exe schtasks.exe PID 1088 wrote to memory of 1448 1088 OWewuLXgD9xZMH3.exe schtasks.exe PID 1088 wrote to memory of 1448 1088 OWewuLXgD9xZMH3.exe schtasks.exe PID 1088 wrote to memory of 304 1088 OWewuLXgD9xZMH3.exe OWewuLXgD9xZMH3.exe PID 1088 wrote to memory of 304 1088 OWewuLXgD9xZMH3.exe OWewuLXgD9xZMH3.exe PID 1088 wrote to memory of 304 1088 OWewuLXgD9xZMH3.exe OWewuLXgD9xZMH3.exe PID 1088 wrote to memory of 304 1088 OWewuLXgD9xZMH3.exe OWewuLXgD9xZMH3.exe PID 1088 wrote to memory of 304 1088 OWewuLXgD9xZMH3.exe OWewuLXgD9xZMH3.exe PID 1088 wrote to memory of 304 1088 OWewuLXgD9xZMH3.exe OWewuLXgD9xZMH3.exe PID 1088 wrote to memory of 304 1088 OWewuLXgD9xZMH3.exe OWewuLXgD9xZMH3.exe PID 304 wrote to memory of 1588 304 OWewuLXgD9xZMH3.exe wscript.exe PID 304 wrote to memory of 1588 304 OWewuLXgD9xZMH3.exe wscript.exe PID 304 wrote to memory of 1588 304 OWewuLXgD9xZMH3.exe wscript.exe PID 304 wrote to memory of 1588 304 OWewuLXgD9xZMH3.exe wscript.exe PID 1588 wrote to memory of 1632 1588 wscript.exe cmd.exe PID 1588 wrote to memory of 1632 1588 wscript.exe cmd.exe PID 1588 wrote to memory of 1632 1588 wscript.exe cmd.exe PID 1588 wrote to memory of 1632 1588 wscript.exe cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
OWewuLXgD9xZMH3.exeOWewuLXgD9xZMH3.exewscript.exedescription pid process target process PID 1088 set thread context of 304 1088 OWewuLXgD9xZMH3.exe OWewuLXgD9xZMH3.exe PID 304 set thread context of 1276 304 OWewuLXgD9xZMH3.exe Explorer.EXE PID 304 set thread context of 1276 304 OWewuLXgD9xZMH3.exe Explorer.EXE PID 1588 set thread context of 1276 1588 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
OWewuLXgD9xZMH3.exewscript.exepid process 304 OWewuLXgD9xZMH3.exe 304 OWewuLXgD9xZMH3.exe 304 OWewuLXgD9xZMH3.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe 1588 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
OWewuLXgD9xZMH3.exewscript.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 304 OWewuLXgD9xZMH3.exe Token: SeDebugPrivilege 1588 wscript.exe Token: SeShutdownPrivilege 1276 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
OWewuLXgD9xZMH3.exewscript.exepid process 304 OWewuLXgD9xZMH3.exe 304 OWewuLXgD9xZMH3.exe 304 OWewuLXgD9xZMH3.exe 304 OWewuLXgD9xZMH3.exe 1588 wscript.exe 1588 wscript.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1632 cmd.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\OWewuLXgD9xZMH3.exe"C:\Users\Admin\AppData\Local\Temp\OWewuLXgD9xZMH3.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1088 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WYCXOwUUC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp82E5.tmp"3⤵
- Creates scheduled task(s)
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\OWewuLXgD9xZMH3.exe"{path}"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:304 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1588 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\OWewuLXgD9xZMH3.exe"5⤵
- Deletes itself
PID:1632
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp82E5.tmp
-
memory/304-2-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/304-3-0x000000000041B6E0-mapping.dmp
-
memory/1276-4-0x0000000004E20000-0x0000000004EE4000-memory.dmpFilesize
784KB
-
memory/1448-0-0x0000000000000000-mapping.dmp
-
memory/1588-5-0x0000000000000000-mapping.dmp
-
memory/1588-6-0x0000000000BB0000-0x0000000000BD6000-memory.dmpFilesize
152KB
-
memory/1588-8-0x0000000003210000-0x0000000003383000-memory.dmpFilesize
1.4MB
-
memory/1632-7-0x0000000000000000-mapping.dmp