38d4e4ea5e9b15b4d221cc6627a7b088a54964dfe95b49173a45bc5f9177a249

General

Target
GENTECH PRODUCT INQUIRY.exe
Size 642KB
Sample200716-76bcpm583e
SHA256 38d4e4ea5e9b15b4d221cc6627a7b088a54964dfe95b49173a45bc5f9177a249
MD5 6366b461b56945be4a795ca8bd346ec3
SHA1 d08c5c0188c8bb4e84b41bed78a805cbc0a127de
SHA512 dc07e51c460193869514c875cdc5aaa1da59855ebaee8fae5edb44cd4acf35d37190982113fda285c0c7f95fbc5c1c854c13be42d7cad53f46360c0beddd8b82
MD5 SHA1 SHA512

Score

7^/10

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1068 set thread context of 1636	1068	GENTECH PRODUCT INQUIRY.exe	28
PID 1636 set thread context of 1296	1636	ieinstal.exe	20
PID 1636 set thread context of 1296	1636	ieinstal.exe	20
PID 1596 set thread context of 1296	1596	msiexec.exe	20

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	ieinstal.exe
Token: SeDebugPrivilege	1596	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Suspicious use of SendNotifyMessage 4 IoCs

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	msiexec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1636	1068	GENTECH PRODUCT INQUIRY.exe	28
PID 1068 wrote to memory of 1636	1068	GENTECH PRODUCT INQUIRY.exe	28
PID 1068 wrote to memory of 1636	1068	GENTECH PRODUCT INQUIRY.exe	28
PID 1068 wrote to memory of 1636	1068	GENTECH PRODUCT INQUIRY.exe	28
PID 1068 wrote to memory of 1636	1068	GENTECH PRODUCT INQUIRY.exe	28
PID 1068 wrote to memory of 1636	1068	GENTECH PRODUCT INQUIRY.exe	28
PID 1068 wrote to memory of 1636	1068	GENTECH PRODUCT INQUIRY.exe	28
PID 1068 wrote to memory of 1636	1068	GENTECH PRODUCT INQUIRY.exe	28
PID 1068 wrote to memory of 1636	1068	GENTECH PRODUCT INQUIRY.exe	28
PID 1296 wrote to memory of 1596	1296	Explorer.EXE	29
PID 1296 wrote to memory of 1596	1296	Explorer.EXE	29
PID 1296 wrote to memory of 1596	1296	Explorer.EXE	29
PID 1296 wrote to memory of 1596	1296	Explorer.EXE	29
PID 1296 wrote to memory of 1596	1296	Explorer.EXE	29
PID 1296 wrote to memory of 1596	1296	Explorer.EXE	29
PID 1296 wrote to memory of 1596	1296	Explorer.EXE	29
PID 1596 wrote to memory of 1896	1596	msiexec.exe	30
PID 1596 wrote to memory of 1896	1596	msiexec.exe	30
PID 1596 wrote to memory of 1896	1596	msiexec.exe	30
PID 1596 wrote to memory of 1896	1596	msiexec.exe	30
PID 1596 wrote to memory of 1896	1596	msiexec.exe	30

Suspicious behavior: EnumeratesProcesses 21 IoCs

Suspicious behavior: MapViewOfSection 8 IoCs

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Vsru = "C:\\Users\\Admin\\AppData\\Local\\Vsru\\Vsru.hta"	GENTECH PRODUCT INQUIRY.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102