Analysis
- max time kernel
147s - max time network
139s - platform
windows7_x64 - resource
win7 - submitted
17/07/2020, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
quotation ref doc.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
quotation ref doc.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target quotation ref doc.exe
- Size 251KB
- Sample200717-m2ry8bpxp6
- SHA256 9b861daa0a7b4276df89a7ec49d2dd3388366ad60a3058df70525313799a0d05
- MD5 3d6c069a2e8a3820de1e6a18f5178aee
- SHA1 df9463625727250c15e5fe8bd7019a01f3ce587e
- SHA512 770179ed1195e6c9fe2687e48b8832a22627f957dcd9fe74aa9f01c024d034c17814373facbba5beaaf63499f09f9e4b2a3379d39ca2fa12e5b9451e84bf66e9
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
-
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Bcf2\certmgr5jd0sxkh.exe netsh.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 900 wrote to memory of 1344 900 quotation ref doc.exe 24 PID 900 wrote to memory of 1344 900 quotation ref doc.exe 24 PID 900 wrote to memory of 1344 900 quotation ref doc.exe 24 PID 900 wrote to memory of 1344 900 quotation ref doc.exe 24 PID 900 wrote to memory of 1344 900 quotation ref doc.exe 24 PID 900 wrote to memory of 1344 900 quotation ref doc.exe 24 PID 900 wrote to memory of 1344 900 quotation ref doc.exe 24 PID 900 wrote to memory of 1344 900 quotation ref doc.exe 24 PID 1336 wrote to memory of 1424 1336 Explorer.EXE 25 PID 1336 wrote to memory of 1424 1336 Explorer.EXE 25 PID 1336 wrote to memory of 1424 1336 Explorer.EXE 25 PID 1336 wrote to memory of 1424 1336 Explorer.EXE 25 PID 1424 wrote to memory of 1512 1424 netsh.exe 26 PID 1424 wrote to memory of 1512 1424 netsh.exe 26 PID 1424 wrote to memory of 1512 1424 netsh.exe 26 PID 1424 wrote to memory of 1512 1424 netsh.exe 26 PID 1424 wrote to memory of 1588 1424 netsh.exe 31 PID 1424 wrote to memory of 1588 1424 netsh.exe 31 PID 1424 wrote to memory of 1588 1424 netsh.exe 31 PID 1424 wrote to memory of 1588 1424 netsh.exe 31 PID 1424 wrote to memory of 1588 1424 netsh.exe 31 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 900 set thread context of 1344 900 quotation ref doc.exe 24 PID 1344 set thread context of 1336 1344 RegAsm.exe 20 PID 1424 set thread context of 1336 1424 netsh.exe 20 - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe quotation ref doc.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 900 quotation ref doc.exe 1344 RegAsm.exe 1344 RegAsm.exe 1344 RegAsm.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe - Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1344 RegAsm.exe 1344 RegAsm.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe 1424 netsh.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1344 RegAsm.exe Token: SeDebugPrivilege 1424 netsh.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run netsh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\X6QLGPYHK8 = "C:\\Program Files (x86)\\Bcf2\\certmgr5jd0sxkh.exe" netsh.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\quotation ref doc.exe"C:\Users\Admin\AppData\Local\Temp\quotation ref doc.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Drops startup file
- Suspicious behavior: MapViewOfSection
PID:900 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Adds Run key to start application
PID:1424 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:1512
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1588
-
-