f01669ff0af4c1b8f4f15985fae94c302537ed8affc5b2fe01534594036218f2

General

Target

Zbicswp.exe
Size

984KB
MD5

622dca0ee8175c9a20456d8892d35a80
SHA1

d45a2f22186a3b494ef1237028b29eea72cc9cca
SHA256

f01669ff0af4c1b8f4f15985fae94c302537ed8affc5b2fe01534594036218f2
SHA512

094ce631693c4c83ebf1d2728e99eb36cf65cdc6a63336cfba982b4ca0332496247f114760c1150aaecd4dc48caf23b386aefef4ffb14f7439407585fd16ec28

Score

8^/10

spyware evasion trojan persistence

Malware Config

Signatures

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1432	832	Zbicswp.exe	24
PID 832 wrote to memory of 1432	832	Zbicswp.exe	24
PID 832 wrote to memory of 1432	832	Zbicswp.exe	24
PID 832 wrote to memory of 1432	832	Zbicswp.exe	24
PID 832 wrote to memory of 1432	832	Zbicswp.exe	24
PID 832 wrote to memory of 1432	832	Zbicswp.exe	24
PID 832 wrote to memory of 1432	832	Zbicswp.exe	24
PID 832 wrote to memory of 1432	832	Zbicswp.exe	24
PID 832 wrote to memory of 1432	832	Zbicswp.exe	24
PID 832 wrote to memory of 1432	832	Zbicswp.exe	24
PID 1248 wrote to memory of 1528	1248	Explorer.EXE	25
PID 1248 wrote to memory of 1528	1248	Explorer.EXE	25
PID 1248 wrote to memory of 1528	1248	Explorer.EXE	25
PID 1248 wrote to memory of 1528	1248	Explorer.EXE	25
PID 1528 wrote to memory of 1056	1528	svchost.exe	27
PID 1528 wrote to memory of 1056	1528	svchost.exe	27
PID 1528 wrote to memory of 1056	1528	svchost.exe	27
PID 1528 wrote to memory of 1056	1528	svchost.exe	27
PID 1528 wrote to memory of 1056	1528	svchost.exe	27

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1432	ieinstal.exe
1432	ieinstal.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1432	ieinstal.exe
1432	ieinstal.exe
1432	ieinstal.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe
1528	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 1248	1432	ieinstal.exe	20
PID 1528 set thread context of 1248	1528	svchost.exe	20

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1432	ieinstal.exe
Token: SeDebugPrivilege	1528	svchost.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	svchost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\1B0LZ = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe"	svchost.exe

Adds policy Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
PID:1248
- C:\Users\Admin\AppData\Local\Temp\Zbicswp.exe
  "C:\Users\Admin\AppData\Local\Temp\Zbicswp.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Program Files (x86)\internet explorer\ieinstal.exe
    "C:\Program Files (x86)\internet explorer\ieinstal.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Modifies Internet Explorer settings
  - Adds Run key to start application
  - Adds policy Run key to start application
  PID:1528
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-0-0x0000000010410000-0x000000001043D000-memory.dmp

Filesize
180KB

Download
memory/1056-7-0x000000013FDA0000-0x000000013FE33000-memory.dmp

Filesize
588KB

Download
memory/1528-3-0x0000000000F50000-0x0000000000F58000-memory.dmp

Filesize
32KB

Download
memory/1528-4-0x00000000031C0000-0x0000000003262000-memory.dmp

Filesize
648KB

Download
memory/1528-5-0x0000000003810000-0x0000000003961000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads