Analysis
- max time kernel
150s - max time network
143s - platform
windows7_x64 - resource
win7 - submitted
18/07/2020, 08:52
Static task
static1
Behavioral task
behavioral1
Sample
Zbicswp.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Zbicswp.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Zbicswp.exe
- Size 984KB
- Sample200718-vfc4gl3ctx
- SHA256 f01669ff0af4c1b8f4f15985fae94c302537ed8affc5b2fe01534594036218f2
- MD5 622dca0ee8175c9a20456d8892d35a80
- SHA1 d45a2f22186a3b494ef1237028b29eea72cc9cca
- SHA512 094ce631693c4c83ebf1d2728e99eb36cf65cdc6a63336cfba982b4ca0332496247f114760c1150aaecd4dc48caf23b386aefef4ffb14f7439407585fd16ec28
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 832 wrote to memory of 1432 832 Zbicswp.exe 24 PID 832 wrote to memory of 1432 832 Zbicswp.exe 24 PID 832 wrote to memory of 1432 832 Zbicswp.exe 24 PID 832 wrote to memory of 1432 832 Zbicswp.exe 24 PID 832 wrote to memory of 1432 832 Zbicswp.exe 24 PID 832 wrote to memory of 1432 832 Zbicswp.exe 24 PID 832 wrote to memory of 1432 832 Zbicswp.exe 24 PID 832 wrote to memory of 1432 832 Zbicswp.exe 24 PID 832 wrote to memory of 1432 832 Zbicswp.exe 24 PID 832 wrote to memory of 1432 832 Zbicswp.exe 24 PID 1248 wrote to memory of 1528 1248 Explorer.EXE 25 PID 1248 wrote to memory of 1528 1248 Explorer.EXE 25 PID 1248 wrote to memory of 1528 1248 Explorer.EXE 25 PID 1248 wrote to memory of 1528 1248 Explorer.EXE 25 PID 1528 wrote to memory of 1056 1528 svchost.exe 27 PID 1528 wrote to memory of 1056 1528 svchost.exe 27 PID 1528 wrote to memory of 1056 1528 svchost.exe 27 PID 1528 wrote to memory of 1056 1528 svchost.exe 27 PID 1528 wrote to memory of 1056 1528 svchost.exe 27 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1432 ieinstal.exe 1432 ieinstal.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1432 ieinstal.exe 1432 ieinstal.exe 1432 ieinstal.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1432 set thread context of 1248 1432 ieinstal.exe 20 PID 1528 set thread context of 1248 1528 svchost.exe 20 - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1432 ieinstal.exe Token: SeDebugPrivilege 1528 svchost.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\1B0LZ = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" svchost.exe - Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\Zbicswp.exe"C:\Users\Admin\AppData\Local\Temp\Zbicswp.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Adds Run key to start application
- Adds policy Run key to start application
PID:1528 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1056
-
-