Analysis
-
max time kernel
151s -
max time network
51s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
19-07-2020 19:25
Static task
static1
Behavioral task
behavioral1
Sample
vmzeus_3.3.7.0.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vmzeus_3.3.7.0.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
vmzeus_3.3.7.0.vir.exe
-
Size
501KB
-
MD5
4d1c3b8e8cf5d6e39a3586f28e56d195
-
SHA1
17c634620f1f31155a6826b2fbb2666ae852137a
-
SHA256
6a46de11b9ebaaa99cecd10012b7532e5d323d9ddf5bb25309f6fbf47f192fde
-
SHA512
59abbc532f76faea4fe91ed618040eb401445555c5f8155b34fdb3b780535f22f94f0882c7e5fd07b17d320cccd3651a5bd260d4cc9ba22770dd2789476fcd72
Score
8/10
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SyncMicrosoft.exepid process 1836 SyncMicrosoft.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 520 cmd.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
SyncMicrosoft.exepid process 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe 1836 SyncMicrosoft.exe -
Drops file in Windows directory 2 IoCs
Processes:
SyncMicrosoft.exevmzeus_3.3.7.0.vir.exedescription ioc process File opened for modification C:\Windows\win.ini SyncMicrosoft.exe File opened for modification C:\Windows\win.ini vmzeus_3.3.7.0.vir.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SyncMicrosoft.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run SyncMicrosoft.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\{A64D7CA8-A16A-0D2A-CB97-029D4A7E75AE} = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SyncMicrosoft.exe" SyncMicrosoft.exe -
Loads dropped DLL 1 IoCs
Processes:
vmzeus_3.3.7.0.vir.exepid process 376 vmzeus_3.3.7.0.vir.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
vmzeus_3.3.7.0.vir.exedescription pid process target process PID 376 wrote to memory of 1836 376 vmzeus_3.3.7.0.vir.exe SyncMicrosoft.exe PID 376 wrote to memory of 1836 376 vmzeus_3.3.7.0.vir.exe SyncMicrosoft.exe PID 376 wrote to memory of 1836 376 vmzeus_3.3.7.0.vir.exe SyncMicrosoft.exe PID 376 wrote to memory of 1836 376 vmzeus_3.3.7.0.vir.exe SyncMicrosoft.exe PID 376 wrote to memory of 520 376 vmzeus_3.3.7.0.vir.exe cmd.exe PID 376 wrote to memory of 520 376 vmzeus_3.3.7.0.vir.exe cmd.exe PID 376 wrote to memory of 520 376 vmzeus_3.3.7.0.vir.exe cmd.exe PID 376 wrote to memory of 520 376 vmzeus_3.3.7.0.vir.exe cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
SyncMicrosoft.exepid process 1836 SyncMicrosoft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.7.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.7.0.vir.exe"1⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SyncMicrosoft.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SyncMicrosoft.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
- Adds Run key to start application
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4edfb31c.bat"2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4edfb31c.bat
-
C:\Users\Admin\AppData\Roaming\Microsoft\SyncMicrosoft.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\SyncMicrosoft.exe
-
C:\Windows\win.ini
-
\Users\Admin\AppData\Roaming\Microsoft\SyncMicrosoft.exe
-
memory/376-6-0x0000000003040000-0x0000000003044000-memory.dmpFilesize
16KB
-
memory/520-5-0x0000000000000000-mapping.dmp
-
memory/1836-1-0x0000000000000000-mapping.dmp