Analysis

  • max time kernel
    151s
  • max time network
    89s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    19-07-2020 19:51

General

  • Target

    iceix_1.1.5.0.vir.exe

  • Size

    253KB

  • MD5

    a5fb8563ce0eced343a7b9a3b4a6d915

  • SHA1

    04a3fdf64b80099623856bc5bef35af2fa55601c

  • SHA256

    70e1d2fba60a7d20e531b09ff328fef21b82bb7e87d78a48f964d82c7dd2680f

  • SHA512

    9992e37f7b0f34f9d2f792b16fe4e635e4e7ec8c7c9e2679253332acba89407082601a724010506190b510e614b30c23168d6be7707f9884b599e0d308f69bd6

Score
8/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 53 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Deletes itself 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1132
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1220
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1284
          • C:\Users\Admin\AppData\Local\Temp\iceix_1.1.5.0.vir.exe
            "C:\Users\Admin\AppData\Local\Temp\iceix_1.1.5.0.vir.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            • Maps connected drives based on registry
            • Modifies Internet Explorer settings
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:1400
            • C:\Users\Admin\AppData\Roaming\Faho\tysovo.exe
              "C:\Users\Admin\AppData\Roaming\Faho\tysovo.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              • Maps connected drives based on registry
              • Adds Run key to start application
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:1592
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp988ed339.bat"
              3⤵
              • Deletes itself
              • Suspicious use of AdjustPrivilegeToken
              PID:1296
        • C:\Program Files\Windows Mail\WinMail.exe
          "C:\Program Files\Windows Mail\WinMail.exe" -Embedding
          1⤵
          • Suspicious use of SetWindowsHookEx
          • NTFS ADS
          • Suspicious use of AdjustPrivilegeToken
          PID:1056
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1580
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
            1⤵
              PID:904
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
              1⤵
                PID:1080

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              Registry Run Keys / Startup Folder

              1
              T1060

              Defense Evasion

              Modify Registry

              2
              T1112

              Discovery

              Query Registry

              1
              T1012

              Peripheral Device Discovery

              1
              T1120

              System Information Discovery

              1
              T1082

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\tmp988ed339.bat
              • C:\Users\Admin\AppData\Roaming\Faho\tysovo.exe
              • C:\Users\Admin\AppData\Roaming\Faho\tysovo.exe
              • C:\Users\Admin\AppData\Roaming\Fydo\iqywes.vey
              • \Users\Admin\AppData\Roaming\Faho\tysovo.exe
              • memory/1056-26-0x00000000024D0000-0x00000000024D2000-memory.dmp
                Filesize

                8KB

              • memory/1056-21-0x00000000040D0000-0x00000000040D2000-memory.dmp
                Filesize

                8KB

              • memory/1056-9-0x00000000039F0000-0x0000000003BF0000-memory.dmp
                Filesize

                2.0MB

              • memory/1056-10-0x0000000003AF0000-0x0000000003BF0000-memory.dmp
                Filesize

                1024KB

              • memory/1056-14-0x00000000024D0000-0x00000000024D2000-memory.dmp
                Filesize

                8KB

              • memory/1056-15-0x00000000024E0000-0x00000000024E2000-memory.dmp
                Filesize

                8KB

              • memory/1056-16-0x00000000024F0000-0x00000000024F2000-memory.dmp
                Filesize

                8KB

              • memory/1056-32-0x0000000004230000-0x0000000004232000-memory.dmp
                Filesize

                8KB

              • memory/1056-6-0x00000000039F0000-0x0000000003BF0000-memory.dmp
                Filesize

                2.0MB

              • memory/1056-31-0x0000000004140000-0x0000000004142000-memory.dmp
                Filesize

                8KB

              • memory/1056-20-0x00000000035C0000-0x00000000035C2000-memory.dmp
                Filesize

                8KB

              • memory/1056-8-0x00000000039F0000-0x0000000003AF0000-memory.dmp
                Filesize

                1024KB

              • memory/1056-22-0x0000000003600000-0x0000000003602000-memory.dmp
                Filesize

                8KB

              • memory/1056-23-0x0000000003600000-0x0000000003602000-memory.dmp
                Filesize

                8KB

              • memory/1056-24-0x0000000003640000-0x0000000003642000-memory.dmp
                Filesize

                8KB

              • memory/1056-25-0x0000000003600000-0x0000000003602000-memory.dmp
                Filesize

                8KB

              • memory/1056-4-0x00000000039F0000-0x0000000003AF0000-memory.dmp
                Filesize

                1024KB

              • memory/1056-27-0x00000000041E0000-0x00000000041E2000-memory.dmp
                Filesize

                8KB

              • memory/1056-28-0x0000000004200000-0x0000000004202000-memory.dmp
                Filesize

                8KB

              • memory/1056-29-0x00000000041F0000-0x00000000041F2000-memory.dmp
                Filesize

                8KB

              • memory/1056-30-0x0000000004210000-0x0000000004212000-memory.dmp
                Filesize

                8KB

              • memory/1296-19-0x000000000006A4AB-mapping.dmp
              • memory/1296-17-0x0000000000050000-0x0000000000077000-memory.dmp
                Filesize

                156KB

              • memory/1592-1-0x0000000000000000-mapping.dmp