Analysis
- max time kernel
151s - max time network
89s - platform
windows7_x64 - resource
win7v200430 - submitted
19/07/2020, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
iceix_1.1.5.0.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
iceix_1.1.5.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target iceix_1.1.5.0.vir.exe
- Size 253KB
- Sample200719-7hknpstabj
- SHA256 70e1d2fba60a7d20e531b09ff328fef21b82bb7e87d78a48f964d82c7dd2680f
- MD5 a5fb8563ce0eced343a7b9a3b4a6d915
- SHA1 04a3fdf64b80099623856bc5bef35af2fa55601c
- SHA512 9992e37f7b0f34f9d2f792b16fe4e635e4e7ec8c7c9e2679253332acba89407082601a724010506190b510e614b30c23168d6be7707f9884b599e0d308f69bd6
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 1400 wrote to memory of 1592 1400 iceix_1.1.5.0.vir.exe 24 PID 1400 wrote to memory of 1592 1400 iceix_1.1.5.0.vir.exe 24 PID 1400 wrote to memory of 1592 1400 iceix_1.1.5.0.vir.exe 24 PID 1400 wrote to memory of 1592 1400 iceix_1.1.5.0.vir.exe 24 PID 1592 wrote to memory of 1132 1592 tysovo.exe 18 PID 1592 wrote to memory of 1132 1592 tysovo.exe 18 PID 1592 wrote to memory of 1132 1592 tysovo.exe 18 PID 1592 wrote to memory of 1132 1592 tysovo.exe 18 PID 1592 wrote to memory of 1132 1592 tysovo.exe 18 PID 1592 wrote to memory of 1220 1592 tysovo.exe 19 PID 1592 wrote to memory of 1220 1592 tysovo.exe 19 PID 1592 wrote to memory of 1220 1592 tysovo.exe 19 PID 1592 wrote to memory of 1220 1592 tysovo.exe 19 PID 1592 wrote to memory of 1220 1592 tysovo.exe 19 PID 1592 wrote to memory of 1284 1592 tysovo.exe 20 PID 1592 wrote to memory of 1284 1592 tysovo.exe 20 PID 1592 wrote to memory of 1284 1592 tysovo.exe 20 PID 1592 wrote to memory of 1284 1592 tysovo.exe 20 PID 1592 wrote to memory of 1284 1592 tysovo.exe 20 PID 1592 wrote to memory of 1400 1592 tysovo.exe 23 PID 1592 wrote to memory of 1400 1592 tysovo.exe 23 PID 1592 wrote to memory of 1400 1592 tysovo.exe 23 PID 1592 wrote to memory of 1400 1592 tysovo.exe 23 PID 1592 wrote to memory of 1400 1592 tysovo.exe 23 PID 1592 wrote to memory of 1056 1592 tysovo.exe 25 PID 1592 wrote to memory of 1056 1592 tysovo.exe 25 PID 1592 wrote to memory of 1056 1592 tysovo.exe 25 PID 1592 wrote to memory of 1056 1592 tysovo.exe 25 PID 1592 wrote to memory of 1056 1592 tysovo.exe 25 PID 1400 wrote to memory of 1296 1400 iceix_1.1.5.0.vir.exe 28 PID 1400 wrote to memory of 1296 1400 iceix_1.1.5.0.vir.exe 28 PID 1400 wrote to memory of 1296 1400 iceix_1.1.5.0.vir.exe 28 PID 1400 wrote to memory of 1296 1400 iceix_1.1.5.0.vir.exe 28 PID 1400 wrote to memory of 1296 1400 iceix_1.1.5.0.vir.exe 28 PID 1400 wrote to memory of 1296 1400 iceix_1.1.5.0.vir.exe 28 PID 1400 wrote to memory of 1296 1400 iceix_1.1.5.0.vir.exe 28 PID 1400 wrote to memory of 1296 1400 iceix_1.1.5.0.vir.exe 28 PID 1400 wrote to memory of 1296 1400 iceix_1.1.5.0.vir.exe 28 PID 1592 wrote to memory of 1580 1592 tysovo.exe 30 PID 1592 wrote to memory of 1580 1592 tysovo.exe 30 PID 1592 wrote to memory of 1580 1592 tysovo.exe 30 PID 1592 wrote to memory of 1580 1592 tysovo.exe 30 PID 1592 wrote to memory of 1580 1592 tysovo.exe 30 PID 1592 wrote to memory of 904 1592 tysovo.exe 31 PID 1592 wrote to memory of 904 1592 tysovo.exe 31 PID 1592 wrote to memory of 904 1592 tysovo.exe 31 PID 1592 wrote to memory of 904 1592 tysovo.exe 31 PID 1592 wrote to memory of 904 1592 tysovo.exe 31 PID 1592 wrote to memory of 1080 1592 tysovo.exe 32 PID 1592 wrote to memory of 1080 1592 tysovo.exe 32 PID 1592 wrote to memory of 1080 1592 tysovo.exe 32 PID 1592 wrote to memory of 1080 1592 tysovo.exe 32 PID 1592 wrote to memory of 1080 1592 tysovo.exe 32 - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1056 WinMail.exe - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 tysovo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum iceix_1.1.5.0.vir.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 iceix_1.1.5.0.vir.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum tysovo.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Privacy iceix_1.1.5.0.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" iceix_1.1.5.0.vir.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run tysovo.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\{B18389F5-6F94-272C-75BC-36F0FBF17293} = "C:\\Users\\Admin\\AppData\\Roaming\\Faho\\tysovo.exe" tysovo.exe - Loads dropped DLL 1 IoCs
pid Process 1400 iceix_1.1.5.0.vir.exe - Executes dropped EXE 1 IoCs
pid Process 1592 tysovo.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe 1592 tysovo.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1400 set thread context of 1296 1400 iceix_1.1.5.0.vir.exe 28 - Deletes itself 1 IoCs
pid Process 1296 cmd.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\330D2D3D-00000001.eml:OECustomProperty WinMail.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeSecurityPrivilege 1400 iceix_1.1.5.0.vir.exe Token: SeSecurityPrivilege 1400 iceix_1.1.5.0.vir.exe Token: SeSecurityPrivilege 1400 iceix_1.1.5.0.vir.exe Token: SeManageVolumePrivilege 1056 WinMail.exe Token: SeSecurityPrivilege 1296 cmd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1132
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1220
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\iceix_1.1.5.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\iceix_1.1.5.0.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1400 -
C:\Users\Admin\AppData\Roaming\Faho\tysovo.exe"C:\Users\Admin\AppData\Roaming\Faho\tysovo.exe"3⤵
- Suspicious use of WriteProcessMemory
- Maps connected drives based on registry
- Adds Run key to start application
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1592
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp988ed339.bat"3⤵
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1580
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:904
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1080