Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:52
Static task
static1
Behavioral task
behavioral1
Sample
tasks_196.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tasks_196.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
tasks_196.vir.exe
-
Size
229KB
-
MD5
5bfda10184fb2ea0246db7f121bb9b22
-
SHA1
b22541ca672cb19b440e222133da6f220fa9027e
-
SHA256
6771d8d0431034fdd65f892475bfb38597457ccb65a7b2d46dd37579e22ebd4d
-
SHA512
08bfa9e2ac0ae48186fb7705da0a4ac80a9d10e131d4cccee1624f93cdc2d3c6878e81130c173171c8decc4ec8db4d46bfa225c513f518cf6d51b33907f1dbb0
Score
8/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 1276 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
tasks_196.vir.exedescription ioc process File created C:\Windows\Tasks\Security Center Update - 790130236.job tasks_196.vir.exe -
Executes dropped EXE 3 IoCs
Processes:
winsec32.exeturepo.exeturepo.exepid process 612 winsec32.exe 1428 turepo.exe 296 turepo.exe -
Suspicious behavior: EnumeratesProcesses 84 IoCs
Processes:
turepo.exeturepo.exepid process 1428 turepo.exe 1428 turepo.exe 1428 turepo.exe 1428 turepo.exe 1428 turepo.exe 1428 turepo.exe 1428 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe 296 turepo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
turepo.exepid process 296 turepo.exe 296 turepo.exe -
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
turepo.exewinsec32.exeExplorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run turepo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run winsec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nyundahi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Aghiewa\\turepo.exe\"" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nyundahi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Aghiewa\\turepo.exe\"" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nyundahi = "C:\\Users\\Admin\\AppData\\Roaming\\Aghiewa\\turepo.exe" turepo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run turepo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Nyundahi = "C:\\Users\\Admin\\AppData\\Roaming\\Aghiewa\\turepo.exe" turepo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Nyundahi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Aghiewa\\turepo.exe\"" winsec32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Drops file in System32 directory 2 IoCs
Processes:
tasks_196.vir.exedescription ioc process File created C:\Windows\SysWOW64\winsec32.exe tasks_196.vir.exe File opened for modification C:\Windows\SysWOW64\winsec32.exe tasks_196.vir.exe -
Processes:
turepo.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main turepo.exe -
Loads dropped DLL 1 IoCs
Processes:
tasks_196.vir.exepid process 1088 tasks_196.vir.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
tasks_196.vir.exeturepo.exeturepo.exedescription pid process target process PID 1088 wrote to memory of 1428 1088 tasks_196.vir.exe turepo.exe PID 1088 wrote to memory of 1428 1088 tasks_196.vir.exe turepo.exe PID 1088 wrote to memory of 1428 1088 tasks_196.vir.exe turepo.exe PID 1088 wrote to memory of 1428 1088 tasks_196.vir.exe turepo.exe PID 1428 wrote to memory of 1276 1428 turepo.exe Explorer.EXE PID 1088 wrote to memory of 1584 1088 tasks_196.vir.exe cmd.exe PID 1088 wrote to memory of 1584 1088 tasks_196.vir.exe cmd.exe PID 1088 wrote to memory of 1584 1088 tasks_196.vir.exe cmd.exe PID 1088 wrote to memory of 1584 1088 tasks_196.vir.exe cmd.exe PID 1428 wrote to memory of 296 1428 turepo.exe turepo.exe PID 1428 wrote to memory of 296 1428 turepo.exe turepo.exe PID 1428 wrote to memory of 296 1428 turepo.exe turepo.exe PID 1428 wrote to memory of 296 1428 turepo.exe turepo.exe PID 1428 wrote to memory of 1276 1428 turepo.exe Explorer.EXE PID 1428 wrote to memory of 1276 1428 turepo.exe Explorer.EXE PID 1428 wrote to memory of 1276 1428 turepo.exe Explorer.EXE PID 1428 wrote to memory of 1276 1428 turepo.exe Explorer.EXE PID 1428 wrote to memory of 1276 1428 turepo.exe Explorer.EXE PID 1428 wrote to memory of 1276 1428 turepo.exe Explorer.EXE PID 296 wrote to memory of 1388 296 turepo.exe ctfmon.exe PID 296 wrote to memory of 1388 296 turepo.exe ctfmon.exe PID 296 wrote to memory of 1388 296 turepo.exe ctfmon.exe PID 296 wrote to memory of 1388 296 turepo.exe ctfmon.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1584 cmd.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\tasks_196.vir.exe"C:\Users\Admin\AppData\Local\Temp\tasks_196.vir.exe"2⤵
- Drops file in Windows directory
- Drops file in System32 directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Aghiewa\turepo.exe"C:\Users\Admin\AppData\Roaming\Aghiewa\turepo.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Aghiewa\turepo.exe"C:\Users\Admin\AppData\Roaming\Aghiewa\turepo.exe" -child4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfmon.exectfmon.exe5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe7043ceb.bat"3⤵
- Deletes itself
-
C:\Windows\SysWOW64\winsec32.exe"C:\Windows\SysWOW64\winsec32.exe" -service "C:\Users\Admin\AppData\Roaming\Aghiewa\turepo.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpe7043ceb.bat
-
C:\Users\Admin\AppData\Roaming\Aghiewa\turepo.exe
-
C:\Users\Admin\AppData\Roaming\Aghiewa\turepo.exe
-
C:\Users\Admin\AppData\Roaming\Aghiewa\turepo.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0ZWVMS5A.txt
-
C:\Windows\SysWOW64\winsec32.exe
-
C:\Windows\SysWOW64\winsec32.exe
-
\Users\Admin\AppData\Roaming\Aghiewa\turepo.exe
-
memory/296-8-0x0000000000000000-mapping.dmp
-
memory/1276-6-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/1388-16-0x0000000000000000-mapping.dmp
-
memory/1428-4-0x0000000000000000-mapping.dmp
-
memory/1584-7-0x0000000000000000-mapping.dmp