Analysis
- max time kernel
151s - max time network
120s - platform
windows7_x64 - resource
win7 - submitted
19/07/2020, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
gameover_0.0.0.27.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
gameover_0.0.0.27.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target gameover_0.0.0.27.vir.exe
- Size 321KB
- Sample200719-avwctjfpke
- SHA256 85c484e63143a822a269e0a5225d4e55f71db303647427ce3fc89cefaad9261a
- MD5 7d7f3e50879eaf40abc74c9d76791308
- SHA1 611abe30ecb7b86f1666c4b598457193c31aab74
- SHA512 6604aab5a2f8f8cff4b56e63ce8d37ec91aa64de3b2b5276a7bdbce8f99699af8eaf23dacc25eeee1ff11385c14474d9915d365d5d725aaac02a501e01d9e858
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 1492 gameover_0.0.0.27.vir.exe 1492 gameover_0.0.0.27.vir.exe - Executes dropped EXE 1 IoCs
pid Process 276 uciwa.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1492 set thread context of 1056 1492 gameover_0.0.0.27.vir.exe 25 - Deletes itself 1 IoCs
pid Process 1056 cmd.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" gameover_0.0.0.27.vir.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy gameover_0.0.0.27.vir.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run uciwa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{B32BE588-FA87-AD4A-B43F-706FBDDA5372} = "C:\\Users\\Admin\\AppData\\Roaming\\Huiza\\uciwa.exe" uciwa.exe - Suspicious use of UnmapMainImage 2 IoCs
pid Process 1492 gameover_0.0.0.27.vir.exe 276 uciwa.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSecurityPrivilege 1492 gameover_0.0.0.27.vir.exe Token: SeSecurityPrivilege 1492 gameover_0.0.0.27.vir.exe Token: SeSecurityPrivilege 1492 gameover_0.0.0.27.vir.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1492 wrote to memory of 276 1492 gameover_0.0.0.27.vir.exe 24 PID 1492 wrote to memory of 276 1492 gameover_0.0.0.27.vir.exe 24 PID 1492 wrote to memory of 276 1492 gameover_0.0.0.27.vir.exe 24 PID 1492 wrote to memory of 276 1492 gameover_0.0.0.27.vir.exe 24 PID 276 wrote to memory of 1092 276 uciwa.exe 18 PID 276 wrote to memory of 1092 276 uciwa.exe 18 PID 276 wrote to memory of 1092 276 uciwa.exe 18 PID 276 wrote to memory of 1092 276 uciwa.exe 18 PID 276 wrote to memory of 1092 276 uciwa.exe 18 PID 276 wrote to memory of 1184 276 uciwa.exe 19 PID 276 wrote to memory of 1184 276 uciwa.exe 19 PID 276 wrote to memory of 1184 276 uciwa.exe 19 PID 276 wrote to memory of 1184 276 uciwa.exe 19 PID 276 wrote to memory of 1184 276 uciwa.exe 19 PID 276 wrote to memory of 1228 276 uciwa.exe 20 PID 276 wrote to memory of 1228 276 uciwa.exe 20 PID 276 wrote to memory of 1228 276 uciwa.exe 20 PID 276 wrote to memory of 1228 276 uciwa.exe 20 PID 276 wrote to memory of 1228 276 uciwa.exe 20 PID 276 wrote to memory of 1492 276 uciwa.exe 23 PID 276 wrote to memory of 1492 276 uciwa.exe 23 PID 276 wrote to memory of 1492 276 uciwa.exe 23 PID 276 wrote to memory of 1492 276 uciwa.exe 23 PID 276 wrote to memory of 1492 276 uciwa.exe 23 PID 1492 wrote to memory of 1056 1492 gameover_0.0.0.27.vir.exe 25 PID 1492 wrote to memory of 1056 1492 gameover_0.0.0.27.vir.exe 25 PID 1492 wrote to memory of 1056 1492 gameover_0.0.0.27.vir.exe 25 PID 1492 wrote to memory of 1056 1492 gameover_0.0.0.27.vir.exe 25 PID 1492 wrote to memory of 1056 1492 gameover_0.0.0.27.vir.exe 25 PID 1492 wrote to memory of 1056 1492 gameover_0.0.0.27.vir.exe 25 PID 1492 wrote to memory of 1056 1492 gameover_0.0.0.27.vir.exe 25 PID 1492 wrote to memory of 1056 1492 gameover_0.0.0.27.vir.exe 25 PID 1492 wrote to memory of 1056 1492 gameover_0.0.0.27.vir.exe 25 - Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe 276 uciwa.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1092
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1184
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\gameover_0.0.0.27.vir.exe"C:\Users\Admin\AppData\Local\Temp\gameover_0.0.0.27.vir.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Roaming\Huiza\uciwa.exe"C:\Users\Admin\AppData\Roaming\Huiza\uciwa.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:276
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp32ed6027.bat"3⤵
- Deletes itself
PID:1056
-
-