Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:38
Static task
static1
Behavioral task
behavioral1
Sample
tasks_137.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tasks_137.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
tasks_137.vir.exe
-
Size
137KB
-
MD5
54a79ec504774ba90fdb75e361ab8273
-
SHA1
5f9a3d9c66b2a77fc81d6e9b330aa5a8e87b00e4
-
SHA256
970720560dfd7943751a84cc89c6361800abb98cb23e9daa66c459cacebd3e92
-
SHA512
00ab17a16a1ca2dab7ea0a0f65d81945e456a4b0653aa49942dfe67b4916491f4b6885b59fffc35adc756b795526ba1a6ef77a48185c917f71702c83ebeb9275
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
winsec.exeohhuzyh.exeohhuzyh.exepid process 1420 winsec.exe 452 ohhuzyh.exe 836 ohhuzyh.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
ohhuzyh.exepid process 836 ohhuzyh.exe 836 ohhuzyh.exe 836 ohhuzyh.exe 836 ohhuzyh.exe 836 ohhuzyh.exe 836 ohhuzyh.exe 836 ohhuzyh.exe 836 ohhuzyh.exe 836 ohhuzyh.exe 836 ohhuzyh.exe 836 ohhuzyh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 736 cmd.exe -
Drops file in Windows directory 1 IoCs
Processes:
tasks_137.vir.exedescription ioc process File created C:\Windows\Tasks\Security Center Update - 3297039994.job tasks_137.vir.exe -
Loads dropped DLL 1 IoCs
Processes:
tasks_137.vir.exepid process 608 tasks_137.vir.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
tasks_137.vir.exeohhuzyh.exeohhuzyh.exedescription pid process target process PID 608 wrote to memory of 452 608 tasks_137.vir.exe ohhuzyh.exe PID 608 wrote to memory of 452 608 tasks_137.vir.exe ohhuzyh.exe PID 608 wrote to memory of 452 608 tasks_137.vir.exe ohhuzyh.exe PID 608 wrote to memory of 452 608 tasks_137.vir.exe ohhuzyh.exe PID 452 wrote to memory of 836 452 ohhuzyh.exe ohhuzyh.exe PID 452 wrote to memory of 836 452 ohhuzyh.exe ohhuzyh.exe PID 452 wrote to memory of 836 452 ohhuzyh.exe ohhuzyh.exe PID 452 wrote to memory of 836 452 ohhuzyh.exe ohhuzyh.exe PID 452 wrote to memory of 836 452 ohhuzyh.exe ohhuzyh.exe PID 452 wrote to memory of 836 452 ohhuzyh.exe ohhuzyh.exe PID 452 wrote to memory of 836 452 ohhuzyh.exe ohhuzyh.exe PID 452 wrote to memory of 836 452 ohhuzyh.exe ohhuzyh.exe PID 452 wrote to memory of 836 452 ohhuzyh.exe ohhuzyh.exe PID 452 wrote to memory of 836 452 ohhuzyh.exe ohhuzyh.exe PID 608 wrote to memory of 736 608 tasks_137.vir.exe cmd.exe PID 608 wrote to memory of 736 608 tasks_137.vir.exe cmd.exe PID 608 wrote to memory of 736 608 tasks_137.vir.exe cmd.exe PID 608 wrote to memory of 736 608 tasks_137.vir.exe cmd.exe PID 836 wrote to memory of 1796 836 ohhuzyh.exe ctfmon.exe PID 836 wrote to memory of 1796 836 ohhuzyh.exe ctfmon.exe PID 836 wrote to memory of 1796 836 ohhuzyh.exe ctfmon.exe PID 836 wrote to memory of 1796 836 ohhuzyh.exe ctfmon.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ohhuzyh.exepid process 836 ohhuzyh.exe 836 ohhuzyh.exe -
Processes:
ohhuzyh.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main ohhuzyh.exe -
Drops file in System32 directory 2 IoCs
Processes:
tasks_137.vir.exedescription ioc process File created C:\Windows\SysWOW64\winsec.exe tasks_137.vir.exe File opened for modification C:\Windows\SysWOW64\winsec.exe tasks_137.vir.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ohhuzyh.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ohhuzyh.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\1860988234 = "C:\\Users\\Admin\\AppData\\Roaming\\Ciygyc\\ohhuzyh.exe" ohhuzyh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ohhuzyh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1860988234 = "C:\\Users\\Admin\\AppData\\Roaming\\Ciygyc\\ohhuzyh.exe" ohhuzyh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tasks_137.vir.exe"C:\Users\Admin\AppData\Local\Temp\tasks_137.vir.exe"1⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\Ciygyc\ohhuzyh.exe"C:\Users\Admin\AppData\Roaming\Ciygyc\ohhuzyh.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Ciygyc\ohhuzyh.exe"C:\Users\Admin\AppData\Roaming\Ciygyc\ohhuzyh.exe" -child3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\ctfmon.exectfmon.exe4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp2e1390b8.bat"2⤵
- Deletes itself
-
C:\Windows\SysWOW64\winsec.exe"C:\Windows\SysWOW64\winsec.exe" -service "C:\Users\Admin\AppData\Roaming\Ciygyc\ohhuzyh.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2e1390b8.bat
-
C:\Users\Admin\AppData\Roaming\Ciygyc\ohhuzyh.exe
-
C:\Users\Admin\AppData\Roaming\Ciygyc\ohhuzyh.exe
-
C:\Users\Admin\AppData\Roaming\Ciygyc\ohhuzyh.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FAHCQLL5.txt
-
C:\Windows\SysWOW64\winsec.exe
-
C:\Windows\SysWOW64\winsec.exe
-
\Users\Admin\AppData\Roaming\Ciygyc\ohhuzyh.exe
-
memory/452-4-0x0000000000000000-mapping.dmp
-
memory/736-13-0x0000000000000000-mapping.dmp
-
memory/836-11-0x0000000000000000-mapping.dmp
-
memory/836-10-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/836-9-0x00000000001D0000-0x00000000001D0002-memory.dmpFilesize
2B
-
memory/836-7-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/836-6-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1796-15-0x0000000000000000-mapping.dmp