6680a475582eb69a5bf028ebe5ae4ebd808e5da535336f0b0fe8a7ae6fe77a60

Analysis

max time kernel
127s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zeus 1_1.2.7.21.vir.exe
Size

108KB
MD5

03abab3227f438e805e72e4c8325086a
SHA1

5884b783f31cbfaa7726ce018b23eaa6ba124692
SHA256

6680a475582eb69a5bf028ebe5ae4ebd808e5da535336f0b0fe8a7ae6fe77a60
SHA512

97c0c455c58ec33e52d736749f5b718264d9963009d788c06813b7198b14d0e44f6f34609134992ee0452e1216d69068af3169babb2e98f9e41dab2262322fe6

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1896 created 1356 1896 WerFault.exe zeus 1_1.2.7.21.vir.exe

description	pid	process	target process
PID 1896 created 1356	1896	WerFault.exe	zeus 1_1.2.7.21.vir.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe
1896	WerFault.exe

Drops file in System32 directory 1 IoCs

Processes:

zeus 1_1.2.7.21.vir.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\lowsec\user.ds zeus 1_1.2.7.21.vir.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\lowsec\user.ds	zeus 1_1.2.7.21.vir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

zeus 1_1.2.7.21.vir.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\software\microsoft\internet explorer\main	zeus 1_1.2.7.21.vir.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

zeus 1_1.2.7.21.vir.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1356	zeus 1_1.2.7.21.vir.exe
Token: SeRestorePrivilege	1896	WerFault.exe
Token: SeBackupPrivilege	1896	WerFault.exe
Token: SeDebugPrivilege	1896	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1896 1356 WerFault.exe zeus 1_1.2.7.21.vir.exe

pid	pid_target	process	target process
1896	1356	WerFault.exe	zeus 1_1.2.7.21.vir.exe

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.7.21.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.7.21.vir.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 844
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Program crash
PID:1896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-0-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/1896-1-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/1896-2-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download