Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:52
Static task
static1
Behavioral task
behavioral1
Sample
tasks_197.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tasks_197.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
tasks_197.vir.exe
-
Size
226KB
-
MD5
8ee9fb84989bd2b845327e7ec0f8947e
-
SHA1
2c434799deba0dce282a3c9eb700d441488cca22
-
SHA256
dd7e225d33efa7642ebf94d87194fee6d9bafa89cd8ad6b05a5e14ecf1094190
-
SHA512
6ca3ba37f26978ab1d8e00137623ba9675194a60d61c472d985fef7c154abb117f5957a36d4bf04f3940413985b6b9e952e7f3e945365b1a039aae3e2abe644b
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
winsec32.exetiqisux.exetiqisux.exepid process 272 winsec32.exe 760 tiqisux.exe 1108 tiqisux.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
tasks_197.vir.exedescription ioc process File created C:\Windows\Tasks\Security Center Update - 3763340463.job tasks_197.vir.exe -
Loads dropped DLL 1 IoCs
Processes:
tasks_197.vir.exepid process 1448 tasks_197.vir.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
tasks_197.vir.exetiqisux.exetiqisux.exedescription pid process target process PID 1448 wrote to memory of 760 1448 tasks_197.vir.exe tiqisux.exe PID 1448 wrote to memory of 760 1448 tasks_197.vir.exe tiqisux.exe PID 1448 wrote to memory of 760 1448 tasks_197.vir.exe tiqisux.exe PID 1448 wrote to memory of 760 1448 tasks_197.vir.exe tiqisux.exe PID 760 wrote to memory of 1312 760 tiqisux.exe Explorer.EXE PID 760 wrote to memory of 1108 760 tiqisux.exe tiqisux.exe PID 760 wrote to memory of 1108 760 tiqisux.exe tiqisux.exe PID 760 wrote to memory of 1108 760 tiqisux.exe tiqisux.exe PID 760 wrote to memory of 1108 760 tiqisux.exe tiqisux.exe PID 760 wrote to memory of 1312 760 tiqisux.exe Explorer.EXE PID 760 wrote to memory of 1312 760 tiqisux.exe Explorer.EXE PID 760 wrote to memory of 1312 760 tiqisux.exe Explorer.EXE PID 760 wrote to memory of 1312 760 tiqisux.exe Explorer.EXE PID 760 wrote to memory of 1312 760 tiqisux.exe Explorer.EXE PID 760 wrote to memory of 1312 760 tiqisux.exe Explorer.EXE PID 1448 wrote to memory of 1820 1448 tasks_197.vir.exe cmd.exe PID 1448 wrote to memory of 1820 1448 tasks_197.vir.exe cmd.exe PID 1448 wrote to memory of 1820 1448 tasks_197.vir.exe cmd.exe PID 1448 wrote to memory of 1820 1448 tasks_197.vir.exe cmd.exe PID 1108 wrote to memory of 1868 1108 tiqisux.exe ctfmon.exe PID 1108 wrote to memory of 1868 1108 tiqisux.exe ctfmon.exe PID 1108 wrote to memory of 1868 1108 tiqisux.exe ctfmon.exe PID 1108 wrote to memory of 1868 1108 tiqisux.exe ctfmon.exe -
Suspicious behavior: EnumeratesProcesses 84 IoCs
Processes:
tiqisux.exetiqisux.exepid process 760 tiqisux.exe 760 tiqisux.exe 760 tiqisux.exe 760 tiqisux.exe 760 tiqisux.exe 760 tiqisux.exe 760 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe 1108 tiqisux.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
tiqisux.exepid process 1108 tiqisux.exe 1108 tiqisux.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1820 cmd.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Drops file in System32 directory 2 IoCs
Processes:
tasks_197.vir.exedescription ioc process File created C:\Windows\SysWOW64\winsec32.exe tasks_197.vir.exe File opened for modification C:\Windows\SysWOW64\winsec32.exe tasks_197.vir.exe -
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
Explorer.EXEwinsec32.exetiqisux.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Houzinumgylogeo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ichituup\\tiqisux.exe\"" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Houzinumgylogeo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ichituup\\tiqisux.exe\"" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run winsec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Houzinumgylogeo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ichituup\\tiqisux.exe\"" winsec32.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tiqisux.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Houzinumgylogeo = "C:\\Users\\Admin\\AppData\\Roaming\\Ichituup\\tiqisux.exe" tiqisux.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run tiqisux.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Houzinumgylogeo = "C:\\Users\\Admin\\AppData\\Roaming\\Ichituup\\tiqisux.exe" tiqisux.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Processes:
tiqisux.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main tiqisux.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\tasks_197.vir.exe"C:\Users\Admin\AppData\Local\Temp\tasks_197.vir.exe"2⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\Ichituup\tiqisux.exe"C:\Users\Admin\AppData\Roaming\Ichituup\tiqisux.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Ichituup\tiqisux.exe"C:\Users\Admin\AppData\Roaming\Ichituup\tiqisux.exe" -child4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\ctfmon.exectfmon.exe5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp473c7fe0.bat"3⤵
- Deletes itself
-
C:\Windows\SysWOW64\winsec32.exe"C:\Windows\SysWOW64\winsec32.exe" -service "C:\Users\Admin\AppData\Roaming\Ichituup\tiqisux.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp473c7fe0.bat
-
C:\Users\Admin\AppData\Roaming\Ichituup\tiqisux.exe
-
C:\Users\Admin\AppData\Roaming\Ichituup\tiqisux.exe
-
C:\Users\Admin\AppData\Roaming\Ichituup\tiqisux.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4ITSCV3E.txt
-
C:\Windows\SysWOW64\winsec32.exe
-
C:\Windows\SysWOW64\winsec32.exe
-
\Users\Admin\AppData\Roaming\Ichituup\tiqisux.exe
-
memory/760-4-0x0000000000000000-mapping.dmp
-
memory/1108-7-0x0000000000000000-mapping.dmp
-
memory/1312-6-0x0000000003E30000-0x0000000003E31000-memory.dmpFilesize
4KB
-
memory/1820-14-0x0000000000000000-mapping.dmp
-
memory/1868-15-0x0000000000000000-mapping.dmp