Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10_x64 -
resource
win10 -
submitted
19-07-2020 17:24
Static task
static1
Behavioral task
behavioral1
Sample
tasks_200.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tasks_200.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
tasks_200.vir.exe
-
Size
327KB
-
MD5
804bedbfe6ecd3d1e07b2b19ba6db60c
-
SHA1
9d37abde24f9781638bc7de50b484389804bd728
-
SHA256
afe94e4b048e0030099c67010dce2fd79461eb050dcf1a441b3d5486ce8821ca
-
SHA512
eb45fa0e60ca37466493333d9cfaf8c2502ef9c120000e9e91510775fffb16b76cafa1d649887f5d41a65df966198bb805be44307586e46653a8f31df3713b3f
Score
8/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
rinypef.exeExplorer.EXEwinsec32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Zucuutluzasye = "C:\\Users\\Admin\\AppData\\Roaming\\Zesihiel\\rinypef.exe" rinypef.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zucuutluzasye = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zesihiel\\rinypef.exe\"" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zucuutluzasye = "C:\\Users\\Admin\\AppData\\Roaming\\Zesihiel\\rinypef.exe" rinypef.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run rinypef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zucuutluzasye = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zesihiel\\rinypef.exe\"" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run winsec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Zucuutluzasye = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zesihiel\\rinypef.exe\"" winsec32.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rinypef.exe -
Drops file in Windows directory 1 IoCs
Processes:
tasks_200.vir.exedescription ioc process File created C:\Windows\Tasks\Security Center Update - 2806415454.job tasks_200.vir.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
tasks_200.vir.exerinypef.exerinypef.exedescription pid process target process PID 3868 wrote to memory of 3852 3868 tasks_200.vir.exe rinypef.exe PID 3868 wrote to memory of 3852 3868 tasks_200.vir.exe rinypef.exe PID 3868 wrote to memory of 3852 3868 tasks_200.vir.exe rinypef.exe PID 3868 wrote to memory of 3240 3868 tasks_200.vir.exe cmd.exe PID 3868 wrote to memory of 3240 3868 tasks_200.vir.exe cmd.exe PID 3868 wrote to memory of 3240 3868 tasks_200.vir.exe cmd.exe PID 3852 wrote to memory of 3020 3852 rinypef.exe Explorer.EXE PID 3852 wrote to memory of 3956 3852 rinypef.exe rinypef.exe PID 3852 wrote to memory of 3956 3852 rinypef.exe rinypef.exe PID 3852 wrote to memory of 3956 3852 rinypef.exe rinypef.exe PID 3852 wrote to memory of 3020 3852 rinypef.exe Explorer.EXE PID 3852 wrote to memory of 3020 3852 rinypef.exe Explorer.EXE PID 3852 wrote to memory of 3020 3852 rinypef.exe Explorer.EXE PID 3852 wrote to memory of 3020 3852 rinypef.exe Explorer.EXE PID 3852 wrote to memory of 3020 3852 rinypef.exe Explorer.EXE PID 3852 wrote to memory of 3020 3852 rinypef.exe Explorer.EXE PID 3956 wrote to memory of 3000 3956 rinypef.exe ctfmon.exe PID 3956 wrote to memory of 3000 3956 rinypef.exe ctfmon.exe PID 3956 wrote to memory of 3000 3956 rinypef.exe ctfmon.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Drops file in System32 directory 2 IoCs
Processes:
tasks_200.vir.exedescription ioc process File created C:\Windows\SysWOW64\winsec32.exe tasks_200.vir.exe File opened for modification C:\Windows\SysWOW64\winsec32.exe tasks_200.vir.exe -
Executes dropped EXE 3 IoCs
Processes:
winsec32.exerinypef.exerinypef.exepid process 4048 winsec32.exe 3852 rinypef.exe 3956 rinypef.exe -
Suspicious behavior: EnumeratesProcesses 104 IoCs
Processes:
rinypef.exerinypef.exepid process 3852 rinypef.exe 3852 rinypef.exe 3852 rinypef.exe 3852 rinypef.exe 3852 rinypef.exe 3852 rinypef.exe 3852 rinypef.exe 3852 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe 3956 rinypef.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
rinypef.exepid process 3956 rinypef.exe 3956 rinypef.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\tasks_200.vir.exe"C:\Users\Admin\AppData\Local\Temp\tasks_200.vir.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\Zesihiel\rinypef.exe"C:\Users\Admin\AppData\Roaming\Zesihiel\rinypef.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Zesihiel\rinypef.exe"C:\Users\Admin\AppData\Roaming\Zesihiel\rinypef.exe" -child4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ctfmon.exectfmon.exe5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp980edbd3.bat"3⤵
-
C:\Windows\SysWOW64\winsec32.exe"C:\Windows\SysWOW64\winsec32.exe" -service "C:\Users\Admin\AppData\Roaming\Zesihiel\rinypef.exe"1⤵
- Adds Run key to start application
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\H0BPI275.cookie
-
C:\Users\Admin\AppData\Local\Temp\tmp980edbd3.bat
-
C:\Users\Admin\AppData\Roaming\Zesihiel\rinypef.exe
-
C:\Users\Admin\AppData\Roaming\Zesihiel\rinypef.exe
-
C:\Users\Admin\AppData\Roaming\Zesihiel\rinypef.exe
-
C:\Windows\SysWOW64\winsec32.exe
-
C:\Windows\SysWOW64\winsec32.exe
-
memory/3000-15-0x0000000000000000-mapping.dmp
-
memory/3020-6-0x0000000002FF0000-0x0000000002FF1000-memory.dmpFilesize
4KB
-
memory/3240-5-0x0000000000000000-mapping.dmp
-
memory/3852-3-0x0000000000000000-mapping.dmp
-
memory/3956-7-0x0000000000000000-mapping.dmp