63ba84423a4d3c8728b3fab4588eed5145889b98c3d070a5dbfcbbed0be29e9f

Analysis

max time kernel
150s
max time network
117s
platform
windows10_x64
resource
win10
submitted
19-07-2020 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zeus 1_1.2.7.12.vir.exe
Size

120KB
MD5

a47eff79ada6f8e8e14c9f0ace1e0f69
SHA1

c52d54245552e6df1572e3b64abcafa8c133df10
SHA256

63ba84423a4d3c8728b3fab4588eed5145889b98c3d070a5dbfcbbed0be29e9f
SHA512

61df678dcec198f390025a76a2a8c16daf80a855d36b17c6aee7ef9de08eaf852fab2a321877f6597ef2cbfbe02dabb13a8a2cfe529b6b8aee56aaf627d6156b

Score

10^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

zeus 1_1.2.7.12.vir.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3612	zeus 1_1.2.7.12.vir.exe
Token: SeRestorePrivilege	1508	WerFault.exe
Token: SeBackupPrivilege	1508	WerFault.exe
Token: SeDebugPrivilege	1508	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1508 3612 WerFault.exe zeus 1_1.2.7.12.vir.exe
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1508 created 3612 1508 WerFault.exe zeus 1_1.2.7.12.vir.exe

pid	pid_target	process	target process
1508	3612	WerFault.exe	zeus 1_1.2.7.12.vir.exe

description	pid	process	target process
PID 1508 created 3612	1508	WerFault.exe	zeus 1_1.2.7.12.vir.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe
1508	WerFault.exe

Drops file in System32 directory 1 IoCs

Processes:

zeus 1_1.2.7.12.vir.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\lowsec\user.ds zeus 1_1.2.7.12.vir.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\lowsec\user.ds	zeus 1_1.2.7.12.vir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

zeus 1_1.2.7.12.vir.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\software\microsoft\internet explorer\main	zeus 1_1.2.7.12.vir.exe

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.7.12.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.7.12.vir.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Drops file in System32 directory
- Modifies Internet Explorer settings
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 852
2⤵
- Suspicious use of AdjustPrivilegeToken
- Program crash
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-1-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/1508-3-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/3612-0-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download