88303bec606c271a2db6fe1bb0945c7e79835203ff2d9ee629c1d9e3987ccaac

Analysis

max time kernel
152s
max time network
146s
platform
windows7_x64
resource
win7
submitted
19/07/2020, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uncategorized_0.0.0.1.vir.exe
Size 111KB
Sample200719-gdvt87asxe
SHA256 88303bec606c271a2db6fe1bb0945c7e79835203ff2d9ee629c1d9e3987ccaac
MD5 346e9d511e4c14e37bd6b6241637d0d1
SHA1 097e29c2e634d1f96cacc74d2b1df75274e0f42c
SHA512 8dec6307a8bbee69a5382f65689bfc3b0c37131141a53410b40ac23dad0bdc20ff9fb916eaea2cb246c9e46896500048d2190e64e2fba36d0f8a9d2b22318b74
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1596	WinMail.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1596	WinMail.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1596	WinMail.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy	uncategorized_0.0.0.1.vir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	uncategorized_0.0.0.1.vir.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	900	uncategorized_0.0.0.1.vir.exe
Token: SeSecurityPrivilege	900	uncategorized_0.0.0.1.vir.exe
Token: SeSecurityPrivilege	900	uncategorized_0.0.0.1.vir.exe
Token: SeManageVolumePrivilege	1596	WinMail.exe

Loads dropped DLL 2 IoCs

pid	Process
900	uncategorized_0.0.0.1.vir.exe
900	uncategorized_0.0.0.1.vir.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1104	900	uncategorized_0.0.0.1.vir.exe	24
PID 900 wrote to memory of 1104	900	uncategorized_0.0.0.1.vir.exe	24
PID 900 wrote to memory of 1104	900	uncategorized_0.0.0.1.vir.exe	24
PID 900 wrote to memory of 1104	900	uncategorized_0.0.0.1.vir.exe	24
PID 1104 wrote to memory of 1144	1104	opzoy.exe	18
PID 1104 wrote to memory of 1144	1104	opzoy.exe	18
PID 1104 wrote to memory of 1144	1104	opzoy.exe	18
PID 1104 wrote to memory of 1144	1104	opzoy.exe	18
PID 1104 wrote to memory of 1144	1104	opzoy.exe	18
PID 1104 wrote to memory of 1252	1104	opzoy.exe	19
PID 1104 wrote to memory of 1252	1104	opzoy.exe	19
PID 1104 wrote to memory of 1252	1104	opzoy.exe	19
PID 1104 wrote to memory of 1252	1104	opzoy.exe	19
PID 1104 wrote to memory of 1252	1104	opzoy.exe	19
PID 1104 wrote to memory of 1292	1104	opzoy.exe	20
PID 1104 wrote to memory of 1292	1104	opzoy.exe	20
PID 1104 wrote to memory of 1292	1104	opzoy.exe	20
PID 1104 wrote to memory of 1292	1104	opzoy.exe	20
PID 1104 wrote to memory of 1292	1104	opzoy.exe	20
PID 1104 wrote to memory of 900	1104	opzoy.exe	23
PID 1104 wrote to memory of 900	1104	opzoy.exe	23
PID 1104 wrote to memory of 900	1104	opzoy.exe	23
PID 1104 wrote to memory of 900	1104	opzoy.exe	23
PID 1104 wrote to memory of 900	1104	opzoy.exe	23
PID 1104 wrote to memory of 1596	1104	opzoy.exe	25
PID 1104 wrote to memory of 1596	1104	opzoy.exe	25
PID 1104 wrote to memory of 1596	1104	opzoy.exe	25
PID 900 wrote to memory of 1916	900	uncategorized_0.0.0.1.vir.exe	26
PID 900 wrote to memory of 1916	900	uncategorized_0.0.0.1.vir.exe	26
PID 900 wrote to memory of 1916	900	uncategorized_0.0.0.1.vir.exe	26
PID 900 wrote to memory of 1916	900	uncategorized_0.0.0.1.vir.exe	26
PID 900 wrote to memory of 1916	900	uncategorized_0.0.0.1.vir.exe	26
PID 900 wrote to memory of 1916	900	uncategorized_0.0.0.1.vir.exe	26
PID 900 wrote to memory of 1916	900	uncategorized_0.0.0.1.vir.exe	26
PID 900 wrote to memory of 1916	900	uncategorized_0.0.0.1.vir.exe	26
PID 900 wrote to memory of 1916	900	uncategorized_0.0.0.1.vir.exe	26
PID 1104 wrote to memory of 2028	1104	opzoy.exe	28
PID 1104 wrote to memory of 2028	1104	opzoy.exe	28
PID 1104 wrote to memory of 2028	1104	opzoy.exe	28
PID 1104 wrote to memory of 2028	1104	opzoy.exe	28
PID 1104 wrote to memory of 2028	1104	opzoy.exe	28
PID 1104 wrote to memory of 1116	1104	opzoy.exe	29
PID 1104 wrote to memory of 1116	1104	opzoy.exe	29
PID 1104 wrote to memory of 1116	1104	opzoy.exe	29
PID 1104 wrote to memory of 1116	1104	opzoy.exe	29
PID 1104 wrote to memory of 1116	1104	opzoy.exe	29
PID 1104 wrote to memory of 1616	1104	opzoy.exe	30
PID 1104 wrote to memory of 1616	1104	opzoy.exe	30
PID 1104 wrote to memory of 1616	1104	opzoy.exe	30
PID 1104 wrote to memory of 1616	1104	opzoy.exe	30
PID 1104 wrote to memory of 1616	1104	opzoy.exe	30
PID 1104 wrote to memory of 1880	1104	opzoy.exe	33
PID 1104 wrote to memory of 1880	1104	opzoy.exe	33
PID 1104 wrote to memory of 1880	1104	opzoy.exe	33
PID 1104 wrote to memory of 1880	1104	opzoy.exe	33
PID 1104 wrote to memory of 1880	1104	opzoy.exe	33
PID 1104 wrote to memory of 1652	1104	opzoy.exe	34
PID 1104 wrote to memory of 1652	1104	opzoy.exe	34
PID 1104 wrote to memory of 1652	1104	opzoy.exe	34
PID 1104 wrote to memory of 1652	1104	opzoy.exe	34
PID 1104 wrote to memory of 1652	1104	opzoy.exe	34

Executes dropped EXE 1 IoCs

pid	Process
1104	opzoy.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run	opzoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{4210C7A0-B3AB-067F-EA63-CB877F15BB8B} = "C:\\Users\\Admin\\AppData\\Roaming\\Tawoiw\\opzoy.exe"	opzoy.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe
1104	opzoy.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 1916	900	uncategorized_0.0.0.1.vir.exe	26

Deletes itself 1 IoCs

pid	Process
1916	cmd.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\54785C21-00000001.eml:OECustomProperty	WinMail.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1144

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1252

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1292
- C:\Users\Admin\AppData\Local\Temp\uncategorized_0.0.0.1.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\uncategorized_0.0.0.1.vir.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:900
- - C:\Users\Admin\AppData\Roaming\Tawoiw\opzoy.exe
    "C:\Users\Admin\AppData\Roaming\Tawoiw\opzoy.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0e3d50bf.bat"
    3⤵
    - Deletes itself
    PID:1916

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
- NTFS ADS
PID:1596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2028

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1116

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1616

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1880

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-5-0x00000000038A0000-0x00000000039A0000-memory.dmp

Download

memory/1596-7-0x00000000038A0000-0x0000000003AA0000-memory.dmp

Download

memory/1596-9-0x00000000038A0000-0x00000000039A0000-memory.dmp

Download

memory/1596-10-0x00000000038A0000-0x0000000003AA0000-memory.dmp

Download

memory/1596-11-0x00000000039A0000-0x0000000003AA0000-memory.dmp

Download

memory/1596-15-0x0000000003AD0000-0x0000000003AD2000-memory.dmp

Download

memory/1596-16-0x0000000003AE0000-0x0000000003AE2000-memory.dmp

Download

memory/1596-17-0x0000000003AF0000-0x0000000003AF2000-memory.dmp

Download

memory/1596-18-0x0000000003B40000-0x0000000003B42000-memory.dmp

Download

memory/1596-19-0x0000000003C90000-0x0000000003C92000-memory.dmp

Download

memory/1596-20-0x0000000003C70000-0x0000000003C72000-memory.dmp

Download

memory/1596-21-0x0000000003B40000-0x0000000003B42000-memory.dmp

Download

memory/1596-22-0x0000000003AE0000-0x0000000003AE2000-memory.dmp

Download

memory/1596-23-0x0000000003C70000-0x0000000003C72000-memory.dmp

Download

memory/1596-24-0x0000000003AE0000-0x0000000003AE2000-memory.dmp

Download

memory/1596-25-0x0000000003D70000-0x0000000003D72000-memory.dmp

Download

memory/1596-26-0x00000000041D0000-0x00000000041D2000-memory.dmp

Download

memory/1596-27-0x0000000004070000-0x0000000004072000-memory.dmp

Download

memory/1596-28-0x0000000004130000-0x0000000004132000-memory.dmp

Download

memory/1596-29-0x0000000003D70000-0x0000000003D72000-memory.dmp

Download

memory/1596-30-0x0000000003D70000-0x0000000003D72000-memory.dmp

Download

memory/1596-31-0x00000000045F0000-0x00000000045F2000-memory.dmp

Download

memory/1596-32-0x0000000004120000-0x0000000004122000-memory.dmp

Download

memory/1596-33-0x0000000004560000-0x0000000004562000-memory.dmp

Download

memory/1596-34-0x0000000003ED0000-0x0000000003ED2000-memory.dmp

Download

memory/1596-35-0x00000000041F0000-0x00000000041F2000-memory.dmp

Download

memory/1596-36-0x0000000004200000-0x0000000004202000-memory.dmp

Download

memory/1596-37-0x0000000004210000-0x0000000004212000-memory.dmp

Download

memory/1596-38-0x0000000004340000-0x0000000004342000-memory.dmp

Download

memory/1596-39-0x0000000004350000-0x0000000004352000-memory.dmp

Download

memory/1596-40-0x0000000003C60000-0x0000000003C62000-memory.dmp

Download

memory/1596-41-0x0000000003C50000-0x0000000003C52000-memory.dmp

Download

memory/1596-42-0x0000000003C80000-0x0000000003C82000-memory.dmp

Download

memory/1596-43-0x0000000003EB0000-0x0000000003EB2000-memory.dmp

Download

memory/1596-44-0x00000000041C0000-0x00000000041C2000-memory.dmp

Download

memory/1596-45-0x0000000003BB0000-0x0000000003BB2000-memory.dmp

Download

memory/1596-46-0x0000000003B60000-0x0000000003B62000-memory.dmp

Download

memory/1596-47-0x0000000004200000-0x0000000004202000-memory.dmp

Download

memory/1596-48-0x0000000004210000-0x0000000004212000-memory.dmp

Download

memory/1596-49-0x0000000004340000-0x0000000004342000-memory.dmp

Download

memory/1596-50-0x00000000038A0000-0x00000000039A0000-memory.dmp

Download

memory/1596-52-0x00000000023A0000-0x00000000023B0000-memory.dmp

Download

memory/1596-58-0x00000000020B0000-0x00000000020C0000-memory.dmp

Download

memory/1916-64-0x0000000000050000-0x0000000000077000-memory.dmp

Download