e4cd3a3bbf851aea2645ff32eeb8fbe177b79bf8149737c52acb413b2ff13eb6

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7
submitted
19/07/2020, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uncategorized_2.1.1.2.vir.exe
Size 162KB
Sample200719-krkad15d1e
SHA256 e4cd3a3bbf851aea2645ff32eeb8fbe177b79bf8149737c52acb413b2ff13eb6
MD5 749cc8984f142b082ab14fe4c86ee396
SHA1 fa83af3da50c64241bfaa31b91c735e6f9a43b2d
SHA512 c23b36f3dfe682fd04427a63c0fecfb486bb5c7e03706fbbe81487dd9a3f302fff9aa8076d45eecf3bfedd32b38b05fb76e23e8b2ef298d70dae059ce307a0f5
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	608	uncategorized_2.1.1.2.vir.exe
Token: SeSecurityPrivilege	608	uncategorized_2.1.1.2.vir.exe
Token: SeSecurityPrivilege	608	uncategorized_2.1.1.2.vir.exe
Token: SeManageVolumePrivilege	1004	WinMail.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 316	608	uncategorized_2.1.1.2.vir.exe	24
PID 608 wrote to memory of 316	608	uncategorized_2.1.1.2.vir.exe	24
PID 608 wrote to memory of 316	608	uncategorized_2.1.1.2.vir.exe	24
PID 608 wrote to memory of 316	608	uncategorized_2.1.1.2.vir.exe	24
PID 316 wrote to memory of 1084	316	teokp.exe	18
PID 316 wrote to memory of 1084	316	teokp.exe	18
PID 316 wrote to memory of 1084	316	teokp.exe	18
PID 316 wrote to memory of 1084	316	teokp.exe	18
PID 316 wrote to memory of 1084	316	teokp.exe	18
PID 316 wrote to memory of 1140	316	teokp.exe	19
PID 316 wrote to memory of 1140	316	teokp.exe	19
PID 316 wrote to memory of 1140	316	teokp.exe	19
PID 316 wrote to memory of 1140	316	teokp.exe	19
PID 316 wrote to memory of 1140	316	teokp.exe	19
PID 316 wrote to memory of 1208	316	teokp.exe	20
PID 316 wrote to memory of 1208	316	teokp.exe	20
PID 316 wrote to memory of 1208	316	teokp.exe	20
PID 316 wrote to memory of 1208	316	teokp.exe	20
PID 316 wrote to memory of 1208	316	teokp.exe	20
PID 316 wrote to memory of 608	316	teokp.exe	23
PID 316 wrote to memory of 608	316	teokp.exe	23
PID 316 wrote to memory of 608	316	teokp.exe	23
PID 316 wrote to memory of 608	316	teokp.exe	23
PID 316 wrote to memory of 608	316	teokp.exe	23
PID 316 wrote to memory of 1004	316	teokp.exe	25
PID 316 wrote to memory of 1004	316	teokp.exe	25
PID 316 wrote to memory of 1004	316	teokp.exe	25
PID 608 wrote to memory of 1900	608	uncategorized_2.1.1.2.vir.exe	26
PID 608 wrote to memory of 1900	608	uncategorized_2.1.1.2.vir.exe	26
PID 608 wrote to memory of 1900	608	uncategorized_2.1.1.2.vir.exe	26
PID 608 wrote to memory of 1900	608	uncategorized_2.1.1.2.vir.exe	26
PID 608 wrote to memory of 1900	608	uncategorized_2.1.1.2.vir.exe	26
PID 608 wrote to memory of 1900	608	uncategorized_2.1.1.2.vir.exe	26
PID 608 wrote to memory of 1900	608	uncategorized_2.1.1.2.vir.exe	26
PID 608 wrote to memory of 1900	608	uncategorized_2.1.1.2.vir.exe	26
PID 608 wrote to memory of 1900	608	uncategorized_2.1.1.2.vir.exe	26
PID 316 wrote to memory of 1216	316	teokp.exe	28
PID 316 wrote to memory of 1216	316	teokp.exe	28
PID 316 wrote to memory of 1216	316	teokp.exe	28
PID 316 wrote to memory of 1216	316	teokp.exe	28
PID 316 wrote to memory of 1216	316	teokp.exe	28
PID 316 wrote to memory of 2040	316	teokp.exe	29
PID 316 wrote to memory of 2040	316	teokp.exe	29
PID 316 wrote to memory of 2040	316	teokp.exe	29
PID 316 wrote to memory of 2040	316	teokp.exe	29
PID 316 wrote to memory of 2040	316	teokp.exe	29
PID 316 wrote to memory of 676	316	teokp.exe	30
PID 316 wrote to memory of 676	316	teokp.exe	30
PID 316 wrote to memory of 676	316	teokp.exe	30
PID 316 wrote to memory of 676	316	teokp.exe	30
PID 316 wrote to memory of 676	316	teokp.exe	30

Executes dropped EXE 1 IoCs

pid	Process
316	teokp.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe
316	teokp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1004	WinMail.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 608 set thread context of 1900	608	uncategorized_2.1.1.2.vir.exe	26

Deletes itself 1 IoCs

pid	Process
1900	cmd.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\75363880-00000001.eml:OECustomProperty	WinMail.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run	teokp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{82A46DA8-515A-65A3-7985-9AF062608FC2} = "C:\\Users\\Admin\\AppData\\Roaming\\Tyywne\\teokp.exe"	teokp.exe

Loads dropped DLL 2 IoCs

pid	Process
608	uncategorized_2.1.1.2.vir.exe
608	uncategorized_2.1.1.2.vir.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1004	WinMail.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1004	WinMail.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy	uncategorized_2.1.1.2.vir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	uncategorized_2.1.1.2.vir.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1084

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1140

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\uncategorized_2.1.1.2.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\uncategorized_2.1.1.2.vir.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  PID:608
- - C:\Users\Admin\AppData\Roaming\Tyywne\teokp.exe
    "C:\Users\Admin\AppData\Roaming\Tyywne\teokp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Adds Run key to start application
    PID:316
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp3ae3351d.bat"
    3⤵
    - Deletes itself
    PID:1900

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of SendNotifyMessage
PID:1004

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1216

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2040

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-5-0x0000000003880000-0x0000000003980000-memory.dmp

Download

memory/1004-7-0x0000000003880000-0x0000000003A80000-memory.dmp

Download

memory/1004-9-0x0000000003880000-0x0000000003980000-memory.dmp

Download

memory/1004-10-0x0000000003880000-0x0000000003A80000-memory.dmp

Download

memory/1004-11-0x0000000003980000-0x0000000003A80000-memory.dmp

Download

memory/1004-15-0x0000000003AE0000-0x0000000003AE2000-memory.dmp

Download

memory/1004-16-0x0000000003AF0000-0x0000000003AF2000-memory.dmp

Download

memory/1004-17-0x0000000003AD0000-0x0000000003AD2000-memory.dmp

Download

memory/1004-18-0x0000000003EA0000-0x0000000003EA2000-memory.dmp

Download

memory/1004-19-0x0000000003F00000-0x0000000003F02000-memory.dmp

Download

memory/1004-20-0x0000000003D00000-0x0000000003D02000-memory.dmp

Download

memory/1004-21-0x0000000003AE0000-0x0000000003AE2000-memory.dmp

Download

memory/1004-22-0x0000000003EA0000-0x0000000003EA2000-memory.dmp

Download

memory/1004-23-0x0000000004A00000-0x0000000004A02000-memory.dmp

Download

memory/1004-24-0x0000000004A10000-0x0000000004A12000-memory.dmp

Download

memory/1004-25-0x0000000004AA0000-0x0000000004AA2000-memory.dmp

Download

memory/1004-26-0x0000000004AB0000-0x0000000004AB2000-memory.dmp

Download

memory/1004-27-0x0000000004AC0000-0x0000000004AC2000-memory.dmp

Download

memory/1004-28-0x0000000004CC0000-0x0000000004CC2000-memory.dmp

Download

memory/1004-29-0x0000000004CD0000-0x0000000004CD2000-memory.dmp

Download

memory/1004-30-0x0000000003F20000-0x0000000003F22000-memory.dmp

Download

memory/1004-31-0x0000000003F40000-0x0000000003F42000-memory.dmp

Download

memory/1004-32-0x0000000003CE0000-0x0000000003CE2000-memory.dmp

Download

memory/1004-33-0x0000000003CF0000-0x0000000003CF2000-memory.dmp

Download

memory/1004-34-0x0000000003E90000-0x0000000003E92000-memory.dmp

Download

memory/1004-35-0x0000000003F00000-0x0000000003F02000-memory.dmp

Download

memory/1004-36-0x0000000003B40000-0x0000000003B42000-memory.dmp

Download

memory/1004-37-0x0000000003ED0000-0x0000000003ED2000-memory.dmp

Download

memory/1004-38-0x0000000003F20000-0x0000000003F22000-memory.dmp

Download

memory/1004-39-0x0000000004920000-0x0000000004922000-memory.dmp

Download

memory/1004-40-0x0000000004CE0000-0x0000000004CE2000-memory.dmp

Download

memory/1004-41-0x0000000004930000-0x0000000004932000-memory.dmp

Download

memory/1004-42-0x0000000004AD0000-0x0000000004AD2000-memory.dmp

Download

memory/1004-43-0x0000000004940000-0x0000000004942000-memory.dmp

Download

memory/1004-44-0x0000000004AC0000-0x0000000004AC2000-memory.dmp

Download

memory/1004-45-0x0000000004960000-0x0000000004962000-memory.dmp

Download

memory/1004-46-0x0000000004AB0000-0x0000000004AB2000-memory.dmp

Download

memory/1004-47-0x0000000004AA0000-0x0000000004AA2000-memory.dmp

Download

memory/1004-48-0x0000000004A00000-0x0000000004A02000-memory.dmp

Download

memory/1004-49-0x0000000003B60000-0x0000000003B62000-memory.dmp

Download

memory/1004-50-0x0000000003880000-0x0000000003980000-memory.dmp

Download

memory/1004-52-0x0000000002390000-0x00000000023A0000-memory.dmp

Download

memory/1004-58-0x0000000001FD0000-0x0000000001FE0000-memory.dmp

Download

memory/1900-64-0x0000000000050000-0x0000000000077000-memory.dmp

Download