Analysis
-
max time kernel
150s -
max time network
67s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
19-07-2020 19:35
Static task
static1
Behavioral task
behavioral1
Sample
vmzeus_3.2.9.1.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vmzeus_3.2.9.1.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
vmzeus_3.2.9.1.vir.exe
-
Size
228KB
-
MD5
c4e45a5e13dbafa2e5ec5dae4a998303
-
SHA1
08f432ece582f4eaf84dab3c0fd8dd5e6e9f1555
-
SHA256
5ffa867ac4050f771867737d104be2bf68ec9e51638b5005a6cd013ddbaba085
-
SHA512
9612b6efbdcd0d4757aebb11228f7311a3d123104e772d98ea81d872d2e10f1a6a0a774504ef2da411e14ce1e1b173d64fddf165b202b3a82bf593da763aceb0
Score
8/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SyncMicrosoft.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\Currentversion\Run SyncMicrosoft.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\{D5AB7F2E-DC1E-A095-CB32-ECCCBB25A5EF} = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SyncMicrosoft.exe" SyncMicrosoft.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
vmzeus_3.2.9.1.vir.exeSyncMicrosoft.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\WINE vmzeus_3.2.9.1.vir.exe Key opened \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\WINE SyncMicrosoft.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
vmzeus_3.2.9.1.vir.exedescription pid process target process PID 428 wrote to memory of 588 428 vmzeus_3.2.9.1.vir.exe SyncMicrosoft.exe PID 428 wrote to memory of 588 428 vmzeus_3.2.9.1.vir.exe SyncMicrosoft.exe PID 428 wrote to memory of 588 428 vmzeus_3.2.9.1.vir.exe SyncMicrosoft.exe PID 428 wrote to memory of 1008 428 vmzeus_3.2.9.1.vir.exe cmd.exe PID 428 wrote to memory of 1008 428 vmzeus_3.2.9.1.vir.exe cmd.exe PID 428 wrote to memory of 1008 428 vmzeus_3.2.9.1.vir.exe cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
SyncMicrosoft.exepid process 588 SyncMicrosoft.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SyncMicrosoft.exepid process 588 SyncMicrosoft.exe -
Suspicious behavior: EnumeratesProcesses 112 IoCs
Processes:
SyncMicrosoft.exepid process 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe 588 SyncMicrosoft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.9.1.vir.exe"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.9.1.vir.exe"1⤵
- Identifies Wine through registry keys
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SyncMicrosoft.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SyncMicrosoft.exe"2⤵
- Adds Run key to start application
- Identifies Wine through registry keys
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp391f7743.bat"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp391f7743.bat
-
C:\Users\Admin\AppData\Roaming\Microsoft\SyncMicrosoft.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\SyncMicrosoft.exe
-
memory/588-0-0x0000000000000000-mapping.dmp
-
memory/1008-3-0x0000000000000000-mapping.dmp