Analysis
- max time kernel
147s - max time network
127s - platform
windows7_x64 - resource
win7 - submitted
20/07/2020, 09:30
Static task
static1
Behavioral task
behavioral1
Sample
RV OFFER REF 571 - REF. INQUIRY NP17836.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RV OFFER REF 571 - REF. INQUIRY NP17836.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target RV OFFER REF 571 - REF. INQUIRY NP17836.exe
- Size 723KB
- Sample200720-nd29bc1s4x
- SHA256 1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a
- MD5 b659d359a6fafaf7954c78199552852e
- SHA1 027ce3b08fe9c0c47114d6711fb26551eba96a72
- SHA512 6699fc5fa65b322edb6ea59062b36deb2a33e481c608a49503c24d3479d7a1feed07ddcefdd9987e9943b5999125148c9330a1717db4f1e10a7377d4a6ef5689
- MD5 SHA1 SHA512
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1424 wrote to memory of 744 1424 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 24 PID 1424 wrote to memory of 744 1424 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 24 PID 1424 wrote to memory of 744 1424 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 24 PID 1424 wrote to memory of 744 1424 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 24 PID 1424 wrote to memory of 744 1424 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 24 PID 1424 wrote to memory of 744 1424 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 24 PID 1424 wrote to memory of 744 1424 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 24 PID 1320 wrote to memory of 1640 1320 Explorer.EXE 25 PID 1320 wrote to memory of 1640 1320 Explorer.EXE 25 PID 1320 wrote to memory of 1640 1320 Explorer.EXE 25 PID 1320 wrote to memory of 1640 1320 Explorer.EXE 25 PID 1320 wrote to memory of 1640 1320 Explorer.EXE 25 PID 1320 wrote to memory of 1640 1320 Explorer.EXE 25 PID 1320 wrote to memory of 1640 1320 Explorer.EXE 25 PID 1640 wrote to memory of 1076 1640 cmstp.exe 26 PID 1640 wrote to memory of 1076 1640 cmstp.exe 26 PID 1640 wrote to memory of 1076 1640 cmstp.exe 26 PID 1640 wrote to memory of 1076 1640 cmstp.exe 26 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1424 set thread context of 744 1424 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 24 PID 744 set thread context of 1320 744 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 20 PID 1640 set thread context of 1320 1640 cmstp.exe 20 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 744 RV OFFER REF 571 - REF. INQUIRY NP17836.exe Token: SeDebugPrivilege 1640 cmstp.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE - Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 744 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 744 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe 1640 cmstp.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 744 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 744 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 744 RV OFFER REF 571 - REF. INQUIRY NP17836.exe 1640 cmstp.exe 1640 cmstp.exe - Deletes itself 1 IoCs
pid Process 1076 cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\RV OFFER REF 571 - REF. INQUIRY NP17836.exe"C:\Users\Admin\AppData\Local\Temp\RV OFFER REF 571 - REF. INQUIRY NP17836.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\RV OFFER REF 571 - REF. INQUIRY NP17836.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:744
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1640 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RV OFFER REF 571 - REF. INQUIRY NP17836.exe"3⤵
- Deletes itself
PID:1076
-
-