Analysis
- max time kernel
150s - max time network
153s - platform
windows7_x64 - resource
win7 - submitted
22/07/2020, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
Specs INQUIRY.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Specs INQUIRY.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Specs INQUIRY.exe
- Size 386KB
- Sample200722-pn5fpbe35s
- SHA256 3c15d1bb32d82a136a76d6e8867506dc2cc12cc183ed5a5c79335cb569e7d52c
- MD5 84c148d04013e64d21ebac8e8b1fe121
- SHA1 1831d5dd11f54a9d46428992d6e1625d24565302
- SHA512 4744858741a8c4c7768d954254bc52368110b716a477d83b9fbea80201a8a2aee875f0ccedd4b751bd8ef2d6951273f1c1ed0c89acc0c679a1765871bc59c5f9
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1464 Specs INQUIRY.exe Token: SeDebugPrivilege 736 Specs INQUIRY.exe Token: SeDebugPrivilege 1636 raserver.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1464 set thread context of 736 1464 Specs INQUIRY.exe 25 PID 736 set thread context of 1228 736 Specs INQUIRY.exe 20 PID 736 set thread context of 1228 736 Specs INQUIRY.exe 20 PID 1636 set thread context of 1228 1636 raserver.exe 20 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ozzwtyltp\user2d00.exe raserver.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1464 wrote to memory of 336 1464 Specs INQUIRY.exe 24 PID 1464 wrote to memory of 336 1464 Specs INQUIRY.exe 24 PID 1464 wrote to memory of 336 1464 Specs INQUIRY.exe 24 PID 1464 wrote to memory of 336 1464 Specs INQUIRY.exe 24 PID 1464 wrote to memory of 736 1464 Specs INQUIRY.exe 25 PID 1464 wrote to memory of 736 1464 Specs INQUIRY.exe 25 PID 1464 wrote to memory of 736 1464 Specs INQUIRY.exe 25 PID 1464 wrote to memory of 736 1464 Specs INQUIRY.exe 25 PID 1464 wrote to memory of 736 1464 Specs INQUIRY.exe 25 PID 1464 wrote to memory of 736 1464 Specs INQUIRY.exe 25 PID 1464 wrote to memory of 736 1464 Specs INQUIRY.exe 25 PID 1228 wrote to memory of 1636 1228 Explorer.EXE 26 PID 1228 wrote to memory of 1636 1228 Explorer.EXE 26 PID 1228 wrote to memory of 1636 1228 Explorer.EXE 26 PID 1228 wrote to memory of 1636 1228 Explorer.EXE 26 PID 1636 wrote to memory of 928 1636 raserver.exe 27 PID 1636 wrote to memory of 928 1636 raserver.exe 27 PID 1636 wrote to memory of 928 1636 raserver.exe 27 PID 1636 wrote to memory of 928 1636 raserver.exe 27 PID 1636 wrote to memory of 1988 1636 raserver.exe 32 PID 1636 wrote to memory of 1988 1636 raserver.exe 32 PID 1636 wrote to memory of 1988 1636 raserver.exe 32 PID 1636 wrote to memory of 1988 1636 raserver.exe 32 PID 1636 wrote to memory of 1988 1636 raserver.exe 32 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1464 Specs INQUIRY.exe 736 Specs INQUIRY.exe 736 Specs INQUIRY.exe 736 Specs INQUIRY.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 736 Specs INQUIRY.exe 736 Specs INQUIRY.exe 736 Specs INQUIRY.exe 736 Specs INQUIRY.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe 1636 raserver.exe - Deletes itself 1 IoCs
pid Process 928 cmd.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run raserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LNUPD = "C:\\Program Files (x86)\\Ozzwtyltp\\user2d00.exe" raserver.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\Specs INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\Specs INQUIRY.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\Specs INQUIRY.exe"{path}"3⤵PID:336
-
-
C:\Users\Admin\AppData\Local\Temp\Specs INQUIRY.exe"{path}"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:736
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Adds Run key to start application
- Modifies Internet Explorer settings
PID:1636 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Specs INQUIRY.exe"3⤵
- Deletes itself
PID:928
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1988
-
-