Analysis
- max time kernel
151s - max time network
109s - platform
windows7_x64 - resource
win7v200722 - submitted
23/07/2020, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
Specification Requirement.bat.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Specification Requirement.bat.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Specification Requirement.bat.exe
- Size 886KB
- Sample200723-2bn39pfk7x
- SHA256 8dceaa57045b4d03ea1f58bb2c82c4d4887dd74ca78bc114c1bc7bdf937e680d
- MD5 5c15297803f33fc6a66dc16bd1110dcf
- SHA1 ab52585287686e34a035800732743140901a6f4e
- SHA512 ae65fd0050017e66f53a7193666c5d72a061e0452af13dec2911d3d8431ea5dbe979d8712d595d602dfe925e45e3b2bd88fb7b68f02cbaf445a608c20255b8bc
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1244 set thread context of 604 1244 Specification Requirement.bat.exe 24 PID 604 set thread context of 1296 604 Specification Requirement.bat.exe 20 PID 604 set thread context of 1296 604 Specification Requirement.bat.exe 20 PID 1424 set thread context of 1296 1424 ipconfig.exe 20 - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XTKDN0AXER = "C:\\Program Files (x86)\\Hbnu\\audiodg7nj4xb.exe" ipconfig.exe Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ipconfig.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2090973689-680783404-4292415065-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1424 ipconfig.exe - Suspicious behavior: MapViewOfSection 9 IoCs
pid Process 1244 Specification Requirement.bat.exe 604 Specification Requirement.bat.exe 604 Specification Requirement.bat.exe 604 Specification Requirement.bat.exe 604 Specification Requirement.bat.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1244 wrote to memory of 604 1244 Specification Requirement.bat.exe 24 PID 1244 wrote to memory of 604 1244 Specification Requirement.bat.exe 24 PID 1244 wrote to memory of 604 1244 Specification Requirement.bat.exe 24 PID 1244 wrote to memory of 604 1244 Specification Requirement.bat.exe 24 PID 1296 wrote to memory of 1424 1296 Explorer.EXE 25 PID 1296 wrote to memory of 1424 1296 Explorer.EXE 25 PID 1296 wrote to memory of 1424 1296 Explorer.EXE 25 PID 1296 wrote to memory of 1424 1296 Explorer.EXE 25 PID 1424 wrote to memory of 1508 1424 ipconfig.exe 26 PID 1424 wrote to memory of 1508 1424 ipconfig.exe 26 PID 1424 wrote to memory of 1508 1424 ipconfig.exe 26 PID 1424 wrote to memory of 1508 1424 ipconfig.exe 26 PID 1424 wrote to memory of 1580 1424 ipconfig.exe 31 PID 1424 wrote to memory of 1580 1424 ipconfig.exe 31 PID 1424 wrote to memory of 1580 1424 ipconfig.exe 31 PID 1424 wrote to memory of 1580 1424 ipconfig.exe 31 PID 1424 wrote to memory of 1580 1424 ipconfig.exe 31 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 604 Specification Requirement.bat.exe Token: SeDebugPrivilege 1424 ipconfig.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Hbnu\audiodg7nj4xb.exe ipconfig.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1244 Specification Requirement.bat.exe 604 Specification Requirement.bat.exe 604 Specification Requirement.bat.exe 604 Specification Requirement.bat.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe 1424 ipconfig.exe - Deletes itself 1 IoCs
pid Process 1508 cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\Specification Requirement.bat.exe"C:\Users\Admin\AppData\Local\Temp\Specification Requirement.bat.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\Specification Requirement.bat.exe"C:\Users\Admin\AppData\Local\Temp\Specification Requirement.bat.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:604
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Adds Run key to start application
- Modifies Internet Explorer settings
- Gathers network information
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1424 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Specification Requirement.bat.exe"3⤵
- Deletes itself
PID:1508
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1580
-
-