Analysis
- max time kernel
148s - max time network
142s - platform
windows10_x64 - resource
win10v200722 - submitted
25/07/2020, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
24-7.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
24-7.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 24-7.exe
- Size 430KB
- Sample200725-twebd3bq22
- SHA256 967360ebfc55336f03edccc32869b0e6b65c17e66fcdac083d4bcc185b852c0d
- MD5 bec411e2423af5db62afa0495631d54c
- SHA1 a993c88fe8d0affa3fe35162844735fb5f44d7d9
- SHA512 04f189a2f0f2955e252128c3374402064307e742d8e7ba5b762eb9f8171dda08d84f709c85b1d6f0c72abfab1c3cd41ca9f4502328313c3722d857c9bfc0ac47
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 408 RegAsm.exe 408 RegAsm.exe 408 RegAsm.exe 408 RegAsm.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer colorcpl.exe - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\CH1D0XBP = "C:\\Program Files (x86)\\Tqnp\\mskvfp.exe" colorcpl.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3488 wrote to memory of 408 3488 24-7.exe 66 PID 3488 wrote to memory of 408 3488 24-7.exe 66 PID 3488 wrote to memory of 408 3488 24-7.exe 66 PID 3488 wrote to memory of 408 3488 24-7.exe 66 PID 3008 wrote to memory of 536 3008 Explorer.EXE 67 PID 3008 wrote to memory of 536 3008 Explorer.EXE 67 PID 3008 wrote to memory of 536 3008 Explorer.EXE 67 PID 536 wrote to memory of 668 536 colorcpl.exe 68 PID 536 wrote to memory of 668 536 colorcpl.exe 68 PID 536 wrote to memory of 668 536 colorcpl.exe 68 PID 536 wrote to memory of 3380 536 colorcpl.exe 76 PID 536 wrote to memory of 3380 536 colorcpl.exe 76 PID 536 wrote to memory of 3380 536 colorcpl.exe 76 PID 536 wrote to memory of 3848 536 colorcpl.exe 78 PID 536 wrote to memory of 3848 536 colorcpl.exe 78 PID 536 wrote to memory of 3848 536 colorcpl.exe 78 - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 3488 24-7.exe 408 RegAsm.exe 408 RegAsm.exe 408 RegAsm.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3488 set thread context of 408 3488 24-7.exe 66 PID 408 set thread context of 3008 408 RegAsm.exe 56 PID 536 set thread context of 3008 536 colorcpl.exe 56 - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 408 RegAsm.exe Token: SeDebugPrivilege 536 colorcpl.exe Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Tqnp\mskvfp.exe colorcpl.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\24-7.exe"C:\Users\Admin\AppData\Local\Temp\24-7.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3488 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:408
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- System policy modification
- Adds policy Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
PID:536 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:668
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3380
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3848
-
-