Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10 -
submitted
29-07-2020 11:26
Static task
static1
Behavioral task
behavioral1
Sample
SKM_454e20070310530.SCR
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SKM_454e20070310530.SCR
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
SKM_454e20070310530.SCR
-
Size
808KB
-
MD5
fd239f6ff382ff48c0b544c650f7e04b
-
SHA1
f07e1454a8b708c150490fc454623519dfd6cef3
-
SHA256
b68844095af181c139ed272cb04e830f803770518ad9dd78cb789e8f4571b4c3
-
SHA512
122000268724443c5bcfb5a071310e31f838ccee106e868bcdf0ee8d045617e3b65ac52495c6e7cda54b0aec530aa130473b07c5b7114e44a48b64989213b86f
Score
8/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 68 IoCs
Processes:
SKM_454e20070310530.SCRSKM_454e20070310530.SCRykepitewnok.exeykepitewnok.exepid process 2192 SKM_454e20070310530.SCR 2192 SKM_454e20070310530.SCR 3888 SKM_454e20070310530.SCR 3888 SKM_454e20070310530.SCR 3928 ykepitewnok.exe 3928 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe 3488 ykepitewnok.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
SKM_454e20070310530.SCRSKM_454e20070310530.SCRykepitewnok.exeykepitewnok.exedescription pid process target process PID 2192 wrote to memory of 3888 2192 SKM_454e20070310530.SCR SKM_454e20070310530.SCR PID 2192 wrote to memory of 3888 2192 SKM_454e20070310530.SCR SKM_454e20070310530.SCR PID 2192 wrote to memory of 3888 2192 SKM_454e20070310530.SCR SKM_454e20070310530.SCR PID 3888 wrote to memory of 3928 3888 SKM_454e20070310530.SCR ykepitewnok.exe PID 3888 wrote to memory of 3928 3888 SKM_454e20070310530.SCR ykepitewnok.exe PID 3888 wrote to memory of 3928 3888 SKM_454e20070310530.SCR ykepitewnok.exe PID 3928 wrote to memory of 3488 3928 ykepitewnok.exe ykepitewnok.exe PID 3928 wrote to memory of 3488 3928 ykepitewnok.exe ykepitewnok.exe PID 3928 wrote to memory of 3488 3928 ykepitewnok.exe ykepitewnok.exe PID 3888 wrote to memory of 696 3888 SKM_454e20070310530.SCR cmd.exe PID 3888 wrote to memory of 696 3888 SKM_454e20070310530.SCR cmd.exe PID 3888 wrote to memory of 696 3888 SKM_454e20070310530.SCR cmd.exe PID 3488 wrote to memory of 2668 3488 ykepitewnok.exe sihost.exe PID 3488 wrote to memory of 2668 3488 ykepitewnok.exe sihost.exe PID 3488 wrote to memory of 2668 3488 ykepitewnok.exe sihost.exe PID 3488 wrote to memory of 2668 3488 ykepitewnok.exe sihost.exe PID 3488 wrote to memory of 2668 3488 ykepitewnok.exe sihost.exe PID 3488 wrote to memory of 2680 3488 ykepitewnok.exe svchost.exe PID 3488 wrote to memory of 2680 3488 ykepitewnok.exe svchost.exe PID 3488 wrote to memory of 2680 3488 ykepitewnok.exe svchost.exe PID 3488 wrote to memory of 2680 3488 ykepitewnok.exe svchost.exe PID 3488 wrote to memory of 2680 3488 ykepitewnok.exe svchost.exe PID 3488 wrote to memory of 2784 3488 ykepitewnok.exe taskhostw.exe PID 3488 wrote to memory of 2784 3488 ykepitewnok.exe taskhostw.exe PID 3488 wrote to memory of 2784 3488 ykepitewnok.exe taskhostw.exe PID 3488 wrote to memory of 2784 3488 ykepitewnok.exe taskhostw.exe PID 3488 wrote to memory of 2784 3488 ykepitewnok.exe taskhostw.exe PID 3488 wrote to memory of 2984 3488 ykepitewnok.exe Explorer.EXE PID 3488 wrote to memory of 2984 3488 ykepitewnok.exe Explorer.EXE PID 3488 wrote to memory of 2984 3488 ykepitewnok.exe Explorer.EXE PID 3488 wrote to memory of 2984 3488 ykepitewnok.exe Explorer.EXE PID 3488 wrote to memory of 2984 3488 ykepitewnok.exe Explorer.EXE PID 3488 wrote to memory of 3140 3488 ykepitewnok.exe ShellExperienceHost.exe PID 3488 wrote to memory of 3140 3488 ykepitewnok.exe ShellExperienceHost.exe PID 3488 wrote to memory of 3140 3488 ykepitewnok.exe ShellExperienceHost.exe PID 3488 wrote to memory of 3140 3488 ykepitewnok.exe ShellExperienceHost.exe PID 3488 wrote to memory of 3140 3488 ykepitewnok.exe ShellExperienceHost.exe PID 3488 wrote to memory of 3156 3488 ykepitewnok.exe SearchUI.exe PID 3488 wrote to memory of 3156 3488 ykepitewnok.exe SearchUI.exe PID 3488 wrote to memory of 3156 3488 ykepitewnok.exe SearchUI.exe PID 3488 wrote to memory of 3156 3488 ykepitewnok.exe SearchUI.exe PID 3488 wrote to memory of 3156 3488 ykepitewnok.exe SearchUI.exe PID 3488 wrote to memory of 3380 3488 ykepitewnok.exe RuntimeBroker.exe PID 3488 wrote to memory of 3380 3488 ykepitewnok.exe RuntimeBroker.exe PID 3488 wrote to memory of 3380 3488 ykepitewnok.exe RuntimeBroker.exe PID 3488 wrote to memory of 3380 3488 ykepitewnok.exe RuntimeBroker.exe PID 3488 wrote to memory of 3380 3488 ykepitewnok.exe RuntimeBroker.exe PID 3488 wrote to memory of 3700 3488 ykepitewnok.exe DllHost.exe PID 3488 wrote to memory of 3700 3488 ykepitewnok.exe DllHost.exe PID 3488 wrote to memory of 3700 3488 ykepitewnok.exe DllHost.exe PID 3488 wrote to memory of 3700 3488 ykepitewnok.exe DllHost.exe PID 3488 wrote to memory of 3700 3488 ykepitewnok.exe DllHost.exe PID 3488 wrote to memory of 3280 3488 ykepitewnok.exe backgroundTaskHost.exe PID 3488 wrote to memory of 3280 3488 ykepitewnok.exe backgroundTaskHost.exe PID 3488 wrote to memory of 3280 3488 ykepitewnok.exe backgroundTaskHost.exe PID 3488 wrote to memory of 3280 3488 ykepitewnok.exe backgroundTaskHost.exe PID 3488 wrote to memory of 3280 3488 ykepitewnok.exe backgroundTaskHost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
SKM_454e20070310530.SCRykepitewnok.exepid process 2192 SKM_454e20070310530.SCR 3928 ykepitewnok.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SKM_454e20070310530.SCRykepitewnok.exedescription pid process target process PID 2192 set thread context of 3888 2192 SKM_454e20070310530.SCR SKM_454e20070310530.SCR PID 3928 set thread context of 3488 3928 ykepitewnok.exe ykepitewnok.exe -
Loads dropped DLL 4 IoCs
Processes:
SKM_454e20070310530.SCRykepitewnok.exepid process 3888 SKM_454e20070310530.SCR 3888 SKM_454e20070310530.SCR 3488 ykepitewnok.exe 3488 ykepitewnok.exe -
Suspicious use of AdjustPrivilegeToken 1420 IoCs
Processes:
SKM_454e20070310530.SCRykepitewnok.exedescription pid process Token: SeSecurityPrivilege 3888 SKM_454e20070310530.SCR Token: SeSecurityPrivilege 3888 SKM_454e20070310530.SCR Token: SeSecurityPrivilege 3888 SKM_454e20070310530.SCR Token: SeSecurityPrivilege 3888 SKM_454e20070310530.SCR Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe Token: SeSecurityPrivilege 3488 ykepitewnok.exe -
Executes dropped EXE 2 IoCs
Processes:
ykepitewnok.exeykepitewnok.exepid process 3928 ykepitewnok.exe 3488 ykepitewnok.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ykepitewnok.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Currentversion\Run ykepitewnok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Owowrehey = "C:\\Users\\Admin\\AppData\\Roaming\\Duocfuupyz\\ykepitewnok.exe" ykepitewnok.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\Currentversion\Run ykepitewnok.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.SCR"C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.SCR" /S2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.SCR"C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.SCR" /S3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Duocfuupyz\ykepitewnok.exe"C:\Users\Admin\AppData\Roaming\Duocfuupyz\ykepitewnok.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Duocfuupyz\ykepitewnok.exe"C:\Users\Admin\AppData\Roaming\Duocfuupyz\ykepitewnok.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp823cbc18.bat"4⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp823cbc18.bat
-
C:\Users\Admin\AppData\Roaming\Duocfuupyz\ykepitewnok.exe
-
C:\Users\Admin\AppData\Roaming\Duocfuupyz\ykepitewnok.exe
-
C:\Users\Admin\AppData\Roaming\Duocfuupyz\ykepitewnok.exe
-
\Users\Admin\AppData\Local\Temp\tmp14EA.tmp
-
\Users\Admin\AppData\Local\Temp\tmp14FB.tmp
-
\Users\Admin\AppData\Local\Temp\tmp6F0.tmp
-
\Users\Admin\AppData\Local\Temp\tmp701.tmp
-
memory/696-12-0x0000000000000000-mapping.dmp
-
memory/3488-9-0x000000000043F4D4-mapping.dmp
-
memory/3888-0-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/3888-2-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/3888-1-0x000000000043F4D4-mapping.dmp
-
memory/3928-5-0x0000000000000000-mapping.dmp