Analysis
- max time kernel
151s - max time network
146s - platform
windows7_x64 - resource
win7 - submitted
30/07/2020, 10:50
Static task
static1
Behavioral task
behavioral1
Sample
iws.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target iws.exe
- Size 415KB
- Sample200730-ddf291f5wa
- SHA256 e3123e19730fb8956de0941c55043272cb6da28fa62c6536062ba2deb7fd8d81
- MD5 87ab3c9d95d82555765c6dca0667975a
- SHA1 65529f46b55f389dbdb01b346eb7bd732633d0d1
- SHA512 b5fae2fb25788b54fad6090d6eb38f5d0338ed0f13016b28f6d066d16e78d17d5220d5786b54d9f02245f75c5348f7d2ccfc4644e378fd2189f31d307919a333
- MD5 SHA1 SHA512
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ipropmapi.exe - Modifies data under HKEY_USERS 21 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecision = "0" ipropmapi.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" ipropmapi.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ipropmapi.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ipropmapi.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21} ipropmapi.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionTime = f064a34b5f66d601 ipropmapi.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ipropmapi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ipropmapi.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ipropmapi.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionReason = "1" ipropmapi.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\32-e2-17-db-d2-77 ipropmapi.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = f064a34b5f66d601 ipropmapi.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ipropmapi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ipropmapi.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070029000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ipropmapi.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadNetworkName = "Network" ipropmapi.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 ipropmapi.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" ipropmapi.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ipropmapi.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" ipropmapi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad ipropmapi.exe - Suspicious behavior: EmotetMutantsSpam 2 IoCs
pid Process 1560 iws.exe 864 ipropmapi.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1496 iws.exe 1560 iws.exe 748 ipropmapi.exe 864 ipropmapi.exe 864 ipropmapi.exe 864 ipropmapi.exe 864 ipropmapi.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1560 iws.exe - Suspicious use of UnmapMainImage 4 IoCs
pid Process 1496 iws.exe 1560 iws.exe 748 ipropmapi.exe 864 ipropmapi.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1496 wrote to memory of 1560 1496 iws.exe 24 PID 1496 wrote to memory of 1560 1496 iws.exe 24 PID 1496 wrote to memory of 1560 1496 iws.exe 24 PID 1496 wrote to memory of 1560 1496 iws.exe 24 PID 748 wrote to memory of 864 748 ipropmapi.exe 26 PID 748 wrote to memory of 864 748 ipropmapi.exe 26 PID 748 wrote to memory of 864 748 ipropmapi.exe 26 PID 748 wrote to memory of 864 748 ipropmapi.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\iws.exe"C:\Users\Admin\AppData\Local\Temp\iws.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\iws.exe"C:\Users\Admin\AppData\Local\Temp\iws.exe"2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1560
-
-
C:\Windows\SysWOW64\ipropmapi.exe"C:\Windows\SysWOW64\ipropmapi.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\ipropmapi.exe"C:\Windows\SysWOW64\ipropmapi.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:864
-