Overview

overview

1

Static

static

176bfstrategiv.exe

windows7_x64

1

176bfstrategiv.exe

windows10_x64

1

Analysis

  • max time kernel
    153s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    31/07/2020, 08:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    176bfstrategiv.exe
  • Size 250KB
  • Sample200731-d6anvm334n
  • SHA256 7c49537e88d2cd6076b3fa728ebb6f4cbad5ef9866570753bb2ea4bfbed65046
  • MD5 SHA1 SHA512
Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 198 IoCs
    adwarespyware
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Suspicious use of SetWindowsHookEx 32 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Checks whether UAC is enabled 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\176bfstrategiv.exe
    "C:\Users\Admin\AppData\Local\Temp\176bfstrategiv.exe"
    1⤵
      PID:1420
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Checks whether UAC is enabled
      PID:1528
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Checks whether UAC is enabled
        PID:1844
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:209938 /prefetch:2
        2⤵
          PID:1060
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        PID:1116
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1116 CREDAT:275457 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:632
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        PID:1156
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1156 CREDAT:275457 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:1920
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        PID:1504
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:1896
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        PID:1860
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:864
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        PID:1820
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:1684
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        PID:1784
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:275457 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:1508
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        PID:340
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:275457 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:1160

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1420-0-0x0000000000310000-0x0000000000327000-memory.dmp
            Download

            memory/1844-2-0x0000000005DC0000-0x0000000005DE3000-memory.dmp
            Download