Overview

overview

1

Static

static

301bfstrategiv.exe

windows7_x64

1

301bfstrategiv.exe

windows10_x64

1

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    31-07-2020 08:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    301bfstrategiv.exe

  • Size

    250KB

  • MD5

    2036c001bf2ea1350479891979d5cab3

  • SHA1

    3aa51c33b1d8bf24408c54e810c1671f03194b4a

  • SHA256

    1cb9f3780b232c8dbf2ded95882750e5455f2ce6e048595c6bc4044e2018c69b

  • SHA512

    8f072bd9f0862464b9d7df943b7fb177e4b4a4df5d2986beac05aee8e37242beb9b1bd44b087a455bd22206c168bdbf0744f767646f2e74081f5321d4b54e4a8

Score
1/10

Malware Config

Signatures

  • Checks whether UAC is enabled 18 IoCs
  • Modifies Internet Explorer settings 1 TTPs 146 IoCs
    adwarespyware
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\301bfstrategiv.exe
    "C:\Users\Admin\AppData\Local\Temp\301bfstrategiv.exe"
    1⤵
      PID:3900
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:2888
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        PID:3928
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:764
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:764 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        PID:476
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:1548
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        PID:1768
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:3152
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3152 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        PID:352
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:772
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:772 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2572
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:2956
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2196
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:1452
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        PID:2312
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:3492
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3492 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3304
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:2192
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        PID:2164

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/352-4-0x0000000000000000-mapping.dmp
      Download
    • memory/476-2-0x0000000000000000-mapping.dmp
      Download
    • memory/1768-3-0x0000000000000000-mapping.dmp
      Download
    • memory/2164-9-0x0000000000000000-mapping.dmp
      Download
    • memory/2196-6-0x0000000000000000-mapping.dmp
      Download
    • memory/2312-7-0x0000000000000000-mapping.dmp
      Download
    • memory/2572-5-0x0000000000000000-mapping.dmp
      Download
    • memory/3304-8-0x0000000000000000-mapping.dmp
      Download
    • memory/3900-0-0x00000000005A0000-0x00000000005B7000-memory.dmp
      Filesize

      92KB

      Download
    • memory/3928-1-0x0000000000000000-mapping.dmp
      Download