Analysis
- max time kernel
147s - max time network
27s - platform
windows7_x64 - resource
win7v200722 - submitted
04/08/2020, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
New PI PL.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
New PI PL.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target New PI PL.exe
- Size 945KB
- Sample200804-t3ccdzmp8a
- SHA256 d4cca60154fcc667ada19dffbac16f84b51691a540daf850a766b91bd46544fe
- MD5 332e036148c15d2453735b513bb8d693
- SHA1 ffe088da337a5d87baeb1f3de49f83ff6a607c0a
- SHA512 099a9ad6dd681e580e7ab0ab1798a51ccb9ce92a9ed001e7a8e49f0c57a714932cbc20c06670683fdb67be1ab88ba4b54e4f67568884deed1bc8921ecee4aed9
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 844 set thread context of 1904 844 New PI PL.exe 27 PID 1904 set thread context of 1188 1904 New PI PL.exe 20 PID 572 set thread context of 1188 572 rundll32.exe 20 - Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1904 New PI PL.exe 1904 New PI PL.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe 572 rundll32.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum New PI PL.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 New PI PL.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1904 New PI PL.exe 1904 New PI PL.exe 1904 New PI PL.exe 572 rundll32.exe 572 rundll32.exe - Deletes itself 1 IoCs
pid Process 1260 cmd.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1904 New PI PL.exe Token: SeDebugPrivilege 572 rundll32.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion New PI PL.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion New PI PL.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 844 wrote to memory of 1904 844 New PI PL.exe 27 PID 844 wrote to memory of 1904 844 New PI PL.exe 27 PID 844 wrote to memory of 1904 844 New PI PL.exe 27 PID 844 wrote to memory of 1904 844 New PI PL.exe 27 PID 844 wrote to memory of 1904 844 New PI PL.exe 27 PID 844 wrote to memory of 1904 844 New PI PL.exe 27 PID 844 wrote to memory of 1904 844 New PI PL.exe 27 PID 1188 wrote to memory of 572 1188 Explorer.EXE 28 PID 1188 wrote to memory of 572 1188 Explorer.EXE 28 PID 1188 wrote to memory of 572 1188 Explorer.EXE 28 PID 1188 wrote to memory of 572 1188 Explorer.EXE 28 PID 1188 wrote to memory of 572 1188 Explorer.EXE 28 PID 1188 wrote to memory of 572 1188 Explorer.EXE 28 PID 1188 wrote to memory of 572 1188 Explorer.EXE 28 PID 572 wrote to memory of 1260 572 rundll32.exe 29 PID 572 wrote to memory of 1260 572 rundll32.exe 29 PID 572 wrote to memory of 1260 572 rundll32.exe 29 PID 572 wrote to memory of 1260 572 rundll32.exe 29 - Formbook Payload 4 IoCs
resource yara_rule behavioral1/memory/1904-2-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1904-2-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1904-3-0x000000000041E290-mapping.dmp formbook behavioral1/memory/572-4-0x0000000000000000-mapping.dmp formbook - Looks for VMWare Tools registry key 2 TTPs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\New PI PL.exe"C:\Users\Admin\AppData\Local\Temp\New PI PL.exe"2⤵
- Suspicious use of SetThreadContext
- Maps connected drives based on registry
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\New PI PL.exe"C:\Users\Admin\AppData\Local\Temp\New PI PL.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\New PI PL.exe"3⤵
- Deletes itself
PID:1260
-
-