8fc4747ee4e9b358ddd1dffff19b0b3f5166e8b4ef15257be68d3fa2decb347e

Analysis

max time kernel
76s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
31/08/2020, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Inquiry Info Ref.exe
Size 1.2MB
Sample200831-f4dlrf44va
SHA256 8fc4747ee4e9b358ddd1dffff19b0b3f5166e8b4ef15257be68d3fa2decb347e
MD5 e93b4001016aa00f3abf2b486683383f
SHA1 48595462d7df1e324c53d3e341c3ce533b149592
SHA512 03c00852aff45dae75727877ebab05718dfbc7e2613505f37d7dc887b4be690a9153b83ea8f9a34e99caacfec0c6357ea3bd685dbba5f43daf5ca7e145ebf607
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3820 set thread context of 2344	3820	Inquiry Info Ref.exe	75

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 7e5c66719c7fd601	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2344	Inquiry Info Ref.exe
2344	Inquiry Info Ref.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	904	svchost.exe
Token: SeCreatePagefilePrivilege	904	svchost.exe
Token: SeDebugPrivilege	2344	Inquiry Info Ref.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 2344	3820	Inquiry Info Ref.exe	75
PID 3820 wrote to memory of 2344	3820	Inquiry Info Ref.exe	75
PID 3820 wrote to memory of 2344	3820	Inquiry Info Ref.exe	75
PID 3820 wrote to memory of 2344	3820	Inquiry Info Ref.exe	75
PID 3820 wrote to memory of 2344	3820	Inquiry Info Ref.exe	75
PID 3820 wrote to memory of 2344	3820	Inquiry Info Ref.exe	75
PID 3820 wrote to memory of 2344	3820	Inquiry Info Ref.exe	75
PID 3820 wrote to memory of 2344	3820	Inquiry Info Ref.exe	75
PID 2344 wrote to memory of 2672	2344	Inquiry Info Ref.exe	77
PID 2344 wrote to memory of 2672	2344	Inquiry Info Ref.exe	77
PID 2344 wrote to memory of 2672	2344	Inquiry Info Ref.exe	77
PID 2672 wrote to memory of 3116	2672	cmd.exe	79
PID 2672 wrote to memory of 3116	2672	cmd.exe	79
PID 2672 wrote to memory of 3116	2672	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\Inquiry Info Ref.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry Info Ref.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\Inquiry Info Ref.exe
  "C:\Users\Admin\AppData\Local\Temp\Inquiry Info Ref.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Inquiry Info Ref.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Inquiry Info Ref.exe'
      4⤵
      PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2344-11-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/2344-20-0x0000000005350000-0x0000000005351000-memory.dmp

Download

memory/2344-19-0x0000000005260000-0x00000000052D1000-memory.dmp

Download

memory/2344-14-0x00000000738C0000-0x0000000073FAE000-memory.dmp

Download

memory/3820-5-0x0000000005880000-0x0000000005881000-memory.dmp

Download

memory/3820-10-0x00000000067A0000-0x0000000006864000-memory.dmp

Download

memory/3820-9-0x0000000001560000-0x000000000163C000-memory.dmp

Download

memory/3820-8-0x0000000005970000-0x000000000597B000-memory.dmp

Download

memory/3820-7-0x0000000005A20000-0x0000000005A21000-memory.dmp

Download

memory/3820-6-0x0000000005950000-0x0000000005951000-memory.dmp

Download

memory/3820-0-0x00000000738C0000-0x0000000073FAE000-memory.dmp

Download

memory/3820-4-0x0000000005D80000-0x0000000005D81000-memory.dmp

Download

memory/3820-3-0x00000000057E0000-0x00000000057E1000-memory.dmp

Download

memory/3820-1-0x0000000000E00000-0x0000000000E01000-memory.dmp

Download