Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
09-10-2020 10:08
Static task
static1
Behavioral task
behavioral1
Sample
CV Actualis_.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
CV Actualis_.bin.exe
Resource
win10v200722
General
-
Target
CV Actualis_.bin.exe
-
Size
1.7MB
-
MD5
384b434bcfeec7287cf02b7aefa06c52
-
SHA1
8e2abd5f01f36b38d3674847dff518e7a4eef897
-
SHA256
0aa70e7306349ec1f3b27d683bfb3fd717f242e86b508b4051e3691c584fbf8d
-
SHA512
a33c8f4c6746d16cd39a19c4ba9fcc3ebabefdeb443c2e46585958bc1d10fca4ff44a6c2612acec5fb284935121ebbf1f4f6028df9060beb38f9e4d01da7d235
Malware Config
Signatures
-
Blacklisted process makes network request 27 IoCs
Processes:
wscript.exeflow pid process 10 696 wscript.exe 12 696 wscript.exe 15 696 wscript.exe 18 696 wscript.exe 19 696 wscript.exe 20 696 wscript.exe 21 696 wscript.exe 22 696 wscript.exe 23 696 wscript.exe 24 696 wscript.exe 25 696 wscript.exe 26 696 wscript.exe 27 696 wscript.exe 28 696 wscript.exe 29 696 wscript.exe 30 696 wscript.exe 31 696 wscript.exe 32 696 wscript.exe 33 696 wscript.exe 34 696 wscript.exe 35 696 wscript.exe 36 696 wscript.exe 37 696 wscript.exe 38 696 wscript.exe 39 696 wscript.exe 40 696 wscript.exe 43 696 wscript.exe -
Executes dropped EXE 3 IoCs
Processes:
InstallSlimPDFReader.exeInstallSlimPDFReader.tmpkl-plugin.exepid process 3028 InstallSlimPDFReader.exe 3724 InstallSlimPDFReader.tmp 1304 kl-plugin.exe -
Drops startup file 2 IoCs
Processes:
WScript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InstallSlimPDFReader.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InstallSlimPDFReader.js wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
InstallSlimPDFReader.tmppid process 3724 InstallSlimPDFReader.tmp -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
wscript.exeWScript.exedescription ioc process Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InstallSlimPDFReader = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\InstallSlimPDFReader.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\InstallSlimPDFReader = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\InstallSlimPDFReader.js\"" WScript.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InstallSlimPDFReader = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\InstallSlimPDFReader.js\"" WScript.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\InstallSlimPDFReader = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\InstallSlimPDFReader.js\"" wscript.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 ip-api.com -
Drops file in Program Files directory 2 IoCs
Processes:
CV Actualis_.bin.exedescription ioc process File opened for modification C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader\InstallSlimPDFReader.exe CV Actualis_.bin.exe File opened for modification C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader\InstallSlimPDFReader.js CV Actualis_.bin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2868 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
CV Actualis_.bin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings CV Actualis_.bin.exe -
Script User-Agent 25 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 18 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 21 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 25 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 29 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 31 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 34 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 15 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 19 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 26 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 30 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 12 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 20 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 22 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 23 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 32 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 35 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 36 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 37 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 38 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 24 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 27 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 28 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 33 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 39 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands HTTP User-Agent header 40 WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2868 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
kl-plugin.exepid process 1304 kl-plugin.exe 1304 kl-plugin.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
CV Actualis_.bin.exeWScript.exeInstallSlimPDFReader.exewscript.execmd.exedescription pid process target process PID 584 wrote to memory of 3972 584 CV Actualis_.bin.exe WScript.exe PID 584 wrote to memory of 3972 584 CV Actualis_.bin.exe WScript.exe PID 584 wrote to memory of 3972 584 CV Actualis_.bin.exe WScript.exe PID 3972 wrote to memory of 696 3972 WScript.exe wscript.exe PID 3972 wrote to memory of 696 3972 WScript.exe wscript.exe PID 3972 wrote to memory of 696 3972 WScript.exe wscript.exe PID 584 wrote to memory of 3028 584 CV Actualis_.bin.exe InstallSlimPDFReader.exe PID 584 wrote to memory of 3028 584 CV Actualis_.bin.exe InstallSlimPDFReader.exe PID 584 wrote to memory of 3028 584 CV Actualis_.bin.exe InstallSlimPDFReader.exe PID 3028 wrote to memory of 3724 3028 InstallSlimPDFReader.exe InstallSlimPDFReader.tmp PID 3028 wrote to memory of 3724 3028 InstallSlimPDFReader.exe InstallSlimPDFReader.tmp PID 3028 wrote to memory of 3724 3028 InstallSlimPDFReader.exe InstallSlimPDFReader.tmp PID 696 wrote to memory of 3688 696 wscript.exe cmd.exe PID 696 wrote to memory of 3688 696 wscript.exe cmd.exe PID 696 wrote to memory of 3688 696 wscript.exe cmd.exe PID 3688 wrote to memory of 2868 3688 cmd.exe taskkill.exe PID 3688 wrote to memory of 2868 3688 cmd.exe taskkill.exe PID 3688 wrote to memory of 2868 3688 cmd.exe taskkill.exe PID 696 wrote to memory of 1304 696 wscript.exe kl-plugin.exe PID 696 wrote to memory of 1304 696 wscript.exe kl-plugin.exe PID 696 wrote to memory of 1304 696 wscript.exe kl-plugin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CV Actualis_.bin.exe"C:\Users\Admin\AppData\Local\Temp\CV Actualis_.bin.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader\InstallSlimPDFReader.js"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\InstallSlimPDFReader.js"3⤵
- Blacklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /F /IM kl-plugin.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM kl-plugin.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\kl-plugin.exe"C:\Users\Admin\AppData\Roaming\kl-plugin.exe" blackid-43205.portmap.io 1118 "WSHRAT|E4B9A6CA|LZUKLIOU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/10/2020|JavaScript-v2.0|NL:Netherlands" 14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader\InstallSlimPDFReader.exe"C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader\InstallSlimPDFReader.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-R0JEC.tmp\InstallSlimPDFReader.tmp"C:\Users\Admin\AppData\Local\Temp\is-R0JEC.tmp\InstallSlimPDFReader.tmp" /SL5="$50076,1106375,177152,C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader\InstallSlimPDFReader.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader\InstallSlimPDFReader.exeMD5
7bac896429f4f066bf4e894a8aeddb57
SHA168e9a9fccf924846d461ba2adfe16a345b1ab28b
SHA256e21afdecd1eb7643fa95a3b2e7a059a0781d533afb105f6df23613b6b32cf1e7
SHA512f0fc7869bac9388eb07254aa5b1be72e8864838c9c668be427738af5c3134349addc0ce3b4112b9262f1e54c1dada122e2b97407adec8f4b6bf3a1a7f473d45d
-
C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader\InstallSlimPDFReader.exeMD5
7bac896429f4f066bf4e894a8aeddb57
SHA168e9a9fccf924846d461ba2adfe16a345b1ab28b
SHA256e21afdecd1eb7643fa95a3b2e7a059a0781d533afb105f6df23613b6b32cf1e7
SHA512f0fc7869bac9388eb07254aa5b1be72e8864838c9c668be427738af5c3134349addc0ce3b4112b9262f1e54c1dada122e2b97407adec8f4b6bf3a1a7f473d45d
-
C:\Program Files (x86)\Investintech.com Inc\SlimPDF Reader\InstallSlimPDFReader.jsMD5
3e3c515ce53a1aedb1fe7e8689f2cd39
SHA117b761826748ac4c63232f227d529b59323864d0
SHA256ef487da7a8301df9dca1e74c58433912fca910fb06bc4c941e4c756ce5ff0712
SHA512f786aebec2f7f31ca0a4b8d3d3dcad2dc3a5d2405d9a5c8f43aab84145d8a52978ee5861d048d49193bcc5c543d641ea8aeb486a4703ce9d746676a3ff579a13
-
C:\Users\Admin\AppData\Local\Temp\is-R0JEC.tmp\InstallSlimPDFReader.tmpMD5
78fd8cbc65d21ae9d82da0c6e5d9bedc
SHA1a49e539502ba74b0eb466104f4d5335fc018adc4
SHA256ae802402022b7a23c5d9e6863c9587102bbc04dbcd2fb4b087309e93a7dedd34
SHA512fa82e553a57a2bcf54770de0c20a4b563161491a926984c3a4e0a2b92dc25fb0d86ea4bdbc6625672f73c4e6ee5eaff4de66311d46085c55659b6528ef22602f
-
C:\Users\Admin\AppData\Local\Temp\is-R0JEC.tmp\InstallSlimPDFReader.tmpMD5
78fd8cbc65d21ae9d82da0c6e5d9bedc
SHA1a49e539502ba74b0eb466104f4d5335fc018adc4
SHA256ae802402022b7a23c5d9e6863c9587102bbc04dbcd2fb4b087309e93a7dedd34
SHA512fa82e553a57a2bcf54770de0c20a4b563161491a926984c3a4e0a2b92dc25fb0d86ea4bdbc6625672f73c4e6ee5eaff4de66311d46085c55659b6528ef22602f
-
C:\Users\Admin\AppData\Roaming\InstallSlimPDFReader.jsMD5
3e3c515ce53a1aedb1fe7e8689f2cd39
SHA117b761826748ac4c63232f227d529b59323864d0
SHA256ef487da7a8301df9dca1e74c58433912fca910fb06bc4c941e4c756ce5ff0712
SHA512f786aebec2f7f31ca0a4b8d3d3dcad2dc3a5d2405d9a5c8f43aab84145d8a52978ee5861d048d49193bcc5c543d641ea8aeb486a4703ce9d746676a3ff579a13
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InstallSlimPDFReader.jsMD5
3e3c515ce53a1aedb1fe7e8689f2cd39
SHA117b761826748ac4c63232f227d529b59323864d0
SHA256ef487da7a8301df9dca1e74c58433912fca910fb06bc4c941e4c756ce5ff0712
SHA512f786aebec2f7f31ca0a4b8d3d3dcad2dc3a5d2405d9a5c8f43aab84145d8a52978ee5861d048d49193bcc5c543d641ea8aeb486a4703ce9d746676a3ff579a13
-
C:\Users\Admin\AppData\Roaming\kl-plugin.exeMD5
7099a939fa30d939ccceb2f0597b19ed
SHA137b644ef5722709cd9024a372db4590916381976
SHA256272e64291748fa8be01109faa46c0ea919bf4baf4924177ea6ac2ee0574f1c1a
SHA5126e179a32b3091beee71d425248ae56495e31e9df569159a93af5826ddef28fba904ae4810d3ca2da45fe6dc8be1eeaecf71e8225b3e605f22f41f4e46d1cf721
-
C:\Users\Admin\AppData\Roaming\kl-plugin.exeMD5
7099a939fa30d939ccceb2f0597b19ed
SHA137b644ef5722709cd9024a372db4590916381976
SHA256272e64291748fa8be01109faa46c0ea919bf4baf4924177ea6ac2ee0574f1c1a
SHA5126e179a32b3091beee71d425248ae56495e31e9df569159a93af5826ddef28fba904ae4810d3ca2da45fe6dc8be1eeaecf71e8225b3e605f22f41f4e46d1cf721
-
\Users\Admin\AppData\Local\Temp\is-HIC86.tmp\itech.dllMD5
bb22f4ca6729309df066bfe0159e3a91
SHA1a6a4afded3f38f3a67fc727c5491d30f99fe8b45
SHA256b81e159aa2030956619cf0dc62dfaadc3f9bb17341c03bfa898ede513f49d7a7
SHA512c3a4fde918995c1ec8a4c6610ae31d2d35e3852e68c8dcb2ada136a1d89de0fe2631f7c72ecfe123669ff7e31b3ec8ba543b569eec5402261adab338732ec1b0
-
memory/696-2-0x0000000000000000-mapping.dmp
-
memory/1304-22-0x0000000000000000-mapping.dmp
-
memory/2868-21-0x0000000000000000-mapping.dmp
-
memory/3028-4-0x0000000000000000-mapping.dmp
-
memory/3688-20-0x0000000000000000-mapping.dmp
-
memory/3724-8-0x0000000000000000-mapping.dmp
-
memory/3972-0-0x0000000000000000-mapping.dmp