Analysis
-
max time kernel
147s -
max time network
123s -
platform
windows7_x64 -
resource
win7 -
submitted
12-10-2020 06:09
Static task
static1
Behavioral task
behavioral1
Sample
Product_item.exe
Resource
win7
General
-
Target
Product_item.exe
-
Size
927KB
-
MD5
8a9aae01cda806a3da1bbb8bdb40da3f
-
SHA1
df95aa3ea7a3fbc66ced0615491ee7e656f09a52
-
SHA256
054b7c5d38a00ecfc40168d4dc21610139c5ab6a46d2a0e851ef100397d5e5e9
-
SHA512
781529a195356186c87507fd0e39368c6ca3ad35fc43b6ae4e547f6b24b399b1ac057a7c1f8765a9669f2363a8fab34ac17946de2a819e2d51c9892849c2d039
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe -
Sets file execution options in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.0 = "C:\\ProgramData\\Google Updater 2.0\\9i5qi759ei.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.0 = "\"C:\\ProgramData\\Google Updater 2.0\\9i5qi759ei.exe\"" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.0 = "\"C:\\ProgramData\\Google Updater 2.0\\9i5qi759ei.exe\"" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe -
Processes:
Product_item.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Product_item.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\ProgramData\Google Updater 2.0\desktop.ini explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
Product_item.exeexplorer.exepid process 1888 Product_item.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Product_item.exedescription pid process target process PID 1164 set thread context of 1888 1164 Product_item.exe Product_item.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Product_item.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Product_item.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Product_item.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\VersionManager explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0" explorer.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
Product_item.exeexplorer.exepid process 1164 Product_item.exe 1164 Product_item.exe 1164 Product_item.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Product_item.exeexplorer.exepid process 1888 Product_item.exe 1888 Product_item.exe 1948 explorer.exe 1948 explorer.exe 1948 explorer.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Product_item.exepid process 1888 Product_item.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
Product_item.exeProduct_item.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1164 Product_item.exe Token: SeDebugPrivilege 1888 Product_item.exe Token: SeRestorePrivilege 1888 Product_item.exe Token: SeBackupPrivilege 1888 Product_item.exe Token: SeLoadDriverPrivilege 1888 Product_item.exe Token: SeCreatePagefilePrivilege 1888 Product_item.exe Token: SeShutdownPrivilege 1888 Product_item.exe Token: SeTakeOwnershipPrivilege 1888 Product_item.exe Token: SeChangeNotifyPrivilege 1888 Product_item.exe Token: SeCreateTokenPrivilege 1888 Product_item.exe Token: SeMachineAccountPrivilege 1888 Product_item.exe Token: SeSecurityPrivilege 1888 Product_item.exe Token: SeAssignPrimaryTokenPrivilege 1888 Product_item.exe Token: SeCreateGlobalPrivilege 1888 Product_item.exe Token: 33 1888 Product_item.exe Token: SeDebugPrivilege 1948 explorer.exe Token: SeRestorePrivilege 1948 explorer.exe Token: SeBackupPrivilege 1948 explorer.exe Token: SeLoadDriverPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeTakeOwnershipPrivilege 1948 explorer.exe Token: SeChangeNotifyPrivilege 1948 explorer.exe Token: SeCreateTokenPrivilege 1948 explorer.exe Token: SeMachineAccountPrivilege 1948 explorer.exe Token: SeSecurityPrivilege 1948 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1948 explorer.exe Token: SeCreateGlobalPrivilege 1948 explorer.exe Token: 33 1948 explorer.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
Product_item.exeProduct_item.exeexplorer.exedescription pid process target process PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1164 wrote to memory of 1888 1164 Product_item.exe Product_item.exe PID 1888 wrote to memory of 1948 1888 Product_item.exe explorer.exe PID 1888 wrote to memory of 1948 1888 Product_item.exe explorer.exe PID 1888 wrote to memory of 1948 1888 Product_item.exe explorer.exe PID 1888 wrote to memory of 1948 1888 Product_item.exe explorer.exe PID 1888 wrote to memory of 1948 1888 Product_item.exe explorer.exe PID 1888 wrote to memory of 1948 1888 Product_item.exe explorer.exe PID 1888 wrote to memory of 1948 1888 Product_item.exe explorer.exe PID 1948 wrote to memory of 1272 1948 explorer.exe Dwm.exe PID 1948 wrote to memory of 1272 1948 explorer.exe Dwm.exe PID 1948 wrote to memory of 1272 1948 explorer.exe Dwm.exe PID 1948 wrote to memory of 1272 1948 explorer.exe Dwm.exe PID 1948 wrote to memory of 1272 1948 explorer.exe Dwm.exe PID 1948 wrote to memory of 1272 1948 explorer.exe Dwm.exe PID 1948 wrote to memory of 1336 1948 explorer.exe Explorer.EXE PID 1948 wrote to memory of 1336 1948 explorer.exe Explorer.EXE PID 1948 wrote to memory of 1336 1948 explorer.exe Explorer.EXE PID 1948 wrote to memory of 1336 1948 explorer.exe Explorer.EXE PID 1948 wrote to memory of 1336 1948 explorer.exe Explorer.EXE PID 1948 wrote to memory of 1336 1948 explorer.exe Explorer.EXE PID 1948 wrote to memory of 1168 1948 explorer.exe DllHost.exe PID 1948 wrote to memory of 1168 1948 explorer.exe DllHost.exe PID 1948 wrote to memory of 1168 1948 explorer.exe DllHost.exe PID 1948 wrote to memory of 1168 1948 explorer.exe DllHost.exe PID 1948 wrote to memory of 1168 1948 explorer.exe DllHost.exe PID 1948 wrote to memory of 1168 1948 explorer.exe DllHost.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Product_item.exe"C:\Users\Admin\AppData\Local\Temp\Product_item.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Product_item.exe"{path}"3⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-0-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/1164-1-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1164-3-0x0000000000480000-0x0000000000484000-memory.dmpFilesize
16KB
-
memory/1164-4-0x0000000005860000-0x00000000058F1000-memory.dmpFilesize
580KB
-
memory/1164-5-0x0000000005BF0000-0x0000000005C6B000-memory.dmpFilesize
492KB
-
memory/1168-12-0x000007FEF7F10000-0x000007FEF818A000-memory.dmpFilesize
2.5MB
-
memory/1888-6-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1888-7-0x00000000004015C6-mapping.dmp
-
memory/1888-8-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1888-9-0x0000000002950000-0x0000000002AA1000-memory.dmpFilesize
1.3MB
-
memory/1888-10-0x0000000002DB0000-0x0000000002F31000-memory.dmpFilesize
1.5MB
-
memory/1948-11-0x0000000000000000-mapping.dmp