Analysis
- max time kernel
101s - max time network
11s - platform
windows7_x64 - resource
win7v200722 - submitted
14/10/2020, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
Information Civilized System Oy.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Information Civilized System Oy.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target Information Civilized System Oy.exe
- Size 3.2MB
- Sample201014-rw9p7mrtjj
- SHA256 bf8e469a058f90d9ccbe081b0da470d3314aa4cd34f916865f0c0b4fa28eacd8
- MD5 9f4649ff692011615d5cf3c5d410b95e
- SHA1 5f7c6637088b8e1a64c5f0e1ff0695c3e050616d
- SHA512 c019f99c789d2a77f620ac06fb16e6cf5f9383119f467dbaf7b1fe6feeec816d8a8847a7cbaef5a023e2460535b1bc4381b88040833a81bff364ac0b1aa70669
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\exefile\shell\open reg.exe Key created \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\exefile\shell reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\exefile\shell\open\NoSmartScreen = "1" reg.exe - Executes dropped EXE 1 IoCs
pid Process 1788 Nevaeh.exe - Loads dropped DLL 5 IoCs
pid Process 908 Information Civilized System Oy.exe 908 Information Civilized System Oy.exe 908 Information Civilized System Oy.exe 908 Information Civilized System Oy.exe 908 Information Civilized System Oy.exe - JavaScript code in executable 1 IoCs
resource yara_rule behavioral1/files/0x00050000000131ac-12.dat js - Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1296 schtasks.exe 1580 schtasks.exe 1544 schtasks.exe 1120 schtasks.exe 1428 schtasks.exe 580 schtasks.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\exefile\shell\open reg.exe Key created \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\exefile reg.exe Key created \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\exefile\shell reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\exefile\shell\open\NoSmartScreen = "1" reg.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 972 reg.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1980 AcroRd32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1788 Nevaeh.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1980 AcroRd32.exe 1980 AcroRd32.exe 1980 AcroRd32.exe - Suspicious use of WriteProcessMemory 126 IoCs
description pid Process procid_target PID 908 wrote to memory of 1788 908 Information Civilized System Oy.exe 25 PID 908 wrote to memory of 1788 908 Information Civilized System Oy.exe 25 PID 908 wrote to memory of 1788 908 Information Civilized System Oy.exe 25 PID 908 wrote to memory of 1788 908 Information Civilized System Oy.exe 25 PID 908 wrote to memory of 1788 908 Information Civilized System Oy.exe 25 PID 908 wrote to memory of 1788 908 Information Civilized System Oy.exe 25 PID 908 wrote to memory of 1788 908 Information Civilized System Oy.exe 25 PID 1788 wrote to memory of 1820 1788 Nevaeh.exe 26 PID 1788 wrote to memory of 1820 1788 Nevaeh.exe 26 PID 1788 wrote to memory of 1820 1788 Nevaeh.exe 26 PID 1788 wrote to memory of 1820 1788 Nevaeh.exe 26 PID 1788 wrote to memory of 1820 1788 Nevaeh.exe 26 PID 1788 wrote to memory of 1820 1788 Nevaeh.exe 26 PID 1788 wrote to memory of 1820 1788 Nevaeh.exe 26 PID 1820 wrote to memory of 1928 1820 cscript.exe 28 PID 1820 wrote to memory of 1928 1820 cscript.exe 28 PID 1820 wrote to memory of 1928 1820 cscript.exe 28 PID 1820 wrote to memory of 1928 1820 cscript.exe 28 PID 1820 wrote to memory of 1928 1820 cscript.exe 28 PID 1820 wrote to memory of 1928 1820 cscript.exe 28 PID 1820 wrote to memory of 1928 1820 cscript.exe 28 PID 1820 wrote to memory of 1936 1820 cscript.exe 30 PID 1820 wrote to memory of 1936 1820 cscript.exe 30 PID 1820 wrote to memory of 1936 1820 cscript.exe 30 PID 1820 wrote to memory of 1936 1820 cscript.exe 30 PID 1820 wrote to memory of 1936 1820 cscript.exe 30 PID 1820 wrote to memory of 1936 1820 cscript.exe 30 PID 1820 wrote to memory of 1936 1820 cscript.exe 30 PID 1820 wrote to memory of 1764 1820 cscript.exe 32 PID 1820 wrote to memory of 1764 1820 cscript.exe 32 PID 1820 wrote to memory of 1764 1820 cscript.exe 32 PID 1820 wrote to memory of 1764 1820 cscript.exe 32 PID 1820 wrote to memory of 1764 1820 cscript.exe 32 PID 1820 wrote to memory of 1764 1820 cscript.exe 32 PID 1820 wrote to memory of 1764 1820 cscript.exe 32 PID 1820 wrote to memory of 1552 1820 cscript.exe 34 PID 1820 wrote to memory of 1552 1820 cscript.exe 34 PID 1820 wrote to memory of 1552 1820 cscript.exe 34 PID 1820 wrote to memory of 1552 1820 cscript.exe 34 PID 1820 wrote to memory of 1552 1820 cscript.exe 34 PID 1820 wrote to memory of 1552 1820 cscript.exe 34 PID 1820 wrote to memory of 1552 1820 cscript.exe 34 PID 1936 wrote to memory of 1580 1936 cmd.exe 35 PID 1936 wrote to memory of 1580 1936 cmd.exe 35 PID 1936 wrote to memory of 1580 1936 cmd.exe 35 PID 1936 wrote to memory of 1580 1936 cmd.exe 35 PID 1936 wrote to memory of 1580 1936 cmd.exe 35 PID 1936 wrote to memory of 1580 1936 cmd.exe 35 PID 1936 wrote to memory of 1580 1936 cmd.exe 35 PID 1764 wrote to memory of 1544 1764 cmd.exe 38 PID 1764 wrote to memory of 1544 1764 cmd.exe 38 PID 1764 wrote to memory of 1544 1764 cmd.exe 38 PID 1764 wrote to memory of 1544 1764 cmd.exe 38 PID 1764 wrote to memory of 1544 1764 cmd.exe 38 PID 1764 wrote to memory of 1544 1764 cmd.exe 38 PID 1764 wrote to memory of 1544 1764 cmd.exe 38 PID 1820 wrote to memory of 1632 1820 cscript.exe 36 PID 1820 wrote to memory of 1632 1820 cscript.exe 36 PID 1820 wrote to memory of 1632 1820 cscript.exe 36 PID 1820 wrote to memory of 1632 1820 cscript.exe 36 PID 1820 wrote to memory of 1632 1820 cscript.exe 36 PID 1820 wrote to memory of 1632 1820 cscript.exe 36 PID 1820 wrote to memory of 1632 1820 cscript.exe 36 PID 1820 wrote to memory of 2016 1820 cscript.exe 39 PID 1820 wrote to memory of 2016 1820 cscript.exe 39 PID 1820 wrote to memory of 2016 1820 cscript.exe 39 PID 1820 wrote to memory of 2016 1820 cscript.exe 39 PID 1820 wrote to memory of 2016 1820 cscript.exe 39 PID 1820 wrote to memory of 2016 1820 cscript.exe 39 PID 1820 wrote to memory of 2016 1820 cscript.exe 39 PID 1928 wrote to memory of 1980 1928 cmd.exe 40 PID 1928 wrote to memory of 1980 1928 cmd.exe 40 PID 1928 wrote to memory of 1980 1928 cmd.exe 40 PID 1928 wrote to memory of 1980 1928 cmd.exe 40 PID 1928 wrote to memory of 1980 1928 cmd.exe 40 PID 1928 wrote to memory of 1980 1928 cmd.exe 40 PID 1928 wrote to memory of 1980 1928 cmd.exe 40 PID 1820 wrote to memory of 1040 1820 cscript.exe 43 PID 1820 wrote to memory of 1040 1820 cscript.exe 43 PID 1820 wrote to memory of 1040 1820 cscript.exe 43 PID 1820 wrote to memory of 1040 1820 cscript.exe 43 PID 1820 wrote to memory of 1040 1820 cscript.exe 43 PID 1820 wrote to memory of 1040 1820 cscript.exe 43 PID 1820 wrote to memory of 1040 1820 cscript.exe 43 PID 2016 wrote to memory of 1120 2016 cmd.exe 44 PID 2016 wrote to memory of 1120 2016 cmd.exe 44 PID 2016 wrote to memory of 1120 2016 cmd.exe 44 PID 2016 wrote to memory of 1120 2016 cmd.exe 44 PID 2016 wrote to memory of 1120 2016 cmd.exe 44 PID 2016 wrote to memory of 1120 2016 cmd.exe 44 PID 2016 wrote to memory of 1120 2016 cmd.exe 44 PID 1552 wrote to memory of 1428 1552 cmd.exe 45 PID 1552 wrote to memory of 1428 1552 cmd.exe 45 PID 1552 wrote to memory of 1428 1552 cmd.exe 45 PID 1552 wrote to memory of 1428 1552 cmd.exe 45 PID 1552 wrote to memory of 1428 1552 cmd.exe 45 PID 1552 wrote to memory of 1428 1552 cmd.exe 45 PID 1552 wrote to memory of 1428 1552 cmd.exe 45 PID 1820 wrote to memory of 268 1820 cscript.exe 47 PID 1820 wrote to memory of 268 1820 cscript.exe 47 PID 1820 wrote to memory of 268 1820 cscript.exe 47 PID 1820 wrote to memory of 268 1820 cscript.exe 47 PID 1820 wrote to memory of 268 1820 cscript.exe 47 PID 1820 wrote to memory of 268 1820 cscript.exe 47 PID 1820 wrote to memory of 268 1820 cscript.exe 47 PID 1632 wrote to memory of 580 1632 cmd.exe 48 PID 1632 wrote to memory of 580 1632 cmd.exe 48 PID 1632 wrote to memory of 580 1632 cmd.exe 48 PID 1632 wrote to memory of 580 1632 cmd.exe 48 PID 1632 wrote to memory of 580 1632 cmd.exe 48 PID 1632 wrote to memory of 580 1632 cmd.exe 48 PID 1632 wrote to memory of 580 1632 cmd.exe 48 PID 1040 wrote to memory of 1296 1040 cmd.exe 50 PID 1040 wrote to memory of 1296 1040 cmd.exe 50 PID 1040 wrote to memory of 1296 1040 cmd.exe 50 PID 1040 wrote to memory of 1296 1040 cmd.exe 50 PID 1040 wrote to memory of 1296 1040 cmd.exe 50 PID 1040 wrote to memory of 1296 1040 cmd.exe 50 PID 1040 wrote to memory of 1296 1040 cmd.exe 50 PID 268 wrote to memory of 972 268 cmd.exe 51 PID 268 wrote to memory of 972 268 cmd.exe 51 PID 268 wrote to memory of 972 268 cmd.exe 51 PID 268 wrote to memory of 972 268 cmd.exe 51 PID 268 wrote to memory of 972 268 cmd.exe 51 PID 268 wrote to memory of 972 268 cmd.exe 51 PID 268 wrote to memory of 972 268 cmd.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\Information Civilized System Oy.exe"C:\Users\Admin\AppData\Local\Temp\Information Civilized System Oy.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\Nevaeh.exe"C:\Users\Admin\AppData\Local\Temp\Nevaeh.exe" /run2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\system32\cscript.exe" //B Meredith.vbs3⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\DiplomaticBag.pdf4⤵PID:1928
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DiplomaticBag.pdf"5⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1980
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC MINUTE /MO 10 /TN Pollard /TR C:\Users\Admin\AppData\Local\Temp\Pollard.exe /F4⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC MINUTE /MO 10 /TN Pollard /TR C:\Users\Admin\AppData\Local\Temp\Pollard.exe /F5⤵
- Creates scheduled task(s)
PID:1580
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC MINUTE /MO 70 /TN Sexton /TR C:\Users\Admin\AppData\Local\Temp\Sexton.exe /F4⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC MINUTE /MO 70 /TN Sexton /TR C:\Users\Admin\AppData\Local\Temp\Sexton.exe /F5⤵
- Creates scheduled task(s)
PID:1544
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 2 /TN Beltran /TR C:\Users\Admin\AppData\Local\Temp\Beltran.exe /F4⤵PID:1552
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 2 /TN Beltran /TR C:\Users\Admin\AppData\Local\Temp\Beltran.exe /F5⤵
- Creates scheduled task(s)
PID:1428
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 8 /TN Wilcox /TR C:\Users\Admin\AppData\Local\Temp\Wilcox.exe /F4⤵PID:1632
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 8 /TN Wilcox /TR C:\Users\Admin\AppData\Local\Temp\Wilcox.exe /F5⤵
- Creates scheduled task(s)
PID:580
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 8 /TN Lotermity /TR C:\Users\Admin\AppData\Roaming\HP\Lotermity.exe /F4⤵PID:2016
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 8 /TN Lotermity /TR C:\Users\Admin\AppData\Roaming\HP\Lotermity.exe /F5⤵
- Creates scheduled task(s)
PID:1120
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 10 /TN Quichi /TR C:\Users\Admin\AppData\Roaming\LG\Quichish.exe /F4⤵PID:1040
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 10 /TN Quichi /TR C:\Users\Admin\AppData\Roaming\LG\Quichish.exe /F5⤵
- Creates scheduled task(s)
PID:1296
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg.exe add HKCU\Software\Classes\exefile\shell\open /v NoSmartScreen /t REG_DWORD /d 1 /f4⤵PID:268
-
C:\Windows\SysWOW64\reg.exereg.exe add HKCU\Software\Classes\exefile\shell\open /v NoSmartScreen /t REG_DWORD /d 1 /f5⤵
- Modifies system executable filetype association
- Modifies registry class
- Modifies registry key
PID:972
-
-
-
-