Analysis
- max time kernel
150s - max time network
135s - platform
windows10_x64 - resource
win10 - submitted
25/10/2020, 08:11
Static task
static1
Behavioral task
behavioral1
Sample
390d5d5b85d20102bdac0544073c4475.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
390d5d5b85d20102bdac0544073c4475.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 390d5d5b85d20102bdac0544073c4475.exe
- Size 65KB
- Sample201025-td3a5ebql6
- SHA256 152fd28bdefe2d56b7a43c2d3c12284bdfe2bd229c671a633d76a342c955a2e3
- MD5 390d5d5b85d20102bdac0544073c4475
- SHA1 dc9b49c3ff2db65a941f13b8d44ccb301fd05974
- SHA512 5299e2862c501587a74226a5a82f6de5baa6d5d1cbd435cf90848befe33dd1245d6419e2ac418fcdf4737e98af84f942abd638cc5a0a625b33f56bafdf5d76ce
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE crashsmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies crashsmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 crashsmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat crashsmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 crashsmc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix crashsmc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" crashsmc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" crashsmc.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe 3548 crashsmc.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3092 390d5d5b85d20102bdac0544073c4475.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3952 wrote to memory of 3092 3952 390d5d5b85d20102bdac0544073c4475.exe 72 PID 3952 wrote to memory of 3092 3952 390d5d5b85d20102bdac0544073c4475.exe 72 PID 3952 wrote to memory of 3092 3952 390d5d5b85d20102bdac0544073c4475.exe 72 PID 2668 wrote to memory of 3548 2668 crashsmc.exe 79 PID 2668 wrote to memory of 3548 2668 crashsmc.exe 79 PID 2668 wrote to memory of 3548 2668 crashsmc.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\390d5d5b85d20102bdac0544073c4475.exe"C:\Users\Admin\AppData\Local\Temp\390d5d5b85d20102bdac0544073c4475.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\390d5d5b85d20102bdac0544073c4475.exe--104a60e62⤵
- Suspicious behavior: RenamesItself
PID:3092
-
-
C:\Windows\SysWOW64\crashsmc.exe"C:\Windows\SysWOW64\crashsmc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\crashsmc.exe--57df88742⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3548
-