Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    17-11-2020 12:19

General

  • Target

    95184d6acbcd3d1f526271d43c7d6e6f.exe

  • Size

    13.6MB

  • MD5

    b61e4049ce52400869cc6afe222ca329

  • SHA1

    95a0715fb486cd9eee7f7df811e93a838539335e

  • SHA256

    f7c20cd92f517c238ec163ec7460b0fa677f656a5e4cb9875c7cfdc38ece9ae6

  • SHA512

    9d43a10fda7ad7ac24c8895788d97687219e0112a1c5f9464dbe1aba13da0ca1030381f11da4342b6f6bf0231b7f287bf56fcadb6fd8481f791dbe1b2a7c55d1

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 49 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95184d6acbcd3d1f526271d43c7d6e6f.exe
    "C:\Users\Admin\AppData\Local\Temp\95184d6acbcd3d1f526271d43c7d6e6f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\is-HFL08.tmp\95184d6acbcd3d1f526271d43c7d6e6f.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HFL08.tmp\95184d6acbcd3d1f526271d43c7d6e6f.tmp" /SL5="$3015A,13454335,936960,C:\Users\Admin\AppData\Local\Temp\95184d6acbcd3d1f526271d43c7d6e6f.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\xvid.ax"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:1368
      • C:\Program Files (x86)\Ree Video Converter\wmfdist.exe
        "C:\Program Files (x86)\Ree Video Converter\wmfdist.exe" /Q:A /R:N
        3⤵
        • Executes dropped EXE
        PID:1356
      • C:\Program Files (x86)\Ree Video Converter\VideoConverter.exe
        "C:\Program Files (x86)\Ree Video Converter\VideoConverter.exe" 95184d6acbcd3d1f526271d43c7d6e6f.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:668

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Ree Video Converter\VideoConverter.exe
    MD5

    234f70a7781270752d527ee9313a81ca

    SHA1

    5c6023a27cd9eb2db41de1402a0328f42cc90642

    SHA256

    2ece275a87fc82e74f53df9098d3a53e57957aeee82b2d0fae31898b59ae31f5

    SHA512

    5b0fe5ac9854c8cca0d9397961567c7f29f842c5e53ffa16b62a98bc9d3c55344b206cbe9a87611e8d558415f6966ab934e29f8044b92b7c3a6a1ee7372849b3

  • C:\Program Files (x86)\Ree Video Converter\sqlite3.dll
    MD5

    e477a96c8f2b18d6b5c27bde49c990bf

    SHA1

    e980c9bf41330d1e5bd04556db4646a0210f7409

    SHA256

    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

    SHA512

    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

  • C:\Program Files (x86)\Ree Video Converter\wmfdist.exe
    MD5

    f59090e9a8070d7fbbdcc8895d2169a3

    SHA1

    370e62290cac6a6c7aa13442741caf6671437a54

    SHA256

    a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

    SHA512

    45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

  • C:\Program Files (x86)\Ree Video Converter\wmfdist.exe
    MD5

    f59090e9a8070d7fbbdcc8895d2169a3

    SHA1

    370e62290cac6a6c7aa13442741caf6671437a54

    SHA256

    a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

    SHA512

    45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

  • C:\Users\Admin\AppData\Local\Temp\is-HFL08.tmp\95184d6acbcd3d1f526271d43c7d6e6f.tmp
    MD5

    cf932a8e4ddc98f4f4ba2e22686209d6

    SHA1

    c5f74277431cabd48bcf3aeab5df6e2e0a5f1a17

    SHA256

    87ee2365ebbf0c4dfdd9dd6abd8e4b49f5fd6d1e7e5c6a133449425fea7ba0af

    SHA512

    245437c5431f01db50943f80b35f21b29f444b445097a2d341a601eaaf026dcc367533be732501fd41bad24150a5b443f98ab542d42e13549c35f9929f30609f

  • C:\Users\Admin\AppData\Local\Temp\is-HFL08.tmp\95184d6acbcd3d1f526271d43c7d6e6f.tmp
    MD5

    cf932a8e4ddc98f4f4ba2e22686209d6

    SHA1

    c5f74277431cabd48bcf3aeab5df6e2e0a5f1a17

    SHA256

    87ee2365ebbf0c4dfdd9dd6abd8e4b49f5fd6d1e7e5c6a133449425fea7ba0af

    SHA512

    245437c5431f01db50943f80b35f21b29f444b445097a2d341a601eaaf026dcc367533be732501fd41bad24150a5b443f98ab542d42e13549c35f9929f30609f

  • C:\Windows\SysWOW64\xvid.ax
    MD5

    1dfc887cb243a525675ce04787dedf8b

    SHA1

    69163fbf6a40a34ae9f27e652b01b4cc8fb2cc5f

    SHA256

    0969d1f5501ad4be6f969ce45f44a739b2d61a50237f75ae7b77626d6a0aff11

    SHA512

    160a6df0774c359a3959088fe478d237b4fa597eaa0cf1b084b77ba8fcdb08137387fa3ce91bd40e3af6d2992be048e583368644fe6fa627918e8900833adde4

  • \Program Files (x86)\Ree Video Converter\VideoConverter.exe
    MD5

    234f70a7781270752d527ee9313a81ca

    SHA1

    5c6023a27cd9eb2db41de1402a0328f42cc90642

    SHA256

    2ece275a87fc82e74f53df9098d3a53e57957aeee82b2d0fae31898b59ae31f5

    SHA512

    5b0fe5ac9854c8cca0d9397961567c7f29f842c5e53ffa16b62a98bc9d3c55344b206cbe9a87611e8d558415f6966ab934e29f8044b92b7c3a6a1ee7372849b3

  • \Program Files (x86)\Ree Video Converter\VideoConverter.exe
    MD5

    234f70a7781270752d527ee9313a81ca

    SHA1

    5c6023a27cd9eb2db41de1402a0328f42cc90642

    SHA256

    2ece275a87fc82e74f53df9098d3a53e57957aeee82b2d0fae31898b59ae31f5

    SHA512

    5b0fe5ac9854c8cca0d9397961567c7f29f842c5e53ffa16b62a98bc9d3c55344b206cbe9a87611e8d558415f6966ab934e29f8044b92b7c3a6a1ee7372849b3

  • \Program Files (x86)\Ree Video Converter\sqlite3.dll
    MD5

    e477a96c8f2b18d6b5c27bde49c990bf

    SHA1

    e980c9bf41330d1e5bd04556db4646a0210f7409

    SHA256

    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

    SHA512

    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

  • \Program Files (x86)\Ree Video Converter\wmfdist.exe
    MD5

    f59090e9a8070d7fbbdcc8895d2169a3

    SHA1

    370e62290cac6a6c7aa13442741caf6671437a54

    SHA256

    a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

    SHA512

    45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

  • \Users\Admin\AppData\Local\Temp\is-4M2JC.tmp\_isetup\_iscrypt.dll
    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • \Users\Admin\AppData\Local\Temp\is-4M2JC.tmp\_isetup\_isdecmp.dll
    MD5

    77d6d961f71a8c558513bed6fd0ad6f1

    SHA1

    122bb9ed6704b72250e4e31b5d5fc2f0476c4b6a

    SHA256

    5da7c8d33d3b7db46277012d92875c0b850c8abf1eb3c8c9c5b9532089a0bcf0

    SHA512

    b0921e2442b4cdec8cc479ba3751a01c0646a4804e2f4a5d5632fa2dbf54cc45d4cccffa4d5b522d42afc2f6a622e07882ed7e663c8462333b082e82503f335a

  • \Users\Admin\AppData\Local\Temp\is-HFL08.tmp\95184d6acbcd3d1f526271d43c7d6e6f.tmp
    MD5

    cf932a8e4ddc98f4f4ba2e22686209d6

    SHA1

    c5f74277431cabd48bcf3aeab5df6e2e0a5f1a17

    SHA256

    87ee2365ebbf0c4dfdd9dd6abd8e4b49f5fd6d1e7e5c6a133449425fea7ba0af

    SHA512

    245437c5431f01db50943f80b35f21b29f444b445097a2d341a601eaaf026dcc367533be732501fd41bad24150a5b443f98ab542d42e13549c35f9929f30609f

  • \Windows\SysWOW64\xvid.ax
    MD5

    1dfc887cb243a525675ce04787dedf8b

    SHA1

    69163fbf6a40a34ae9f27e652b01b4cc8fb2cc5f

    SHA256

    0969d1f5501ad4be6f969ce45f44a739b2d61a50237f75ae7b77626d6a0aff11

    SHA512

    160a6df0774c359a3959088fe478d237b4fa597eaa0cf1b084b77ba8fcdb08137387fa3ce91bd40e3af6d2992be048e583368644fe6fa627918e8900833adde4

  • memory/668-15-0x0000000000000000-mapping.dmp
  • memory/668-20-0x0000000004FF0000-0x0000000005001000-memory.dmp
    Filesize

    68KB

  • memory/668-19-0x0000000004BE0000-0x0000000004BF1000-memory.dmp
    Filesize

    68KB

  • memory/1184-1-0x0000000000000000-mapping.dmp
  • memory/1356-11-0x0000000000000000-mapping.dmp
  • memory/1368-7-0x0000000000000000-mapping.dmp