Overview

overview

8

Static

static

iview456_x...up.exe

windows7_x64

1

iview456_x...up.exe

windows10_x64

8

Analysis

  • max time kernel
    110s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    29-11-2020 07:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    iview456_x64_setup.exe

  • Size

    3.7MB

  • MD5

    a6c1653bdb69aaf72198794e2000f5f1

  • SHA1

    ce73fcf0f88cb56dea79ba643784461a97068bfc

  • SHA256

    52a48acf59027468c7f859b78c51196e42b47c9e65d17466ff1995f71a6cff91

  • SHA512

    68592719c7d98c53d13f9225d7d35f472662e289dab3e9015dfb2d4ac51c18006896ccc3f3fb7829a15377cf9e0a7f55fdd9f4f0efc7a38d0f32c9ab43b469ae

Score
8/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 69 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 732 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\iview456_x64_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\iview456_x64_setup.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Program Files\IrfanView\i_view64.exe
      "C:\Program Files\IrfanView\i_view64.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:4376
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1528
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:1792
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4432
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2300

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\IrfanView\Toolbars\Samuel_16.png
    MD5

    49b9e25c8f622c2344e00665a40aed59

    SHA1

    5f977c67185297c2ed29c0ca32230e4f4ace7555

    SHA256

    07a1b34d2a6e259a515d179caa01df67e7a2ded0522919df80abb6281e73a4cd

    SHA512

    0c771762ae53ac8e610e2b1f58920c683fa8167c546eb99b37e055b10daafb347e4bcc91c00aecb5d8d4b2122437f4e8f99014f91acfc19d8922a4458dd4b47c

    Download Submit
  • C:\Program Files\IrfanView\i_view64.exe
    MD5

    ad5fafa2f5af3e8cc61ed221d36a3241

    SHA1

    b9c013048d989a1a0fcf6da79d5247c96e93dfe4

    SHA256

    2eb7144c44db31c0ee0c4392afef4f7c8dbece3c81b3835fb8d414a66615311a

    SHA512

    7edaf5ba92715a044516f999a02e72b5990f69f84e7460ea63dae729b1e5292855aa4e45738f0dfd5e9b7ec87f50689c55c53cf19d3b4975e7e06751f4950541

    Download Submit
  • C:\Program Files\IrfanView\i_view64.exe
    MD5

    ad5fafa2f5af3e8cc61ed221d36a3241

    SHA1

    b9c013048d989a1a0fcf6da79d5247c96e93dfe4

    SHA256

    2eb7144c44db31c0ee0c4392afef4f7c8dbece3c81b3835fb8d414a66615311a

    SHA512

    7edaf5ba92715a044516f999a02e72b5990f69f84e7460ea63dae729b1e5292855aa4e45738f0dfd5e9b7ec87f50689c55c53cf19d3b4975e7e06751f4950541

    Download Submit
  • C:\Program Files\IrfanView\i_view64.ini
    MD5

    25a92f802d3ffd5519f7dab35c0aec3f

    SHA1

    dcbf6d35f41452515fa4a0402da6a8fd89bc0ac0

    SHA256

    668c0ba227f3b0c95419dbb9328311961346dfa42ab17da4f13e9777ddecf58a

    SHA512

    0928c2c9dc3136a83d90598afb5b51887950a671dd23e34a7a6a4ac5fa5c3497e13d00fe39527f13e2e9ef9088d2c7553a682589f5ac70e7cb593376276e2427

    Download Submit
  • C:\Users\Admin\AppData\Roaming\IrfanView\i_view64.ini
    MD5

    514b9ecbdc05d377276528ea232c4df0

    SHA1

    6641e509e2d5e54ea50f93e4256470cd61925a65

    SHA256

    d317839a5b34985617a3069c469f5b1e0f8ba1bdd149268371919d42b2e7e09b

    SHA512

    42e5c248f186efb053ebbe835dba1ce37cbc8a81ab7179b9d19f63d728bc803cb0105bb6b8589dadec3719c75bf70704bbce3a121eb87a92f9abd215a475b9bc

    Download Submit
  • memory/4376-3-0x0000000000000000-mapping.dmp
    Download
  • memory/4376-8-0x0000011654BD0000-0x0000011654BD1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4636-2-0x0000019338D80000-0x0000019338E81000-memory.dmp
    Filesize

    1.0MB

    Download