Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-01-2021 07:08
Static task
static1
Behavioral task
behavioral1
Sample
Scan_order.scr
Resource
win7v20201028
General
-
Target
Scan_order.scr
-
Size
76KB
-
MD5
04be7ed51e345a56403df4657b376990
-
SHA1
44f5fdf6902d114524afc110cd927f95f72903fa
-
SHA256
ab77af2c0fe4a39b3e2ec7b7450ef36999baf7c66316f4b3934d5a60e124d50c
-
SHA512
0b71a26ad38bbc0c1fb37854f636125012cfa6177afa1de4291756e5bdbe3bc07df157a1eb4ba7c3ee82055ece44ec21157ff14a6d66df14b0a720ad410afd21
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
Scan_order.scrieinstal.exepid process 1824 Scan_order.scr 1520 ieinstal.exe 1520 ieinstal.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Scan_order.scrdescription pid process target process PID 1824 set thread context of 1520 1824 Scan_order.scr ieinstal.exe -
Drops file in Program Files directory 1 IoCs
Processes:
ieinstal.exedescription ioc process File opened for modification C:\Program Files (x86)\internet explorer\ieinstal.exe ieinstal.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Scan_order.scrpid process 1824 Scan_order.scr -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Scan_order.scrieinstal.exepid process 1824 Scan_order.scr 1520 ieinstal.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Scan_order.scrieinstal.exedescription pid process target process PID 1824 wrote to memory of 1520 1824 Scan_order.scr ieinstal.exe PID 1824 wrote to memory of 1520 1824 Scan_order.scr ieinstal.exe PID 1824 wrote to memory of 1520 1824 Scan_order.scr ieinstal.exe PID 1824 wrote to memory of 1520 1824 Scan_order.scr ieinstal.exe PID 1824 wrote to memory of 1520 1824 Scan_order.scr ieinstal.exe PID 1824 wrote to memory of 1520 1824 Scan_order.scr ieinstal.exe PID 1824 wrote to memory of 1520 1824 Scan_order.scr ieinstal.exe PID 1824 wrote to memory of 1520 1824 Scan_order.scr ieinstal.exe PID 1520 wrote to memory of 1056 1520 ieinstal.exe WScript.exe PID 1520 wrote to memory of 1056 1520 ieinstal.exe WScript.exe PID 1520 wrote to memory of 1056 1520 ieinstal.exe WScript.exe PID 1520 wrote to memory of 1056 1520 ieinstal.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan_order.scr"C:\Users\Admin\AppData\Local\Temp\Scan_order.scr" /S1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\Scan_order.scr" /S2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\uninstall.vbs"3⤵PID:1056
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\uninstall.vbsMD5
0fe2423601d3291b0b6326e6518286a0
SHA109746eb739147f191068aba1552cd616eabd5e1d
SHA2561a899121e3969c2bb894e08765a57e8a65cb9154d71c3825baa6b4f2da61d8f3
SHA5129632acaa96bf0d7bc5f3754d15117079888fcc23591007fc7f4d5dabfdb1e9300cf96ff3ee9266fe2d29ea118623651773d1002d5a3f91270471841d5012cec6
-
memory/1056-7-0x0000000000000000-mapping.dmp
-
memory/1056-9-0x00000000028B0000-0x00000000028B4000-memory.dmpFilesize
16KB
-
memory/1520-5-0x00000000000D0000-mapping.dmp
-
memory/1520-4-0x00000000000D0000-0x00000000001D0000-memory.dmpFilesize
1024KB
-
memory/1632-6-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmpFilesize
2.5MB