Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-02-2021 15:35
Static task
static1
Behavioral task
behavioral1
Sample
277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe
Resource
win10v20201028
General
-
Target
277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe
-
Size
138KB
-
MD5
6c7e2255031fdbb8efd157c2b4179319
-
SHA1
f77cf9bb93945feb70c2519debbfbaec476156f3
-
SHA256
277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f
-
SHA512
8a992f53395fa4a0afbe9354a39cfee642b9f8b396b21317d16b21029221a5c379fbe16812ea85b4296064157f2053f2413ee5a1aa76c1fa3392d26fb79bb406
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
isynz.exepid process 1672 isynz.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1132 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exepid process 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
isynz.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\Currentversion\Run isynz.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\{182F93A7-3D47-E447-1BAC-DF26EE497B27} = "C:\\Users\\Admin\\AppData\\Roaming\\Zibo\\isynz.exe" isynz.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exedescription pid process target process PID 1752 set thread context of 1132 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe cmd.exe -
Processes:
277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Privacy 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\2F0B0601-00000001.eml:OECustomProperty WinMail.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
isynz.exepid process 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe 1672 isynz.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exeWinMail.execmd.exedescription pid process Token: SeSecurityPrivilege 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe Token: SeSecurityPrivilege 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe Token: SeSecurityPrivilege 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe Token: SeManageVolumePrivilege 1448 WinMail.exe Token: SeSecurityPrivilege 1132 cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1448 WinMail.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exeisynz.exedescription pid process target process PID 1752 wrote to memory of 1672 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe isynz.exe PID 1752 wrote to memory of 1672 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe isynz.exe PID 1752 wrote to memory of 1672 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe isynz.exe PID 1752 wrote to memory of 1672 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe isynz.exe PID 1672 wrote to memory of 1124 1672 isynz.exe taskhost.exe PID 1672 wrote to memory of 1124 1672 isynz.exe taskhost.exe PID 1672 wrote to memory of 1124 1672 isynz.exe taskhost.exe PID 1672 wrote to memory of 1124 1672 isynz.exe taskhost.exe PID 1672 wrote to memory of 1124 1672 isynz.exe taskhost.exe PID 1672 wrote to memory of 1172 1672 isynz.exe Dwm.exe PID 1672 wrote to memory of 1172 1672 isynz.exe Dwm.exe PID 1672 wrote to memory of 1172 1672 isynz.exe Dwm.exe PID 1672 wrote to memory of 1172 1672 isynz.exe Dwm.exe PID 1672 wrote to memory of 1172 1672 isynz.exe Dwm.exe PID 1672 wrote to memory of 1200 1672 isynz.exe Explorer.EXE PID 1672 wrote to memory of 1200 1672 isynz.exe Explorer.EXE PID 1672 wrote to memory of 1200 1672 isynz.exe Explorer.EXE PID 1672 wrote to memory of 1200 1672 isynz.exe Explorer.EXE PID 1672 wrote to memory of 1200 1672 isynz.exe Explorer.EXE PID 1672 wrote to memory of 1752 1672 isynz.exe 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe PID 1672 wrote to memory of 1752 1672 isynz.exe 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe PID 1672 wrote to memory of 1752 1672 isynz.exe 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe PID 1672 wrote to memory of 1752 1672 isynz.exe 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe PID 1672 wrote to memory of 1752 1672 isynz.exe 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe PID 1672 wrote to memory of 1448 1672 isynz.exe WinMail.exe PID 1672 wrote to memory of 1448 1672 isynz.exe WinMail.exe PID 1672 wrote to memory of 1448 1672 isynz.exe WinMail.exe PID 1672 wrote to memory of 1448 1672 isynz.exe WinMail.exe PID 1672 wrote to memory of 1448 1672 isynz.exe WinMail.exe PID 1752 wrote to memory of 1132 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe cmd.exe PID 1752 wrote to memory of 1132 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe cmd.exe PID 1752 wrote to memory of 1132 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe cmd.exe PID 1752 wrote to memory of 1132 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe cmd.exe PID 1752 wrote to memory of 1132 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe cmd.exe PID 1752 wrote to memory of 1132 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe cmd.exe PID 1752 wrote to memory of 1132 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe cmd.exe PID 1752 wrote to memory of 1132 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe cmd.exe PID 1752 wrote to memory of 1132 1752 277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe cmd.exe PID 1672 wrote to memory of 1300 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1300 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1300 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1300 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1300 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1588 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1588 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1588 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1588 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1588 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1572 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1572 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1572 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1572 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 1572 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 620 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 620 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 620 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 620 1672 isynz.exe DllHost.exe PID 1672 wrote to memory of 620 1672 isynz.exe DllHost.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe"C:\Users\Admin\AppData\Local\Temp\277371d2f69231c4beced4f5898f2a6bd57f1fe7488e50decc6e7ea63ad5677f.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Zibo\isynz.exe"C:\Users\Admin\AppData\Roaming\Zibo\isynz.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfb54f73a.bat"3⤵
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpfb54f73a.batMD5
a8e82714efa6fda331af2b76f6cf8a81
SHA11f8a2d287588ab641b3c5e963e6cd0fc7493f0e3
SHA2568999f418ab337fb8a7c571b2eff72c7f67454333341d4dcb3556c9bddbac1d57
SHA5129d25f5f187daceba2cfc9b5ab672ab24d52d934c3e7474bff2c6f45139526628769cd8eeca4d99d981b90b2a62ce34cda16175bb9a9a470a675e001fd64ed2b6
-
C:\Users\Admin\AppData\Roaming\Sive\tyha.tyeMD5
71858df29843f58b3625d7dddd2a93b6
SHA1418d4297387e549472de5e9ca864d04970de70f6
SHA2565bab7cd6032c5ecf1e5af62383a187d7fd31fe5950c0f1d85232246755b12d09
SHA5121fdacb0a8552e30b60727ca015e084e7a0bc6759c565ad749560e4d6879aed0fa69347769774c9e29cd0e7658395284f0b12c7557ceffd474b6a34a7b0d811f2
-
C:\Users\Admin\AppData\Roaming\Zibo\isynz.exeMD5
458ea729786b8e1c8875248829a1835a
SHA13b3d2a54aab1b599ddebfa66f4a41c78c44c4fb1
SHA256e6d4aa6e9c7e0ec498c3e8a7999dfa87eb64561e232ea7b960b0a4cb7637e94c
SHA5124d502c5e277b9136d7fd77d9bdb0554400f9a2a1a6abe7153291fa2a856c11714504e88412d79099ab0f4cfb91beb6f2bf50b9b46aac8851b0e488819172dd60
-
C:\Users\Admin\AppData\Roaming\Zibo\isynz.exeMD5
458ea729786b8e1c8875248829a1835a
SHA13b3d2a54aab1b599ddebfa66f4a41c78c44c4fb1
SHA256e6d4aa6e9c7e0ec498c3e8a7999dfa87eb64561e232ea7b960b0a4cb7637e94c
SHA5124d502c5e277b9136d7fd77d9bdb0554400f9a2a1a6abe7153291fa2a856c11714504e88412d79099ab0f4cfb91beb6f2bf50b9b46aac8851b0e488819172dd60
-
\Users\Admin\AppData\Roaming\Zibo\isynz.exeMD5
458ea729786b8e1c8875248829a1835a
SHA13b3d2a54aab1b599ddebfa66f4a41c78c44c4fb1
SHA256e6d4aa6e9c7e0ec498c3e8a7999dfa87eb64561e232ea7b960b0a4cb7637e94c
SHA5124d502c5e277b9136d7fd77d9bdb0554400f9a2a1a6abe7153291fa2a856c11714504e88412d79099ab0f4cfb91beb6f2bf50b9b46aac8851b0e488819172dd60
-
\Users\Admin\AppData\Roaming\Zibo\isynz.exeMD5
458ea729786b8e1c8875248829a1835a
SHA13b3d2a54aab1b599ddebfa66f4a41c78c44c4fb1
SHA256e6d4aa6e9c7e0ec498c3e8a7999dfa87eb64561e232ea7b960b0a4cb7637e94c
SHA5124d502c5e277b9136d7fd77d9bdb0554400f9a2a1a6abe7153291fa2a856c11714504e88412d79099ab0f4cfb91beb6f2bf50b9b46aac8851b0e488819172dd60
-
memory/1132-26-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1132-32-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/1132-30-0x0000000073B30000-0x0000000073CD3000-memory.dmpFilesize
1.6MB
-
memory/1132-28-0x0000000000056B06-mapping.dmp
-
memory/1448-16-0x0000000003930000-0x0000000003A30000-memory.dmpFilesize
1024KB
-
memory/1448-25-0x0000000003930000-0x0000000003B30000-memory.dmpFilesize
2.0MB
-
memory/1448-13-0x000007FEFB811000-0x000007FEFB813000-memory.dmpFilesize
8KB
-
memory/1448-18-0x0000000003930000-0x0000000003B30000-memory.dmpFilesize
2.0MB
-
memory/1448-20-0x0000000003930000-0x0000000003A30000-memory.dmpFilesize
1024KB
-
memory/1448-21-0x0000000003930000-0x0000000003B30000-memory.dmpFilesize
2.0MB
-
memory/1448-22-0x0000000003A30000-0x0000000003B30000-memory.dmpFilesize
1024KB
-
memory/1448-15-0x000007FEF7160000-0x000007FEF73DA000-memory.dmpFilesize
2.5MB
-
memory/1448-14-0x000007FEF58B1000-0x000007FEF58B3000-memory.dmpFilesize
8KB
-
memory/1588-34-0x000007FEF7160000-0x000007FEF73DA000-memory.dmpFilesize
2.5MB
-
memory/1672-5-0x0000000000000000-mapping.dmp
-
memory/1752-2-0x0000000075EB1000-0x0000000075EB3000-memory.dmpFilesize
8KB
-
memory/1752-12-0x0000000073B20000-0x0000000073CC3000-memory.dmpFilesize
1.6MB
-
memory/1752-11-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1752-9-0x00000000002D0000-0x00000000002F7000-memory.dmpFilesize
156KB