Analysis
-
max time kernel
152s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-02-2021 17:53
Static task
static1
Behavioral task
behavioral1
Sample
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe
Resource
win7v20201028
General
-
Target
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe
-
Size
695KB
-
MD5
75a0dff08308ea7de7a5a7a0528683de
-
SHA1
79fbffc4c4b90d58ea179ece6153302e8dd4012d
-
SHA256
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd
-
SHA512
2cd661e50aad22c1d2b113dbe0e92f5391bc370fc19b8adf2009431a2dfd48072bf15a65edf6089c562ffeabee4c8fc0ab556448cef7a0ea72b007bd0df9708c
Malware Config
Signatures
-
Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/files/0x00050000000130f5-37.dat disable_win_def behavioral1/files/0x00050000000130f5-40.dat disable_win_def behavioral1/files/0x00050000000130f5-41.dat disable_win_def -
Modifies visiblity of hidden/system files in Explorer 2 TTPs
-
Executes dropped EXE 6 IoCs
pid Process 1644 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1500 icsys.icn.exe 1828 explorer.exe 1900 spoolsv.exe 880 svchost.exe 928 spoolsv.exe -
Loads dropped DLL 6 IoCs
pid Process 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1500 icsys.icn.exe 1828 explorer.exe 1900 spoolsv.exe 880 svchost.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 240 schtasks.exe 1904 schtasks.exe 1956 schtasks.exe 764 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 1828 explorer.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe 880 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1828 explorer.exe 880 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1644 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe Token: SeDebugPrivilege 1644 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 1500 icsys.icn.exe 1500 icsys.icn.exe 1828 explorer.exe 1828 explorer.exe 1900 spoolsv.exe 1900 spoolsv.exe 880 svchost.exe 880 svchost.exe 928 spoolsv.exe 928 spoolsv.exe 1644 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1040 wrote to memory of 1644 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 26 PID 1040 wrote to memory of 1644 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 26 PID 1040 wrote to memory of 1644 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 26 PID 1040 wrote to memory of 1644 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 26 PID 1040 wrote to memory of 1500 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 28 PID 1040 wrote to memory of 1500 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 28 PID 1040 wrote to memory of 1500 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 28 PID 1040 wrote to memory of 1500 1040 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 28 PID 1500 wrote to memory of 1828 1500 icsys.icn.exe 29 PID 1500 wrote to memory of 1828 1500 icsys.icn.exe 29 PID 1500 wrote to memory of 1828 1500 icsys.icn.exe 29 PID 1500 wrote to memory of 1828 1500 icsys.icn.exe 29 PID 1828 wrote to memory of 1900 1828 explorer.exe 31 PID 1828 wrote to memory of 1900 1828 explorer.exe 31 PID 1828 wrote to memory of 1900 1828 explorer.exe 31 PID 1828 wrote to memory of 1900 1828 explorer.exe 31 PID 1900 wrote to memory of 880 1900 spoolsv.exe 33 PID 1900 wrote to memory of 880 1900 spoolsv.exe 33 PID 1900 wrote to memory of 880 1900 spoolsv.exe 33 PID 1900 wrote to memory of 880 1900 spoolsv.exe 33 PID 880 wrote to memory of 928 880 svchost.exe 34 PID 880 wrote to memory of 928 880 svchost.exe 34 PID 880 wrote to memory of 928 880 svchost.exe 34 PID 880 wrote to memory of 928 880 svchost.exe 34 PID 1828 wrote to memory of 368 1828 explorer.exe 35 PID 1828 wrote to memory of 368 1828 explorer.exe 35 PID 1828 wrote to memory of 368 1828 explorer.exe 35 PID 1828 wrote to memory of 368 1828 explorer.exe 35 PID 880 wrote to memory of 1904 880 svchost.exe 37 PID 880 wrote to memory of 1904 880 svchost.exe 37 PID 880 wrote to memory of 1904 880 svchost.exe 37 PID 880 wrote to memory of 1904 880 svchost.exe 37 PID 1644 wrote to memory of 1956 1644 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 40 PID 1644 wrote to memory of 1956 1644 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 40 PID 1644 wrote to memory of 1956 1644 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 40 PID 1644 wrote to memory of 1956 1644 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 40 PID 880 wrote to memory of 764 880 svchost.exe 42 PID 880 wrote to memory of 764 880 svchost.exe 42 PID 880 wrote to memory of 764 880 svchost.exe 42 PID 880 wrote to memory of 764 880 svchost.exe 42 PID 880 wrote to memory of 240 880 svchost.exe 44 PID 880 wrote to memory of 240 880 svchost.exe 44 PID 880 wrote to memory of 240 880 svchost.exe 44 PID 880 wrote to memory of 240 880 svchost.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe"C:\Users\Admin\AppData\Local\Temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\users\admin\appdata\local\temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exec:\users\admin\appdata\local\temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win10" /sc ONLOGON /tr "c:\users\admin\appdata\local\temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe " /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1956
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:928
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 18:51 /f6⤵
- Creates scheduled task(s)
PID:1904
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 18:52 /f6⤵
- Creates scheduled task(s)
PID:764
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 18:53 /f6⤵
- Creates scheduled task(s)
PID:240
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe4⤵PID:368
-
-
-