Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 17:53
Static task
static1
Behavioral task
behavioral1
Sample
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe
Resource
win7v20201028
General
-
Target
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe
-
Size
695KB
-
MD5
75a0dff08308ea7de7a5a7a0528683de
-
SHA1
79fbffc4c4b90d58ea179ece6153302e8dd4012d
-
SHA256
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd
-
SHA512
2cd661e50aad22c1d2b113dbe0e92f5391bc370fc19b8adf2009431a2dfd48072bf15a65edf6089c562ffeabee4c8fc0ab556448cef7a0ea72b007bd0df9708c
Malware Config
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/files/0x000100000001ab75-38.dat disable_win_def behavioral2/files/0x000100000001ab75-39.dat disable_win_def -
Modifies visiblity of hidden/system files in Explorer 2 TTPs
-
Executes dropped EXE 6 IoCs
Processes:
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid Process 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 3764 icsys.icn.exe 792 explorer.exe 212 spoolsv.exe 1504 svchost.exe 1500 spoolsv.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
svchost.exeexplorer.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 5 IoCs
Processes:
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exeicsys.icn.exeexplorer.exespoolsv.exedescription ioc Process File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exeicsys.icn.exepid Process 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
svchost.exeexplorer.exepid Process 1504 svchost.exe 792 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exedescription pid Process Token: SeDebugPrivilege 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe Token: SeDebugPrivilege 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exeicsys.icn.exeexplorer.exespoolsv.exeb603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe svchost.exespoolsv.exepid Process 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 792 explorer.exe 792 explorer.exe 212 spoolsv.exe 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 212 spoolsv.exe 1504 svchost.exe 1504 svchost.exe 1500 spoolsv.exe 1500 spoolsv.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exeicsys.icn.exeb603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe explorer.exespoolsv.exesvchost.exedescription pid Process procid_target PID 648 wrote to memory of 3608 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 74 PID 648 wrote to memory of 3608 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 74 PID 648 wrote to memory of 3608 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 74 PID 648 wrote to memory of 3764 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 76 PID 648 wrote to memory of 3764 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 76 PID 648 wrote to memory of 3764 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 76 PID 3764 wrote to memory of 792 3764 icsys.icn.exe 77 PID 3764 wrote to memory of 792 3764 icsys.icn.exe 77 PID 3764 wrote to memory of 792 3764 icsys.icn.exe 77 PID 3608 wrote to memory of 3824 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 78 PID 3608 wrote to memory of 3824 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 78 PID 3608 wrote to memory of 3824 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 78 PID 792 wrote to memory of 212 792 explorer.exe 80 PID 792 wrote to memory of 212 792 explorer.exe 80 PID 792 wrote to memory of 212 792 explorer.exe 80 PID 212 wrote to memory of 1504 212 spoolsv.exe 81 PID 212 wrote to memory of 1504 212 spoolsv.exe 81 PID 212 wrote to memory of 1504 212 spoolsv.exe 81 PID 1504 wrote to memory of 1500 1504 svchost.exe 82 PID 1504 wrote to memory of 1500 1504 svchost.exe 82 PID 1504 wrote to memory of 1500 1504 svchost.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe"C:\Users\Admin\AppData\Local\Temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\users\admin\appdata\local\temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exec:\users\admin\appdata\local\temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win10" /sc ONLOGON /tr "c:\users\admin\appdata\local\temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe " /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:3824
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe
MD5f817213d0a4955a4a64a204ef9fe123c
SHA1c4aa1c2a952e98c1f6ac829c0b16747689affafc
SHA2567a7c0ab5b55abad85d6beb23a62687777a65dc54d461f151a612118eef2785d6
SHA5121b55bd21cee892204ac9133b2dc1141205d3e1f09586a035aff4ccfb2036e78022438869866deda76351b7d5a1d4f83e57a8e82b56af59f97d04c3aea29d18ab
-
MD5
516072070d0510a7dbde6e01b62bc6a2
SHA1b5bb093549e839d8266c2ab296c079dde39f3ebc
SHA256485d6028cf7a517b16da815141c76703a18d8a6471af77a0fc056a2ab133eea3
SHA512028bd8d6b7e57b6006748564598fc38ebd11bfdaa9d270d057582f6e9fcf4b0caf4e550f4c3ad536943465ef8c5335ad1446356ec25df1f00e4f49820a5c4a7a
-
MD5
8bf8ca5470aa2a93588b93c736d4414e
SHA14b3feaab2697e6958413f2657c5ca4d4b51d1878
SHA256d9773031756077e61141cda5beeada77ffa9cda40db96210cd08a97ebb78a802
SHA512133322033d2c0e4640648fe69694d6b23b854cbcb582dc81e28cdcfa93d735c06249c53698ed47f2b231e5821e5fa22824e25e9b6257a104bffb0c28bd798847
-
MD5
8bf8ca5470aa2a93588b93c736d4414e
SHA14b3feaab2697e6958413f2657c5ca4d4b51d1878
SHA256d9773031756077e61141cda5beeada77ffa9cda40db96210cd08a97ebb78a802
SHA512133322033d2c0e4640648fe69694d6b23b854cbcb582dc81e28cdcfa93d735c06249c53698ed47f2b231e5821e5fa22824e25e9b6257a104bffb0c28bd798847
-
MD5
d410a3252168b20e825d9beaa526206f
SHA17c52367b81b160205a0867ecd49d89904fe51bac
SHA2560cc1e966502b69cf546abd8254badbb3d609beb81e885a75af7fd1e390412887
SHA5123d194dda00443830a2005da7ac5b453dd35e21596f7087b8e2749d58fe37d3161ea52dc11ea7a0ece65d3af48b0569fae74196d0675cbe9df0a7c30790f6315d
-
MD5
d410a3252168b20e825d9beaa526206f
SHA17c52367b81b160205a0867ecd49d89904fe51bac
SHA2560cc1e966502b69cf546abd8254badbb3d609beb81e885a75af7fd1e390412887
SHA5123d194dda00443830a2005da7ac5b453dd35e21596f7087b8e2749d58fe37d3161ea52dc11ea7a0ece65d3af48b0569fae74196d0675cbe9df0a7c30790f6315d
-
MD5
852203695064d9bdb7866d202652f014
SHA1d6b99b53edd24c41c2db995a8bf08eb1313ac830
SHA25620065bca35a51d2e9531143035c6650673d18b7ede5280326883cfabdebf3416
SHA51274318df6bd2dec420fad5a6ebf530ad5ffc51dc0e91a5e7ec0b596cefcf9531dcb6e2d10a8a57b32c6b0655b0e11c3cf87d1b63654a8e0e6c3ac8e70ca57c91e
-
\??\c:\users\admin\appdata\local\temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe
MD5f817213d0a4955a4a64a204ef9fe123c
SHA1c4aa1c2a952e98c1f6ac829c0b16747689affafc
SHA2567a7c0ab5b55abad85d6beb23a62687777a65dc54d461f151a612118eef2785d6
SHA5121b55bd21cee892204ac9133b2dc1141205d3e1f09586a035aff4ccfb2036e78022438869866deda76351b7d5a1d4f83e57a8e82b56af59f97d04c3aea29d18ab
-
MD5
d410a3252168b20e825d9beaa526206f
SHA17c52367b81b160205a0867ecd49d89904fe51bac
SHA2560cc1e966502b69cf546abd8254badbb3d609beb81e885a75af7fd1e390412887
SHA5123d194dda00443830a2005da7ac5b453dd35e21596f7087b8e2749d58fe37d3161ea52dc11ea7a0ece65d3af48b0569fae74196d0675cbe9df0a7c30790f6315d
-
MD5
852203695064d9bdb7866d202652f014
SHA1d6b99b53edd24c41c2db995a8bf08eb1313ac830
SHA25620065bca35a51d2e9531143035c6650673d18b7ede5280326883cfabdebf3416
SHA51274318df6bd2dec420fad5a6ebf530ad5ffc51dc0e91a5e7ec0b596cefcf9531dcb6e2d10a8a57b32c6b0655b0e11c3cf87d1b63654a8e0e6c3ac8e70ca57c91e
-
MD5
516072070d0510a7dbde6e01b62bc6a2
SHA1b5bb093549e839d8266c2ab296c079dde39f3ebc
SHA256485d6028cf7a517b16da815141c76703a18d8a6471af77a0fc056a2ab133eea3
SHA512028bd8d6b7e57b6006748564598fc38ebd11bfdaa9d270d057582f6e9fcf4b0caf4e550f4c3ad536943465ef8c5335ad1446356ec25df1f00e4f49820a5c4a7a