Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28/02/2021, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe
Resource
win7v20201028
General
-
Target
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe
-
Size
695KB
-
MD5
75a0dff08308ea7de7a5a7a0528683de
-
SHA1
79fbffc4c4b90d58ea179ece6153302e8dd4012d
-
SHA256
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd
-
SHA512
2cd661e50aad22c1d2b113dbe0e92f5391bc370fc19b8adf2009431a2dfd48072bf15a65edf6089c562ffeabee4c8fc0ab556448cef7a0ea72b007bd0df9708c
Malware Config
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/files/0x000100000001ab75-38.dat disable_win_def behavioral2/files/0x000100000001ab75-39.dat disable_win_def -
Modifies visiblity of hidden/system files in Explorer 2 TTPs
-
Executes dropped EXE 6 IoCs
pid Process 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 3764 icsys.icn.exe 792 explorer.exe 212 spoolsv.exe 1504 svchost.exe 1500 spoolsv.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ip-api.com -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3824 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 3764 icsys.icn.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1504 svchost.exe 792 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe Token: SeDebugPrivilege 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 3764 icsys.icn.exe 3764 icsys.icn.exe 792 explorer.exe 792 explorer.exe 212 spoolsv.exe 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 212 spoolsv.exe 1504 svchost.exe 1504 svchost.exe 1500 spoolsv.exe 1500 spoolsv.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 648 wrote to memory of 3608 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 74 PID 648 wrote to memory of 3608 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 74 PID 648 wrote to memory of 3608 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 74 PID 648 wrote to memory of 3764 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 76 PID 648 wrote to memory of 3764 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 76 PID 648 wrote to memory of 3764 648 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 76 PID 3764 wrote to memory of 792 3764 icsys.icn.exe 77 PID 3764 wrote to memory of 792 3764 icsys.icn.exe 77 PID 3764 wrote to memory of 792 3764 icsys.icn.exe 77 PID 3608 wrote to memory of 3824 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 78 PID 3608 wrote to memory of 3824 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 78 PID 3608 wrote to memory of 3824 3608 b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe 78 PID 792 wrote to memory of 212 792 explorer.exe 80 PID 792 wrote to memory of 212 792 explorer.exe 80 PID 792 wrote to memory of 212 792 explorer.exe 80 PID 212 wrote to memory of 1504 212 spoolsv.exe 81 PID 212 wrote to memory of 1504 212 spoolsv.exe 81 PID 212 wrote to memory of 1504 212 spoolsv.exe 81 PID 1504 wrote to memory of 1500 1504 svchost.exe 82 PID 1504 wrote to memory of 1500 1504 svchost.exe 82 PID 1504 wrote to memory of 1500 1504 svchost.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe"C:\Users\Admin\AppData\Local\Temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\users\admin\appdata\local\temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exec:\users\admin\appdata\local\temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win10" /sc ONLOGON /tr "c:\users\admin\appdata\local\temp\b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd.exe " /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:3824
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
-
-
-