Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22-12-2021 11:56
Static task
static1
Behavioral task
behavioral1
Sample
wiretransfer009387489.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
wiretransfer009387489.exe
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
wiretransfer009387489.exe
-
Size
424KB
-
MD5
4f5e20c314951e30f5ca01a71559a62c
-
SHA1
8910f34119c522fed7dee3f545ed7aa67396baec
-
SHA256
467693bbef8580dd6eab668a628d44e94548710be1cc60799f8e17df8c63f88a
-
SHA512
e39657f0dbab0cf9056e41d753e8c26e83b4d2b23cafedbb3652e588bf248f538c1fa1ed6017c4cee5bfde8304cb6d1b521bc12191547321195f0578e160f012
Score
10/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\J3S7K4V2-L8C6-M6Q5-Y5I3-V6L7F1Y2X5G0 = "C:\\Users\\Admin\\AppData\\Roaming\\J3S7K4V2-L8C6-M6Q5-Y5I3-V6L7F1Y2X5G0\\J3S7K4V2-L8C6-M6Q5-Y5I3-V6L7F1Y2X5G0.exe" iexplore.exe -
Processes:
wiretransfer009387489.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" wiretransfer009387489.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\J3S7K4V2-L8C6-M6Q5-Y5I3-V6L7F1Y2X5G0 = "C:\\Users\\Admin\\AppData\\Roaming\\J3S7K4V2-L8C6-M6Q5-Y5I3-V6L7F1Y2X5G0\\J3S7K4V2-L8C6-M6Q5-Y5I3-V6L7F1Y2X5G0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\J3S7K4V2-L8C6-M6Q5-Y5I3-V6L7F1Y2X5G0 = "C:\\Users\\Admin\\AppData\\Roaming\\J3S7K4V2-L8C6-M6Q5-Y5I3-V6L7F1Y2X5G0\\J3S7K4V2-L8C6-M6Q5-Y5I3-V6L7F1Y2X5G0.exe" iexplore.exe -
Processes:
wiretransfer009387489.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wiretransfer009387489.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
wiretransfer009387489.exewiretransfer009387489.exedescription pid process target process PID 1524 set thread context of 752 1524 wiretransfer009387489.exe wiretransfer009387489.exe PID 752 set thread context of 1240 752 wiretransfer009387489.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
wiretransfer009387489.exepid process 752 wiretransfer009387489.exe 752 wiretransfer009387489.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 1240 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
wiretransfer009387489.exeiexplore.exepid process 752 wiretransfer009387489.exe 1240 iexplore.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
wiretransfer009387489.exewiretransfer009387489.exedescription pid process target process PID 1524 wrote to memory of 752 1524 wiretransfer009387489.exe wiretransfer009387489.exe PID 1524 wrote to memory of 752 1524 wiretransfer009387489.exe wiretransfer009387489.exe PID 1524 wrote to memory of 752 1524 wiretransfer009387489.exe wiretransfer009387489.exe PID 1524 wrote to memory of 752 1524 wiretransfer009387489.exe wiretransfer009387489.exe PID 1524 wrote to memory of 752 1524 wiretransfer009387489.exe wiretransfer009387489.exe PID 1524 wrote to memory of 752 1524 wiretransfer009387489.exe wiretransfer009387489.exe PID 1524 wrote to memory of 752 1524 wiretransfer009387489.exe wiretransfer009387489.exe PID 1524 wrote to memory of 752 1524 wiretransfer009387489.exe wiretransfer009387489.exe PID 752 wrote to memory of 1240 752 wiretransfer009387489.exe iexplore.exe PID 752 wrote to memory of 1240 752 wiretransfer009387489.exe iexplore.exe PID 752 wrote to memory of 1240 752 wiretransfer009387489.exe iexplore.exe PID 752 wrote to memory of 1240 752 wiretransfer009387489.exe iexplore.exe PID 752 wrote to memory of 1240 752 wiretransfer009387489.exe iexplore.exe PID 752 wrote to memory of 1240 752 wiretransfer009387489.exe iexplore.exe PID 752 wrote to memory of 1240 752 wiretransfer009387489.exe iexplore.exe PID 752 wrote to memory of 1240 752 wiretransfer009387489.exe iexplore.exe PID 752 wrote to memory of 1240 752 wiretransfer009387489.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
wiretransfer009387489.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wiretransfer009387489.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wiretransfer009387489.exe"C:\Users\Admin\AppData\Local\Temp\wiretransfer009387489.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wiretransfer009387489.exe"C:\Users\Admin\AppData\Local\Temp\wiretransfer009387489.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\wiretransfer009387489.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/752-63-0x00000000004010B8-mapping.dmp
-
memory/752-59-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/752-60-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/752-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/752-62-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/752-64-0x0000000000080000-0x0000000000086000-memory.dmpFilesize
24KB
-
memory/752-65-0x0000000000080000-0x000000000008A000-memory.dmpFilesize
40KB
-
memory/1240-66-0x0000000000401364-mapping.dmp
-
memory/1524-55-0x0000000075D51000-0x0000000075D53000-memory.dmpFilesize
8KB
-
memory/1524-56-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/1524-57-0x0000000000370000-0x0000000000378000-memory.dmpFilesize
32KB
-
memory/1524-58-0x0000000005A60000-0x0000000005ABC000-memory.dmpFilesize
368KB
-
memory/1524-53-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB