b4d86013b4e92782a3d2cfb833720060949154ad61e5c4ff8848115ad77235f3

General

Target

ifififif.exe
Size

1.2MB
MD5

d71de7f78b4ceff3845de504bd84d1ec
SHA1

f37b1d1440e2817bba44d2e4486255aa9086d87f
SHA256

9d839079365af7cef63e51d9b4e8f751272cb753852dc67092ae84dde4bf1778
SHA512

395ad3bf20f96d21c878fc12a6c85f513d7918eee0ddf545cd9166a090a2c9691affb9c1e5b1e35ccb13b4561bceb7fa9410a1b8871340d75819c90affe8e4e2

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ififig.vbs	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2944 set thread context of 2088	2944	ifififif.exe	78

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2944	ifififif.exe
2944	ifififif.exe
3956	powershell.exe
3956	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2944	ifififif.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1792	2944	ifififif.exe	77
PID 2944 wrote to memory of 1792	2944	ifififif.exe	77
PID 2944 wrote to memory of 1792	2944	ifififif.exe	77
PID 2944 wrote to memory of 1792	2944	ifififif.exe	77
PID 2944 wrote to memory of 1792	2944	ifififif.exe	77
PID 2944 wrote to memory of 2088	2944	ifififif.exe	78
PID 2944 wrote to memory of 2088	2944	ifififif.exe	78
PID 2944 wrote to memory of 2088	2944	ifififif.exe	78
PID 2088 wrote to memory of 3280	2088	ifififif.exe	81
PID 2088 wrote to memory of 3280	2088	ifififif.exe	81
PID 2088 wrote to memory of 3280	2088	ifififif.exe	81
PID 3280 wrote to memory of 3956	3280	cmd.exe	83
PID 3280 wrote to memory of 3956	3280	cmd.exe	83
PID 3280 wrote to memory of 3956	3280	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\ifififif.exe
"C:\Users\Admin\AppData\Local\Temp\ifififif.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Drops startup file
  PID:1792
- C:\Users\Admin\AppData\Local\Temp\ifififif.exe
  "C:\Users\Admin\AppData\Local\Temp\ifififif.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\ifififif.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\ifififif.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-133-0x0000000000BF0000-0x0000000000CB4000-memory.dmp

Filesize
784KB

Download
memory/2088-134-0x0000000000BF0000-0x0000000000CB4000-memory.dmp

Filesize
784KB

Download
memory/2088-135-0x0000000004BF0000-0x0000000005194000-memory.dmp

Filesize
5.6MB

Download
memory/2088-136-0x00000000051F0000-0x000000000528C000-memory.dmp

Filesize
624KB

Download
memory/2088-137-0x0000000005350000-0x00000000053B6000-memory.dmp

Filesize
408KB

Download
memory/2088-138-0x0000000005720000-0x00000000057B2000-memory.dmp

Filesize
584KB

Download
memory/2944-130-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3956-141-0x0000000002480000-0x00000000024B6000-memory.dmp

Filesize
216KB

Download
memory/3956-142-0x0000000005290000-0x00000000058B8000-memory.dmp

Filesize
6.2MB

Download
memory/3956-143-0x0000000004DF0000-0x0000000004E12000-memory.dmp

Filesize
136KB

Download
memory/3956-144-0x0000000004F10000-0x0000000004F76000-memory.dmp

Filesize
408KB

Download
memory/3956-145-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

Filesize
120KB

Download
memory/3956-146-0x0000000007420000-0x0000000007A9A000-memory.dmp

Filesize
6.5MB

Download
memory/3956-147-0x00000000062B0000-0x00000000062CA000-memory.dmp

Filesize
104KB

Download
memory/3956-148-0x0000000006E40000-0x0000000006ED6000-memory.dmp

Filesize
600KB

Download
memory/3956-149-0x00000000063A0000-0x00000000063C2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing