768540de4df55eedd3b6bb4d9ec9bf3eee1fbe14270cd9e828d1e1a6a3893d02

Analysis

max time kernel
89s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2022, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Zusy.435740.23236.exe
Size 215KB
Sample220817-n86m2aaca6
SHA256 768540de4df55eedd3b6bb4d9ec9bf3eee1fbe14270cd9e828d1e1a6a3893d02
MD5 1ac432ab6bc101d9fb26e12095d98c99
SHA1 a66063f184f981681411fcee0e7b4e064cc65ad3
SHA512 c71901edc0839a6795dafddec3adcaa56fc10062bca71e5b2612502e8d16c1ebc133eec154b5df9b44dac5849a5a91d8bd52bf4e2dca074218ac9e8f640a42b5
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3044	7f658c82.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	checkip.amazonaws.com
13	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 4884	4988	SecuriteInfo.com.Variant.Zusy.435740.23236.exe	80

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
320	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4884	4988	SecuriteInfo.com.Variant.Zusy.435740.23236.exe	80
PID 4988 wrote to memory of 4884	4988	SecuriteInfo.com.Variant.Zusy.435740.23236.exe	80
PID 4988 wrote to memory of 4884	4988	SecuriteInfo.com.Variant.Zusy.435740.23236.exe	80
PID 4988 wrote to memory of 4884	4988	SecuriteInfo.com.Variant.Zusy.435740.23236.exe	80
PID 4988 wrote to memory of 4884	4988	SecuriteInfo.com.Variant.Zusy.435740.23236.exe	80
PID 4884 wrote to memory of 4812	4884	AppLaunch.exe	82
PID 4884 wrote to memory of 4812	4884	AppLaunch.exe	82
PID 4884 wrote to memory of 4812	4884	AppLaunch.exe	82
PID 4812 wrote to memory of 212	4812	cmd.exe	84
PID 4812 wrote to memory of 212	4812	cmd.exe	84
PID 4812 wrote to memory of 212	4812	cmd.exe	84
PID 4812 wrote to memory of 320	4812	cmd.exe	85
PID 4812 wrote to memory of 320	4812	cmd.exe	85
PID 4812 wrote to memory of 320	4812	cmd.exe	85
PID 4812 wrote to memory of 3044	4812	cmd.exe	86
PID 4812 wrote to memory of 3044	4812	cmd.exe	86
PID 4812 wrote to memory of 3044	4812	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.435740.23236.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.435740.23236.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2589.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d "C:\ProgramData\Media Checker v6.0.5"
      4⤵
      PID:212
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 4
      4⤵
      Delays execution with timeout.exe
      PID:320
  - - C:\ProgramData\Media Checker v6.0.5\7f658c82.exe
      "C:\ProgramData\Media Checker v6.0.5\7f658c82.exe"
      4⤵
      Executes dropped EXE
      PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

7f658c82.exe

Path C:\ProgramData\Media Checker v6.0.5\7f658c82.exe
Size 6.8MB
SHA256 0a0ac945940f0238ecd2c2c67b2e540ea5121fe07b2654ed5d8e17528dcf606e
MD5 847201056625638b5756893c2972e143
SHA1 a45afa87a77cf55f662aab952f77cd810cf7bfeb
SHA512 161561e9a645581521fbe5d6330c8968aaf05e157d1a182a7da7aa09580b85fcec6bbe39c9dbd4bb77804d52d7642f8f8ba9770658cf1a498803c13a8a8e3bad
SSDEEP 196608:fiObi9vL3lfHG59/GBn2MH2iP3j4k5QpjUz1QNCP:fiObuvL1fAG2MW6kkmpopQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

7f658c82.exe

Path C:\ProgramData\Media Checker v6.0.5\7f658c82.exe
Size 6.8MB
SHA256 0a0ac945940f0238ecd2c2c67b2e540ea5121fe07b2654ed5d8e17528dcf606e
MD5 847201056625638b5756893c2972e143
SHA1 a45afa87a77cf55f662aab952f77cd810cf7bfeb
SHA512 161561e9a645581521fbe5d6330c8968aaf05e157d1a182a7da7aa09580b85fcec6bbe39c9dbd4bb77804d52d7642f8f8ba9770658cf1a498803c13a8a8e3bad
SSDEEP 196608:fiObi9vL3lfHG59/GBn2MH2iP3j4k5QpjUz1QNCP:fiObuvL1fAG2MW6kkmpopQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp2589.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp2589.tmp.bat
Size 342B
SHA256 977c8990b2e3e9d06f78057edcf4f0ef5a8d7ada0db14c681ee89ad8b7e86c51
MD5 d05b115098aa5e080a968347faea18cc
SHA1 d5f8112e2d6825d36617a3c5cfeb0f14cb2637ce
SHA512 f5ac86657ef85c465a932e276726976889f84bae15b09272256968cade935c0e73279b4f0fe088d0e69379a92a7e6109bcc5d90bb0211f84fff59e4c86c44009
MD5 SHA1 SHA512

Submit Download

memory/4884-133-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4884-138-0x00000000052C0000-0x0000000005326000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads