Analysis
- max time kernel
47s - max time network
50s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
17/08/2022, 12:34
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Zusy.435740.7544.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Zusy.435740.7544.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target SecuriteInfo.com.Variant.Zusy.435740.7544.exe
- Size 215KB
- Sample220817-prrm8aaee8
- SHA256 6286a34f6c9835d44ef8dc06ae1f56bf8b9735abe78b38b06ba5be366a6164e1
- MD5 a257097c887574a9a1debae1da6a7700
- SHA1 586d283b9aa5f83a71482930d9cddb6bdda07018
- SHA512 639fed5ac948e3bd2c1b2533b17c4bb22c7b347fc606b4da4238d4523b34b7cac3f11b7f8b44b8e3aa53d9b615cf4b9bf2ebaec96ffb55cce0a409117fb377c2
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 524 6398c49d.exe - Loads dropped DLL 1 IoCs
pid Process 1252 cmd.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com 3 checkip.amazonaws.com - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1964 set thread context of 2028 1964 SecuriteInfo.com.Variant.Zusy.435740.7544.exe 26 - Delays execution with timeout.exe 1 IoCs
pid Process 1420 timeout.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2028 AppLaunch.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2028 1964 SecuriteInfo.com.Variant.Zusy.435740.7544.exe 26 PID 1964 wrote to memory of 2028 1964 SecuriteInfo.com.Variant.Zusy.435740.7544.exe 26 PID 1964 wrote to memory of 2028 1964 SecuriteInfo.com.Variant.Zusy.435740.7544.exe 26 PID 1964 wrote to memory of 2028 1964 SecuriteInfo.com.Variant.Zusy.435740.7544.exe 26 PID 1964 wrote to memory of 2028 1964 SecuriteInfo.com.Variant.Zusy.435740.7544.exe 26 PID 1964 wrote to memory of 2028 1964 SecuriteInfo.com.Variant.Zusy.435740.7544.exe 26 PID 1964 wrote to memory of 2028 1964 SecuriteInfo.com.Variant.Zusy.435740.7544.exe 26 PID 1964 wrote to memory of 2028 1964 SecuriteInfo.com.Variant.Zusy.435740.7544.exe 26 PID 1964 wrote to memory of 2028 1964 SecuriteInfo.com.Variant.Zusy.435740.7544.exe 26 PID 2028 wrote to memory of 1252 2028 AppLaunch.exe 28 PID 2028 wrote to memory of 1252 2028 AppLaunch.exe 28 PID 2028 wrote to memory of 1252 2028 AppLaunch.exe 28 PID 2028 wrote to memory of 1252 2028 AppLaunch.exe 28 PID 2028 wrote to memory of 1252 2028 AppLaunch.exe 28 PID 2028 wrote to memory of 1252 2028 AppLaunch.exe 28 PID 2028 wrote to memory of 1252 2028 AppLaunch.exe 28 PID 1252 wrote to memory of 388 1252 cmd.exe 30 PID 1252 wrote to memory of 388 1252 cmd.exe 30 PID 1252 wrote to memory of 388 1252 cmd.exe 30 PID 1252 wrote to memory of 388 1252 cmd.exe 30 PID 1252 wrote to memory of 388 1252 cmd.exe 30 PID 1252 wrote to memory of 388 1252 cmd.exe 30 PID 1252 wrote to memory of 388 1252 cmd.exe 30 PID 1252 wrote to memory of 1420 1252 cmd.exe 31 PID 1252 wrote to memory of 1420 1252 cmd.exe 31 PID 1252 wrote to memory of 1420 1252 cmd.exe 31 PID 1252 wrote to memory of 1420 1252 cmd.exe 31 PID 1252 wrote to memory of 1420 1252 cmd.exe 31 PID 1252 wrote to memory of 1420 1252 cmd.exe 31 PID 1252 wrote to memory of 1420 1252 cmd.exe 31 PID 1252 wrote to memory of 524 1252 cmd.exe 32 PID 1252 wrote to memory of 524 1252 cmd.exe 32 PID 1252 wrote to memory of 524 1252 cmd.exe 32 PID 1252 wrote to memory of 524 1252 cmd.exe 32 PID 1252 wrote to memory of 524 1252 cmd.exe 32 PID 1252 wrote to memory of 524 1252 cmd.exe 32 PID 1252 wrote to memory of 524 1252 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.435740.7544.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.435740.7544.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp68A3.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d "C:\ProgramData\Sound Graphics v7.1.6"4⤵PID:388
-
-
C:\Windows\SysWOW64\timeout.exetimeout 44⤵
- Delays execution with timeout.exe
PID:1420
-
-
C:\ProgramData\Sound Graphics v7.1.6\6398c49d.exe"C:\ProgramData\Sound Graphics v7.1.6\6398c49d.exe"4⤵
- Executes dropped EXE
PID:524
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Sound Graphics v7.1.6\6398c49d.exe
- Size 8.0MB
- SHA256 308f96590be06b5f1efeec8a24ad90b666517aa14ed98b1795457c5a20148439
- MD5 97b646727256da928f4b443641745f12
- SHA1 e45b7cd3b20b20b8bc862591ef1aa0c4c7771bf4
- SHA512 d96de562e4f08aae3f3a49c43f14dbebc877b295e72be7e6eb904f932b0f3cb2b0f0c5fc0e94e41e9d9406fab58413c21ff133792b4c331de567bd64a615da48
- SSDEEP 196608:texB5KRwowdRpfZbp0gohW/Kxn7FLLFcOwobiK5JLy9/qop:tebbvfb0gqWipJLLqAiK5JyM8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Sound Graphics v7.1.6\6398c49d.exe
- Size 8.0MB
- SHA256 308f96590be06b5f1efeec8a24ad90b666517aa14ed98b1795457c5a20148439
- MD5 97b646727256da928f4b443641745f12
- SHA1 e45b7cd3b20b20b8bc862591ef1aa0c4c7771bf4
- SHA512 d96de562e4f08aae3f3a49c43f14dbebc877b295e72be7e6eb904f932b0f3cb2b0f0c5fc0e94e41e9d9406fab58413c21ff133792b4c331de567bd64a615da48
- SSDEEP 196608:texB5KRwowdRpfZbp0gohW/Kxn7FLLFcOwobiK5JLy9/qop:tebbvfb0gqWipJLLqAiK5JyM8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp68A3.tmp.bat
- Size 344B
- SHA256 ca4ed5b332229bbf54b804195f6bdbdda22d8dadb5992cd95e24affa1d3a54d2
- MD5 50ce716d62d390c8e119c72f07ae1e32
- SHA1 7592ae14f2591d43994b4422e60647465a994cae
- SHA512 c9d52f6017a8f775202e3a49380de924b6a7db8a94acd04650111aade48a1636e487b353dadc1c74a204eecb99f77e377e2bbe7bc7b1444115254e52660d43a2
- MD5 SHA1 SHA512
- Path \ProgramData\Sound Graphics v7.1.6\6398c49d.exe
- Size 8.0MB
- SHA256 308f96590be06b5f1efeec8a24ad90b666517aa14ed98b1795457c5a20148439
- MD5 97b646727256da928f4b443641745f12
- SHA1 e45b7cd3b20b20b8bc862591ef1aa0c4c7771bf4
- SHA512 d96de562e4f08aae3f3a49c43f14dbebc877b295e72be7e6eb904f932b0f3cb2b0f0c5fc0e94e41e9d9406fab58413c21ff133792b4c331de567bd64a615da48
- SSDEEP 196608:texB5KRwowdRpfZbp0gohW/Kxn7FLLFcOwobiK5JLy9/qop:tebbvfb0gqWipJLLqAiK5JyM8
- MD5 SHA1 SHA512 SSDEEP