14f3aa7a57e22c80435145fe40f6f52aa8f2680425bb48b79285bb98be187053

General

Target

e-ticket.scr
Size

610KB
MD5

aa11dfd8b7f848595d4252db8f31ca05
SHA1

dc333aac83e4d3586bdf030bc81ba51e96ac6499
SHA256

b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c
SHA512

628bda240bfd73de4d6b268df462a85160f7b50f9cfd962f0d6fac0c67afa7bb42df6509649a8142e588c7316b84c41bc77d37677a696be64080545f265ecaa8
SSDEEP

12288:ZZ4DjeEs3opA/7QQ5BYLNLlNYp63xdusjHXNGxOFrZHU04B2BgL+:T4U/7QQPYd2ECsrXN+0mPDa

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1380	Explorer.EXE

Loads dropped DLL 1 IoCs

pid	Process
1196	regsvr32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\NifuBilz = "regsvr32.exe \"C:\\ProgramData\\NifuBilz\\NewaFewet.aqz\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\NifuBilz = "regsvr32.exe \"C:\\ProgramData\\NifuBilz\\NewaFewet.aqz\""	regsvr32.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1196	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1196	regsvr32.exe
Token: SeDebugPrivilege	1196	regsvr32.exe
Token: SeCreateGlobalPrivilege	1380	Explorer.EXE
Token: SeShutdownPrivilege	1380	Explorer.EXE
Token: SeDebugPrivilege	1380	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1196	1476	e-ticket.scr	27
PID 1476 wrote to memory of 1196	1476	e-ticket.scr	27
PID 1476 wrote to memory of 1196	1476	e-ticket.scr	27
PID 1476 wrote to memory of 1196	1476	e-ticket.scr	27
PID 1476 wrote to memory of 1196	1476	e-ticket.scr	27
PID 1476 wrote to memory of 1196	1476	e-ticket.scr	27
PID 1476 wrote to memory of 1196	1476	e-ticket.scr	27
PID 1196 wrote to memory of 284	1196	regsvr32.exe	16
PID 1196 wrote to memory of 284	1196	regsvr32.exe	16
PID 1196 wrote to memory of 1380	1196	regsvr32.exe	20
PID 1196 wrote to memory of 1380	1196	regsvr32.exe	20
PID 1196 wrote to memory of 956	1196	regsvr32.exe	23
PID 1196 wrote to memory of 956	1196	regsvr32.exe	23
PID 1196 wrote to memory of 1712	1196	regsvr32.exe	24
PID 1196 wrote to memory of 1712	1196	regsvr32.exe	24

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:284

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Adds Run key to start application
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1380
- C:\Users\Admin\AppData\Local\Temp\e-ticket.scr
  "C:\Users\Admin\AppData\Local\Temp\e-ticket.scr" /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\\~006C80D4.tmp"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1196

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:956

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\NifuBilz\NewaFewet.aqz

Filesize
280KB

MD5
5c96388c2af777962b6d863c97cdac29

SHA1
4bb2c2df85b29e158890ec5a0c2de7aaf47a368b

SHA256
5e85ee202d30a99889f3c138215031e1b3f3d820266b29332a918ecda1d7176d

SHA512
42c93bcbd693bdd4a2c2966f3aed8ffbb22a8f08873b8cfadb4034525089ca7f4676d245c81f341777d8ea1165aaa5faafeb107c6abb74382f2e01dc52ae0089

Download Submit
C:\Users\Admin\AppData\Local\Temp\~006C80D4.tmp

Filesize
280KB

MD5
5c96388c2af777962b6d863c97cdac29

SHA1
4bb2c2df85b29e158890ec5a0c2de7aaf47a368b

SHA256
5e85ee202d30a99889f3c138215031e1b3f3d820266b29332a918ecda1d7176d

SHA512
42c93bcbd693bdd4a2c2966f3aed8ffbb22a8f08873b8cfadb4034525089ca7f4676d245c81f341777d8ea1165aaa5faafeb107c6abb74382f2e01dc52ae0089

Download Submit
\Users\Admin\AppData\Local\Temp\~006C80D4.tmp

Filesize
280KB

MD5
5c96388c2af777962b6d863c97cdac29

SHA1
4bb2c2df85b29e158890ec5a0c2de7aaf47a368b

SHA256
5e85ee202d30a99889f3c138215031e1b3f3d820266b29332a918ecda1d7176d

SHA512
42c93bcbd693bdd4a2c2966f3aed8ffbb22a8f08873b8cfadb4034525089ca7f4676d245c81f341777d8ea1165aaa5faafeb107c6abb74382f2e01dc52ae0089

Download Submit
memory/284-68-0x0000000001F90000-0x0000000001FE8000-memory.dmp

Filesize
352KB

Download
memory/1196-58-0x0000000000000000-mapping.dmp

Download
memory/1196-64-0x0000000074630000-0x0000000074667000-memory.dmp

Filesize
220KB

Download
memory/1196-72-0x0000000074630000-0x0000000074699000-memory.dmp

Filesize
420KB

Download
memory/1196-78-0x0000000074630000-0x0000000074667000-memory.dmp

Filesize
220KB

Download
memory/1380-73-0x0000000002AF0000-0x0000000002B48000-memory.dmp

Filesize
352KB

Download
memory/1380-79-0x000007FFFFF00000-0x000007FFFFF6D000-memory.dmp

Filesize
436KB

Download
memory/1380-81-0x000007FFFFF00000-0x000007FFFFF6D000-memory.dmp

Filesize
436KB

Download
memory/1476-59-0x0000000002E60000-0x0000000002F80000-memory.dmp

Filesize
1.1MB

Download
memory/1476-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1476-56-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1476-55-0x0000000002E60000-0x0000000002F80000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads