Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
05-10-2023 09:30
Static task
static1
Behavioral task
behavioral1
Sample
2023 Customer Information Export(1).doc.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023 Customer Information Export(1).doc.exe
Resource
win10v2004-20230915-en
General
-
Target
2023 Customer Information Export(1).doc.exe
-
Size
690KB
-
MD5
decf06be9f0c0eed2d93bf190ba4b99b
-
SHA1
e4aa992415440850a9e0a17b2038c066d952bf4f
-
SHA256
4d845e9e862b6cc61cf4909f4c16c2330483ba62d32c977c0080020a841bf3e1
-
SHA512
a00a7ffba5a666d19fdeccf7c8520e1bee55f72bbe6e4802565b131040adfeb5e1590af23d8d066ef2d38b63aeb51ac1bbc203b07c7ccc252b8d78315ece8ec3
-
SSDEEP
12288:s44lO9ZVrJDoPAYzy8DjzzUl1XW9OSJLIF:s44lkl0N2kzzu1XW9OOMF
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZYybOms = "C:\\Users\\Admin\\AppData\\Roaming\\ZYybOms\\ZYybOms.exe" RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 924 set thread context of 2684 924 2023 Customer Information Export(1).doc.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2820 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 924 2023 Customer Information Export(1).doc.exe 924 2023 Customer Information Export(1).doc.exe 2684 RegSvcs.exe 2684 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 924 2023 Customer Information Export(1).doc.exe Token: SeDebugPrivilege 2684 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2684 RegSvcs.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 924 wrote to memory of 2820 924 2023 Customer Information Export(1).doc.exe 30 PID 924 wrote to memory of 2820 924 2023 Customer Information Export(1).doc.exe 30 PID 924 wrote to memory of 2820 924 2023 Customer Information Export(1).doc.exe 30 PID 924 wrote to memory of 2820 924 2023 Customer Information Export(1).doc.exe 30 PID 924 wrote to memory of 2716 924 2023 Customer Information Export(1).doc.exe 32 PID 924 wrote to memory of 2716 924 2023 Customer Information Export(1).doc.exe 32 PID 924 wrote to memory of 2716 924 2023 Customer Information Export(1).doc.exe 32 PID 924 wrote to memory of 2716 924 2023 Customer Information Export(1).doc.exe 32 PID 924 wrote to memory of 2716 924 2023 Customer Information Export(1).doc.exe 32 PID 924 wrote to memory of 2716 924 2023 Customer Information Export(1).doc.exe 32 PID 924 wrote to memory of 2716 924 2023 Customer Information Export(1).doc.exe 32 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33 PID 924 wrote to memory of 2684 924 2023 Customer Information Export(1).doc.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023 Customer Information Export(1).doc.exe"C:\Users\Admin\AppData\Local\Temp\2023 Customer Information Export(1).doc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hETSNfSV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F58.tmp"2⤵
- Creates scheduled task(s)
PID:2820
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:2716
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cfb335a7e9713d21fafe09795c4c3ba4
SHA1980041b840b0bac29a520cf73aacf914fb0cb221
SHA256a074a1949d37b7486bcae6428aa16936c77a60208549b81fb635a21865ca812b
SHA51239d5a30724eeba49416bb8aaa007fe92798218ca669fb7275c5ebeecf8c72b9699c845eefbecd21b193ee1cefd216d5360158e0d8749bb788a6cc3dbdaa74967