Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 00:43
Behavioral task
behavioral1
Sample
twizt.exe
Resource
win7-20240221-en
General
-
Target
twizt.exe
-
Size
88KB
-
MD5
4505daf4c08fc8e8e1380911e98588aa
-
SHA1
d990eb1b2ccbb71c878944be37923b1ebd17bc72
-
SHA256
a2139600c569365149894405d411ea1401bafc8c7e8af1983d046cf087269c40
-
SHA512
bb57d11150086c3c61f9a8fdd2511e3e780a24362183a6b833f44484238451f23b74b244262009f38a8baa7254d07dfdd9d4209efcf426dfd4e651c47f2f8cec
-
SSDEEP
1536:yL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:+0poOfP6+JuEjaaKHK
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
sysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" sysmablsvr.exe -
Phorphiex payload 1 IoCs
Processes:
resource yara_rule C:\Windows\sysmablsvr.exe family_phorphiex -
Processes:
sysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
sysmablsvr.exe2733027882.exe3995231065.exepid process 1256 sysmablsvr.exe 2680 2733027882.exe 2596 3995231065.exe -
Loads dropped DLL 2 IoCs
Processes:
sysmablsvr.exe2733027882.exepid process 1256 sysmablsvr.exe 2680 2733027882.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
sysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysmablsvr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
twizt.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe" twizt.exe -
Drops file in Windows directory 2 IoCs
Processes:
twizt.exedescription ioc process File opened for modification C:\Windows\sysmablsvr.exe twizt.exe File created C:\Windows\sysmablsvr.exe twizt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
twizt.exesysmablsvr.exe2733027882.exedescription pid process target process PID 552 wrote to memory of 1256 552 twizt.exe sysmablsvr.exe PID 552 wrote to memory of 1256 552 twizt.exe sysmablsvr.exe PID 552 wrote to memory of 1256 552 twizt.exe sysmablsvr.exe PID 552 wrote to memory of 1256 552 twizt.exe sysmablsvr.exe PID 1256 wrote to memory of 2680 1256 sysmablsvr.exe 2733027882.exe PID 1256 wrote to memory of 2680 1256 sysmablsvr.exe 2733027882.exe PID 1256 wrote to memory of 2680 1256 sysmablsvr.exe 2733027882.exe PID 1256 wrote to memory of 2680 1256 sysmablsvr.exe 2733027882.exe PID 2680 wrote to memory of 2596 2680 2733027882.exe 3995231065.exe PID 2680 wrote to memory of 2596 2680 2733027882.exe 3995231065.exe PID 2680 wrote to memory of 2596 2680 2733027882.exe 3995231065.exe PID 2680 wrote to memory of 2596 2680 2733027882.exe 3995231065.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\twizt.exe"C:\Users\Admin\AppData\Local\Temp\twizt.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\sysmablsvr.exeC:\Windows\sysmablsvr.exe2⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2733027882.exeC:\Users\Admin\AppData\Local\Temp\2733027882.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3995231065.exeC:\Users\Admin\AppData\Local\Temp\3995231065.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\sysmablsvr.exeFilesize
88KB
MD54505daf4c08fc8e8e1380911e98588aa
SHA1d990eb1b2ccbb71c878944be37923b1ebd17bc72
SHA256a2139600c569365149894405d411ea1401bafc8c7e8af1983d046cf087269c40
SHA512bb57d11150086c3c61f9a8fdd2511e3e780a24362183a6b833f44484238451f23b74b244262009f38a8baa7254d07dfdd9d4209efcf426dfd4e651c47f2f8cec
-
\Users\Admin\AppData\Local\Temp\2733027882.exeFilesize
10KB
MD562a359fc04086f9293ce70140e9b72cc
SHA1125c91a4b5248316ed7a262acf936b8b4ab54a9f
SHA2566868e06c295e6335cf8a8d6c5cd56a1e9d9ecc4202b2fed9af2477b1d3f441ad
SHA5122241e3781cf099f2e36a9769602c71ccba1df0029e9b1949d0b35f529bf33b722f3db51739b6c720f7ff9e3d63e59de1815fff3753699bec7e9816eb5c3e6ac2
-
\Users\Admin\AppData\Local\Temp\3995231065.exeFilesize
20KB
MD55d1f5a6f5f6ea2e560c75673556e10c2
SHA1be03b3d220349f0fc856fd9548ab36cca2fea638
SHA256ff070a8f81124812406aba43a43f2ab2a0f1ca58cdfbff65705c8d1b2fe557b0
SHA5126cda9a5f0fec1e9d8afebc7d126c0ef1d4a2bf01822ee8bc494d060a1ccd9874056af0b812226c7cd895164c96bc9687c028ad6a5b4a5148fb86af2fd8af3121