Analysis
- max time kernel
149s - max time network
32s - platform
windows7_x64 - resource
win7v200430 - submitted
24/06/2020, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
payslip.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
payslip.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target payslip.exe
- Size 377KB
- Sample200624-ntdccp116j
- SHA256 c128856d5c14b0bdf9b327cc2abbec30cfdfb5c0692f7ac57bc22551037da339
- MD5 71d576e94e3417d6cb92868a5f11d6e4
- SHA1 1d0f81d6d2c82cc5c9f5a06dc08c1933a48389af
- SHA512 962fb7202e404c64dc84925744906fcf82a1893a69e6b0df051461fd86c821ee6c1d5f6e903f413044d50046dc7946e1210c1bf176029b93260ccdb718fba487
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1092 payslip.exe Token: SeDebugPrivilege 1892 payslip.exe Token: SeDebugPrivilege 1764 colorcpl.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1092 payslip.exe 1092 payslip.exe 1092 payslip.exe 1092 payslip.exe 1092 payslip.exe 1092 payslip.exe 1092 payslip.exe 1092 payslip.exe 1892 payslip.exe 1892 payslip.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe 1764 colorcpl.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1092 wrote to memory of 1892 1092 payslip.exe 27 PID 1092 wrote to memory of 1892 1092 payslip.exe 27 PID 1092 wrote to memory of 1892 1092 payslip.exe 27 PID 1092 wrote to memory of 1892 1092 payslip.exe 27 PID 1092 wrote to memory of 1892 1092 payslip.exe 27 PID 1092 wrote to memory of 1892 1092 payslip.exe 27 PID 1092 wrote to memory of 1892 1092 payslip.exe 27 PID 1320 wrote to memory of 1764 1320 Explorer.EXE 28 PID 1320 wrote to memory of 1764 1320 Explorer.EXE 28 PID 1320 wrote to memory of 1764 1320 Explorer.EXE 28 PID 1320 wrote to memory of 1764 1320 Explorer.EXE 28 PID 1764 wrote to memory of 1744 1764 colorcpl.exe 29 PID 1764 wrote to memory of 1744 1764 colorcpl.exe 29 PID 1764 wrote to memory of 1744 1764 colorcpl.exe 29 PID 1764 wrote to memory of 1744 1764 colorcpl.exe 29 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1092 set thread context of 1892 1092 payslip.exe 27 PID 1892 set thread context of 1320 1892 payslip.exe 20 PID 1764 set thread context of 1320 1764 colorcpl.exe 20 - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1892 payslip.exe 1892 payslip.exe 1892 payslip.exe 1764 colorcpl.exe 1764 colorcpl.exe - Deletes itself 1 IoCs
pid Process 1744 cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\payslip.exe"C:\Users\Admin\AppData\Local\Temp\payslip.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\payslip.exe"C:\Users\Admin\AppData\Local\Temp\payslip.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1892
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1764 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\payslip.exe"3⤵
- Deletes itself
PID:1744
-
-