Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 12:54
Static task
static1
Behavioral task
behavioral1
Sample
PRICE AND SPECIFICATION.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
PRICE AND SPECIFICATION.exe
Resource
win10
General
-
Target
PRICE AND SPECIFICATION.exe
-
Size
657KB
-
MD5
516f3f0b9f52bb65a396cb675c62b1fc
-
SHA1
d8e080586c8732542f871aa74e3aad882d59fa88
-
SHA256
fbf0680165efb20121f2cc3292421424ce7f8766b603579c1f7e9dfeee773ad3
-
SHA512
bab6acf0f9e5de8392adc6d5936fe81d45ad5a4f5851e27d40e558592155c437323b99622918baa803d3ec459d0644df33101e02889df3407b51c0def6faa285
Malware Config
Signatures
-
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PRICE AND SPECIFICATION.exePRICE AND SPECIFICATION.exeraserver.exedescription pid process target process PID 1400 set thread context of 1432 1400 PRICE AND SPECIFICATION.exe PRICE AND SPECIFICATION.exe PID 1432 set thread context of 1284 1432 PRICE AND SPECIFICATION.exe Explorer.EXE PID 1432 set thread context of 1284 1432 PRICE AND SPECIFICATION.exe Explorer.EXE PID 240 set thread context of 1284 240 raserver.exe Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PRICE AND SPECIFICATION.exeraserver.exedescription pid process Token: SeDebugPrivilege 1432 PRICE AND SPECIFICATION.exe Token: SeDebugPrivilege 240 raserver.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1604 cmd.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
raserver.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run raserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MHUPLPFPCNY = "C:\\Program Files (x86)\\Vtd_\\regsvck6qliv8.exe" raserver.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
raserver.exedescription ioc process File opened for modification C:\Program Files (x86)\Vtd_\regsvck6qliv8.exe raserver.exe -
Processes:
raserver.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
PRICE AND SPECIFICATION.exePRICE AND SPECIFICATION.exeraserver.exepid process 1400 PRICE AND SPECIFICATION.exe 1432 PRICE AND SPECIFICATION.exe 1432 PRICE AND SPECIFICATION.exe 1432 PRICE AND SPECIFICATION.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PRICE AND SPECIFICATION.exeExplorer.EXEraserver.exedescription pid process target process PID 1400 wrote to memory of 1432 1400 PRICE AND SPECIFICATION.exe PRICE AND SPECIFICATION.exe PID 1400 wrote to memory of 1432 1400 PRICE AND SPECIFICATION.exe PRICE AND SPECIFICATION.exe PID 1400 wrote to memory of 1432 1400 PRICE AND SPECIFICATION.exe PRICE AND SPECIFICATION.exe PID 1400 wrote to memory of 1432 1400 PRICE AND SPECIFICATION.exe PRICE AND SPECIFICATION.exe PID 1284 wrote to memory of 240 1284 Explorer.EXE raserver.exe PID 1284 wrote to memory of 240 1284 Explorer.EXE raserver.exe PID 1284 wrote to memory of 240 1284 Explorer.EXE raserver.exe PID 1284 wrote to memory of 240 1284 Explorer.EXE raserver.exe PID 240 wrote to memory of 1604 240 raserver.exe cmd.exe PID 240 wrote to memory of 1604 240 raserver.exe cmd.exe PID 240 wrote to memory of 1604 240 raserver.exe cmd.exe PID 240 wrote to memory of 1604 240 raserver.exe cmd.exe PID 240 wrote to memory of 1308 240 raserver.exe Firefox.exe PID 240 wrote to memory of 1308 240 raserver.exe Firefox.exe PID 240 wrote to memory of 1308 240 raserver.exe Firefox.exe PID 240 wrote to memory of 1308 240 raserver.exe Firefox.exe PID 240 wrote to memory of 1308 240 raserver.exe Firefox.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
PRICE AND SPECIFICATION.exePRICE AND SPECIFICATION.exeraserver.exepid process 1400 PRICE AND SPECIFICATION.exe 1432 PRICE AND SPECIFICATION.exe 1432 PRICE AND SPECIFICATION.exe 1432 PRICE AND SPECIFICATION.exe 1432 PRICE AND SPECIFICATION.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe 240 raserver.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\PRICE AND SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\PRICE AND SPECIFICATION.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\PRICE AND SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\PRICE AND SPECIFICATION.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PRICE AND SPECIFICATION.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\-823QC40\-82logim.jpeg
-
C:\Users\Admin\AppData\Roaming\-823QC40\-82logrf.ini
-
C:\Users\Admin\AppData\Roaming\-823QC40\-82logri.ini
-
C:\Users\Admin\AppData\Roaming\-823QC40\-82logrv.ini
-
memory/240-6-0x0000000001EC0000-0x0000000001F99000-memory.dmpFilesize
868KB
-
memory/240-7-0x00000000031D0000-0x00000000032E1000-memory.dmpFilesize
1.1MB
-
memory/240-4-0x0000000000AA0000-0x0000000000ABC000-memory.dmpFilesize
112KB
-
memory/240-3-0x0000000000000000-mapping.dmp
-
memory/1284-2-0x00000000062F0000-0x000000000641A000-memory.dmpFilesize
1.2MB
-
memory/1308-8-0x0000000000000000-mapping.dmp
-
memory/1308-9-0x000000013F130000-0x000000013F1C3000-memory.dmpFilesize
588KB
-
memory/1432-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1432-1-0x000000000041E2A0-mapping.dmp
-
memory/1604-5-0x0000000000000000-mapping.dmp