Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 21:31
Static task
static1
Behavioral task
behavioral1
Sample
UNGO PAYMENT FORM08656049_DOC.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
UNGO PAYMENT FORM08656049_DOC.exe
Resource
win10
General
-
Target
UNGO PAYMENT FORM08656049_DOC.exe
-
Size
831KB
-
MD5
5310d3ed86e4e68a0d657ed3bb30acd5
-
SHA1
a4d46ab83ac7e30492b061e4ac95b9f5dd2e8905
-
SHA256
dea3774e5c5ae207131be64dec69219c8e0274ee90efc6914ceaedf551f255c6
-
SHA512
1768202776abb2bfccc2efcaa1024c46ca20f83d3e87fdb9739c03f838ff48df52241134fdd68376c8fe644492271d3f6366edff6ae9c3fb848cb593a0145dce
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
regsvc6l6hzln8.exeregsvc6l6hzln8.exepid process 1588 regsvc6l6hzln8.exe 1632 regsvc6l6hzln8.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
help.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run help.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1B3DUFW8NHJH = "C:\\Program Files (x86)\\Ygfyljfwp\\regsvc6l6hzln8.exe" help.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
UNGO PAYMENT FORM08656049_DOC.exeUNGO PAYMENT FORM08656049_DOC.exehelp.exeregsvc6l6hzln8.exeregsvc6l6hzln8.exepid process 888 UNGO PAYMENT FORM08656049_DOC.exe 1048 UNGO PAYMENT FORM08656049_DOC.exe 1048 UNGO PAYMENT FORM08656049_DOC.exe 1048 UNGO PAYMENT FORM08656049_DOC.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1588 regsvc6l6hzln8.exe 1632 regsvc6l6hzln8.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
help.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe help.exe File created C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe Explorer.EXE -
Suspicious use of SetThreadContext 5 IoCs
Processes:
UNGO PAYMENT FORM08656049_DOC.exeUNGO PAYMENT FORM08656049_DOC.exehelp.exeregsvc6l6hzln8.exedescription pid process target process PID 888 set thread context of 1048 888 UNGO PAYMENT FORM08656049_DOC.exe UNGO PAYMENT FORM08656049_DOC.exe PID 1048 set thread context of 1296 1048 UNGO PAYMENT FORM08656049_DOC.exe Explorer.EXE PID 1048 set thread context of 1296 1048 UNGO PAYMENT FORM08656049_DOC.exe Explorer.EXE PID 1376 set thread context of 1296 1376 help.exe Explorer.EXE PID 1588 set thread context of 1632 1588 regsvc6l6hzln8.exe regsvc6l6hzln8.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
UNGO PAYMENT FORM08656049_DOC.exehelp.exeregsvc6l6hzln8.exedescription pid process Token: SeDebugPrivilege 1048 UNGO PAYMENT FORM08656049_DOC.exe Token: SeDebugPrivilege 1376 help.exe Token: SeDebugPrivilege 1632 regsvc6l6hzln8.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1464 cmd.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE -
Loads dropped DLL 1 IoCs
Processes:
help.exepid process 1376 help.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
help.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer help.exe -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
UNGO PAYMENT FORM08656049_DOC.exeExplorer.EXEhelp.exeregsvc6l6hzln8.exedescription pid process target process PID 888 wrote to memory of 1048 888 UNGO PAYMENT FORM08656049_DOC.exe UNGO PAYMENT FORM08656049_DOC.exe PID 888 wrote to memory of 1048 888 UNGO PAYMENT FORM08656049_DOC.exe UNGO PAYMENT FORM08656049_DOC.exe PID 888 wrote to memory of 1048 888 UNGO PAYMENT FORM08656049_DOC.exe UNGO PAYMENT FORM08656049_DOC.exe PID 888 wrote to memory of 1048 888 UNGO PAYMENT FORM08656049_DOC.exe UNGO PAYMENT FORM08656049_DOC.exe PID 1296 wrote to memory of 1376 1296 Explorer.EXE help.exe PID 1296 wrote to memory of 1376 1296 Explorer.EXE help.exe PID 1296 wrote to memory of 1376 1296 Explorer.EXE help.exe PID 1296 wrote to memory of 1376 1296 Explorer.EXE help.exe PID 1376 wrote to memory of 1464 1376 help.exe cmd.exe PID 1376 wrote to memory of 1464 1376 help.exe cmd.exe PID 1376 wrote to memory of 1464 1376 help.exe cmd.exe PID 1376 wrote to memory of 1464 1376 help.exe cmd.exe PID 1376 wrote to memory of 1188 1376 help.exe Firefox.exe PID 1376 wrote to memory of 1188 1376 help.exe Firefox.exe PID 1376 wrote to memory of 1188 1376 help.exe Firefox.exe PID 1376 wrote to memory of 1188 1376 help.exe Firefox.exe PID 1376 wrote to memory of 1188 1376 help.exe Firefox.exe PID 1376 wrote to memory of 1432 1376 help.exe cmd.exe PID 1376 wrote to memory of 1432 1376 help.exe cmd.exe PID 1376 wrote to memory of 1432 1376 help.exe cmd.exe PID 1376 wrote to memory of 1432 1376 help.exe cmd.exe PID 1296 wrote to memory of 1588 1296 Explorer.EXE regsvc6l6hzln8.exe PID 1296 wrote to memory of 1588 1296 Explorer.EXE regsvc6l6hzln8.exe PID 1296 wrote to memory of 1588 1296 Explorer.EXE regsvc6l6hzln8.exe PID 1296 wrote to memory of 1588 1296 Explorer.EXE regsvc6l6hzln8.exe PID 1588 wrote to memory of 1632 1588 regsvc6l6hzln8.exe regsvc6l6hzln8.exe PID 1588 wrote to memory of 1632 1588 regsvc6l6hzln8.exe regsvc6l6hzln8.exe PID 1588 wrote to memory of 1632 1588 regsvc6l6hzln8.exe regsvc6l6hzln8.exe PID 1588 wrote to memory of 1632 1588 regsvc6l6hzln8.exe regsvc6l6hzln8.exe -
Suspicious behavior: MapViewOfSection 10 IoCs
Processes:
UNGO PAYMENT FORM08656049_DOC.exeUNGO PAYMENT FORM08656049_DOC.exehelp.exeregsvc6l6hzln8.exepid process 888 UNGO PAYMENT FORM08656049_DOC.exe 1048 UNGO PAYMENT FORM08656049_DOC.exe 1048 UNGO PAYMENT FORM08656049_DOC.exe 1048 UNGO PAYMENT FORM08656049_DOC.exe 1048 UNGO PAYMENT FORM08656049_DOC.exe 1376 help.exe 1376 help.exe 1376 help.exe 1376 help.exe 1588 regsvc6l6hzln8.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Adds Run entry to policy start application
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- System policy modification
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe"C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe"C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe
-
C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe
-
C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
\Users\Admin\AppData\Local\Temp\sqlite3.dll
-
memory/1048-1-0x000000000041C210-mapping.dmp
-
memory/1048-0-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1188-8-0x0000000000000000-mapping.dmp
-
memory/1188-9-0x000000013F530000-0x000000013F5C3000-memory.dmpFilesize
588KB
-
memory/1296-2-0x0000000007030000-0x0000000007181000-memory.dmpFilesize
1.3MB
-
memory/1376-4-0x0000000000270000-0x0000000000276000-memory.dmpFilesize
24KB
-
memory/1376-10-0x0000000003470000-0x000000000353E000-memory.dmpFilesize
824KB
-
memory/1376-7-0x0000000003470000-0x000000000353E000-memory.dmpFilesize
824KB
-
memory/1376-6-0x0000000001A70000-0x0000000001BDD000-memory.dmpFilesize
1.4MB
-
memory/1376-3-0x0000000000000000-mapping.dmp
-
memory/1432-12-0x0000000000000000-mapping.dmp
-
memory/1464-5-0x0000000000000000-mapping.dmp
-
memory/1588-14-0x0000000000000000-mapping.dmp
-
memory/1632-18-0x000000000041C210-mapping.dmp