dea3774e5c5ae207131be64dec69219c8e0274ee90efc6914ceaedf551f255c6

General

Target

UNGO PAYMENT FORM08656049_DOC.exe
Size

831KB
MD5

5310d3ed86e4e68a0d657ed3bb30acd5
SHA1

a4d46ab83ac7e30492b061e4ac95b9f5dd2e8905
SHA256

dea3774e5c5ae207131be64dec69219c8e0274ee90efc6914ceaedf551f255c6
SHA512

1768202776abb2bfccc2efcaa1024c46ca20f83d3e87fdb9739c03f838ff48df52241134fdd68376c8fe644492271d3f6366edff6ae9c3fb848cb593a0145dce

Score

8^/10

evasion trojan persistence spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

regsvc6l6hzln8.exeregsvc6l6hzln8.exe

pid process

1588 regsvc6l6hzln8.exe
1632 regsvc6l6hzln8.exe

pid	process
1588	regsvc6l6hzln8.exe
1632	regsvc6l6hzln8.exe

Adds Run entry to policy start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

help.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	help.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1B3DUFW8NHJH = "C:\\Program Files (x86)\\Ygfyljfwp\\regsvc6l6hzln8.exe"	help.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

UNGO PAYMENT FORM08656049_DOC.exeUNGO PAYMENT FORM08656049_DOC.exehelp.exeregsvc6l6hzln8.exeregsvc6l6hzln8.exe

pid	process
888	UNGO PAYMENT FORM08656049_DOC.exe
1048	UNGO PAYMENT FORM08656049_DOC.exe
1048	UNGO PAYMENT FORM08656049_DOC.exe
1048	UNGO PAYMENT FORM08656049_DOC.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1588	regsvc6l6hzln8.exe
1632	regsvc6l6hzln8.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Explorer.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Drops file in Program Files directory 2 IoCs

Processes:

help.exeExplorer.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe	help.exe
File created	C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe	Explorer.EXE

Suspicious use of SetThreadContext 5 IoCs

Processes:

UNGO PAYMENT FORM08656049_DOC.exeUNGO PAYMENT FORM08656049_DOC.exehelp.exeregsvc6l6hzln8.exe

description	pid	process	target process
PID 888 set thread context of 1048	888	UNGO PAYMENT FORM08656049_DOC.exe	UNGO PAYMENT FORM08656049_DOC.exe
PID 1048 set thread context of 1296	1048	UNGO PAYMENT FORM08656049_DOC.exe	Explorer.EXE
PID 1048 set thread context of 1296	1048	UNGO PAYMENT FORM08656049_DOC.exe	Explorer.EXE
PID 1376 set thread context of 1296	1376	help.exe	Explorer.EXE
PID 1588 set thread context of 1632	1588	regsvc6l6hzln8.exe	regsvc6l6hzln8.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

UNGO PAYMENT FORM08656049_DOC.exehelp.exeregsvc6l6hzln8.exe

description	pid	process
Token: SeDebugPrivilege	1048	UNGO PAYMENT FORM08656049_DOC.exe
Token: SeDebugPrivilege	1376	help.exe
Token: SeDebugPrivilege	1632	regsvc6l6hzln8.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1464 cmd.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
Loads dropped DLL 1 IoCs

Processes:

help.exe

pid process

1376 help.exe
System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

help.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer help.exe

pid	process
1464	cmd.exe

pid	process
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE

pid	process
1376	help.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	help.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

help.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	help.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

UNGO PAYMENT FORM08656049_DOC.exeExplorer.EXEhelp.exeregsvc6l6hzln8.exe

description	pid	process	target process
PID 888 wrote to memory of 1048	888	UNGO PAYMENT FORM08656049_DOC.exe	UNGO PAYMENT FORM08656049_DOC.exe
PID 888 wrote to memory of 1048	888	UNGO PAYMENT FORM08656049_DOC.exe	UNGO PAYMENT FORM08656049_DOC.exe
PID 888 wrote to memory of 1048	888	UNGO PAYMENT FORM08656049_DOC.exe	UNGO PAYMENT FORM08656049_DOC.exe
PID 888 wrote to memory of 1048	888	UNGO PAYMENT FORM08656049_DOC.exe	UNGO PAYMENT FORM08656049_DOC.exe
PID 1296 wrote to memory of 1376	1296	Explorer.EXE	help.exe
PID 1296 wrote to memory of 1376	1296	Explorer.EXE	help.exe
PID 1296 wrote to memory of 1376	1296	Explorer.EXE	help.exe
PID 1296 wrote to memory of 1376	1296	Explorer.EXE	help.exe
PID 1376 wrote to memory of 1464	1376	help.exe	cmd.exe
PID 1376 wrote to memory of 1464	1376	help.exe	cmd.exe
PID 1376 wrote to memory of 1464	1376	help.exe	cmd.exe
PID 1376 wrote to memory of 1464	1376	help.exe	cmd.exe
PID 1376 wrote to memory of 1188	1376	help.exe	Firefox.exe
PID 1376 wrote to memory of 1188	1376	help.exe	Firefox.exe
PID 1376 wrote to memory of 1188	1376	help.exe	Firefox.exe
PID 1376 wrote to memory of 1188	1376	help.exe	Firefox.exe
PID 1376 wrote to memory of 1188	1376	help.exe	Firefox.exe
PID 1376 wrote to memory of 1432	1376	help.exe	cmd.exe
PID 1376 wrote to memory of 1432	1376	help.exe	cmd.exe
PID 1376 wrote to memory of 1432	1376	help.exe	cmd.exe
PID 1376 wrote to memory of 1432	1376	help.exe	cmd.exe
PID 1296 wrote to memory of 1588	1296	Explorer.EXE	regsvc6l6hzln8.exe
PID 1296 wrote to memory of 1588	1296	Explorer.EXE	regsvc6l6hzln8.exe
PID 1296 wrote to memory of 1588	1296	Explorer.EXE	regsvc6l6hzln8.exe
PID 1296 wrote to memory of 1588	1296	Explorer.EXE	regsvc6l6hzln8.exe
PID 1588 wrote to memory of 1632	1588	regsvc6l6hzln8.exe	regsvc6l6hzln8.exe
PID 1588 wrote to memory of 1632	1588	regsvc6l6hzln8.exe	regsvc6l6hzln8.exe
PID 1588 wrote to memory of 1632	1588	regsvc6l6hzln8.exe	regsvc6l6hzln8.exe
PID 1588 wrote to memory of 1632	1588	regsvc6l6hzln8.exe	regsvc6l6hzln8.exe

Suspicious behavior: MapViewOfSection 10 IoCs

Processes:

UNGO PAYMENT FORM08656049_DOC.exeUNGO PAYMENT FORM08656049_DOC.exehelp.exeregsvc6l6hzln8.exe

pid	process
888	UNGO PAYMENT FORM08656049_DOC.exe
1048	UNGO PAYMENT FORM08656049_DOC.exe
1048	UNGO PAYMENT FORM08656049_DOC.exe
1048	UNGO PAYMENT FORM08656049_DOC.exe
1048	UNGO PAYMENT FORM08656049_DOC.exe
1376	help.exe
1376	help.exe
1376	help.exe
1376	help.exe
1588	regsvc6l6hzln8.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Explorer.EXE

pid process

1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE

pid	process
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
PID:1296

C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe
"C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:888

C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe
"C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1048

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Adds Run entry to policy start application
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- System policy modification
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1376

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\UNGO PAYMENT FORM08656049_DOC.exe"
3⤵
- Deletes itself
PID:1464

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1188

C:\Windows\SysWOW64\cmd.exe
/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
3⤵
PID:1432

C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe
"C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1588

C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe
"C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe

Download Submit
C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe

Download Submit
C:\Program Files (x86)\Ygfyljfwp\regsvc6l6hzln8.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB1

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll

Download Submit
memory/1048-1-0x000000000041C210-mapping.dmp

Download
memory/1048-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1188-8-0x0000000000000000-mapping.dmp

Download
memory/1188-9-0x000000013F530000-0x000000013F5C3000-memory.dmp

Filesize
588KB

Download
memory/1296-2-0x0000000007030000-0x0000000007181000-memory.dmp

Filesize
1.3MB

Download
memory/1376-4-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1376-10-0x0000000003470000-0x000000000353E000-memory.dmp

Filesize
824KB

Download
memory/1376-7-0x0000000003470000-0x000000000353E000-memory.dmp

Filesize
824KB

Download
memory/1376-6-0x0000000001A70000-0x0000000001BDD000-memory.dmp

Filesize
1.4MB

Download
memory/1376-3-0x0000000000000000-mapping.dmp

Download
memory/1432-12-0x0000000000000000-mapping.dmp

Download
memory/1464-5-0x0000000000000000-mapping.dmp

Download
memory/1588-14-0x0000000000000000-mapping.dmp

Download
memory/1632-18-0x000000000041C210-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads