Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
12-07-2020 08:08
Static task
static1
Behavioral task
behavioral1
Sample
UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe
Resource
win10
General
-
Target
UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe
-
Size
296KB
-
MD5
8e35b423a18fafd76c7de83fafeae683
-
SHA1
ccaa813ae4f830e973032f4ed4dff91538efb8d4
-
SHA256
2427c640fc5ca5313c85c5a956571afdb1543d5964d3ce536b61262d73a9eaaa
-
SHA512
bdea8bfaedabc5463715c6d99d47a5f849d3eff354e35f65042cf9e0e15769a27b30c4c68f4483de00f524efa0e0b1124379827c0d0a8d115cc2ab4f9d0a136f
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1768 cmd.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
help.exedescription ioc process File opened for modification C:\Program Files (x86)\O7njlhx\vgamfyllflx.exe help.exe -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exeExplorer.EXEhelp.exedescription pid process target process PID 1296 wrote to memory of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1296 wrote to memory of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1296 wrote to memory of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1296 wrote to memory of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1296 wrote to memory of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1296 wrote to memory of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1296 wrote to memory of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1296 wrote to memory of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1296 wrote to memory of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1296 wrote to memory of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1304 wrote to memory of 1772 1304 Explorer.EXE help.exe PID 1304 wrote to memory of 1772 1304 Explorer.EXE help.exe PID 1304 wrote to memory of 1772 1304 Explorer.EXE help.exe PID 1304 wrote to memory of 1772 1304 Explorer.EXE help.exe PID 1772 wrote to memory of 1768 1772 help.exe cmd.exe PID 1772 wrote to memory of 1768 1772 help.exe cmd.exe PID 1772 wrote to memory of 1768 1772 help.exe cmd.exe PID 1772 wrote to memory of 1768 1772 help.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exehelp.exepid process 1764 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe 1764 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe 1764 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe 1772 help.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
help.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer help.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
help.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run help.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\-Z_XD4IX = "C:\\Program Files (x86)\\O7njlhx\\vgamfyllflx.exe" help.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exeUPDATED STATEMENT OF ACCOUNT-SOA.PDF.exehelp.exedescription pid process target process PID 1296 set thread context of 1764 1296 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe PID 1764 set thread context of 1304 1764 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe Explorer.EXE PID 1764 set thread context of 1304 1764 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe Explorer.EXE PID 1772 set thread context of 1304 1772 help.exe Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exehelp.exedescription pid process Token: SeDebugPrivilege 1764 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe Token: SeDebugPrivilege 1772 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exehelp.exepid process 1764 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe 1764 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe 1764 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe 1764 UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe 1772 help.exe 1772 help.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe"C:\Users\Admin\AppData\Local\Temp\UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
- Adds Run entry to policy start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\UPDATED STATEMENT OF ACCOUNT-SOA.PDF.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\7POO2RA3\7POlogim.jpeg
-
C:\Users\Admin\AppData\Roaming\7POO2RA3\7POlogri.ini
-
C:\Users\Admin\AppData\Roaming\7POO2RA3\7POlogrv.ini
-
memory/1296-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1304-4-0x0000000004EA0000-0x0000000004FB8000-memory.dmpFilesize
1.1MB
-
memory/1764-2-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1764-3-0x000000000041B650-mapping.dmp
-
memory/1768-7-0x0000000000000000-mapping.dmp
-
memory/1772-5-0x0000000000000000-mapping.dmp
-
memory/1772-6-0x0000000000600000-0x0000000000606000-memory.dmpFilesize
24KB
-
memory/1772-8-0x0000000000750000-0x0000000000830000-memory.dmpFilesize
896KB