8c55df1fdc1ac49e2c0a3b5b77bd044d842d2f6e38bd5f782d93853a560140fb

General

Target

MT103 PAYMENT COPY_PDF.exe
Size

369KB
MD5

20a2543a7a37a75b93924dd83c03743d
SHA1

dacf53a9ae5c29a1d33fb2bf064ede984a0ad379
SHA256

8c55df1fdc1ac49e2c0a3b5b77bd044d842d2f6e38bd5f782d93853a560140fb
SHA512

3c49d4b09b5510e9a2ea24e75c9bf694a006cd31b9d06546aa08ac369cb8464916c40c7d0db566ef82d4b147e265582f5d081c26f3b6ad9e99f6c792c9be0d10

Score

8^/10

evasion trojan persistence spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

MT103 PAYMENT COPY_PDF.exe

pid process

1516 MT103 PAYMENT COPY_PDF.exe
Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE
1212 Explorer.EXE
1212 Explorer.EXE
1212 Explorer.EXE
1212 Explorer.EXE
1212 Explorer.EXE
1212 Explorer.EXE
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE
1212 Explorer.EXE
1212 Explorer.EXE
1212 Explorer.EXE
1212 Explorer.EXE
1212 Explorer.EXE
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Explorer.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

cmstp.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cmstp.exe

pid	process
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

pid	process
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cmstp.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cmstp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cmstp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YJRPUFWH5L = "C:\\Program Files (x86)\\Mgzvh\\IconCachewnd0n4.exe"	cmstp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

MT103 PAYMENT COPY_PDF.exeMT103 PAYMENT COPY_PDF.execmstp.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1516	MT103 PAYMENT COPY_PDF.exe
Token: SeDebugPrivilege	1752	MT103 PAYMENT COPY_PDF.exe
Token: SeDebugPrivilege	1936	cmstp.exe
Token: SeShutdownPrivilege	1212	Explorer.EXE

Executes dropped EXE 1 IoCs

Processes:

MT103 PAYMENT COPY_PDF.exe

pid process

1752 MT103 PAYMENT COPY_PDF.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

cmstp.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmstp.exe

Drops file in Program Files directory 1 IoCs

Processes:

cmstp.exe

description ioc process

File opened for modification C:\Program Files (x86)\Mgzvh\IconCachewnd0n4.exe cmstp.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Mgzvh\IconCachewnd0n4.exe	cmstp.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

MT103 PAYMENT COPY_PDF.exeMT103 PAYMENT COPY_PDF.execmstp.exe

pid	process
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1516	MT103 PAYMENT COPY_PDF.exe
1752	MT103 PAYMENT COPY_PDF.exe
1752	MT103 PAYMENT COPY_PDF.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

MT103 PAYMENT COPY_PDF.exeMT103 PAYMENT COPY_PDF.execmstp.exe

description	pid	process	target process
PID 1516 set thread context of 1752	1516	MT103 PAYMENT COPY_PDF.exe	MT103 PAYMENT COPY_PDF.exe
PID 1752 set thread context of 1212	1752	MT103 PAYMENT COPY_PDF.exe	Explorer.EXE
PID 1936 set thread context of 1212	1936	cmstp.exe	Explorer.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

MT103 PAYMENT COPY_PDF.exeExplorer.EXEcmstp.exe

description	pid	process	target process
PID 1516 wrote to memory of 1752	1516	MT103 PAYMENT COPY_PDF.exe	MT103 PAYMENT COPY_PDF.exe
PID 1516 wrote to memory of 1752	1516	MT103 PAYMENT COPY_PDF.exe	MT103 PAYMENT COPY_PDF.exe
PID 1516 wrote to memory of 1752	1516	MT103 PAYMENT COPY_PDF.exe	MT103 PAYMENT COPY_PDF.exe
PID 1516 wrote to memory of 1752	1516	MT103 PAYMENT COPY_PDF.exe	MT103 PAYMENT COPY_PDF.exe
PID 1516 wrote to memory of 1752	1516	MT103 PAYMENT COPY_PDF.exe	MT103 PAYMENT COPY_PDF.exe
PID 1516 wrote to memory of 1752	1516	MT103 PAYMENT COPY_PDF.exe	MT103 PAYMENT COPY_PDF.exe
PID 1516 wrote to memory of 1752	1516	MT103 PAYMENT COPY_PDF.exe	MT103 PAYMENT COPY_PDF.exe
PID 1212 wrote to memory of 1936	1212	Explorer.EXE	cmstp.exe
PID 1212 wrote to memory of 1936	1212	Explorer.EXE	cmstp.exe
PID 1212 wrote to memory of 1936	1212	Explorer.EXE	cmstp.exe
PID 1212 wrote to memory of 1936	1212	Explorer.EXE	cmstp.exe
PID 1212 wrote to memory of 1936	1212	Explorer.EXE	cmstp.exe
PID 1212 wrote to memory of 1936	1212	Explorer.EXE	cmstp.exe
PID 1212 wrote to memory of 1936	1212	Explorer.EXE	cmstp.exe
PID 1936 wrote to memory of 1952	1936	cmstp.exe	cmd.exe
PID 1936 wrote to memory of 1952	1936	cmstp.exe	cmd.exe
PID 1936 wrote to memory of 1952	1936	cmstp.exe	cmd.exe
PID 1936 wrote to memory of 1952	1936	cmstp.exe	cmd.exe
PID 1936 wrote to memory of 1020	1936	cmstp.exe	Firefox.exe
PID 1936 wrote to memory of 1020	1936	cmstp.exe	Firefox.exe
PID 1936 wrote to memory of 1020	1936	cmstp.exe	Firefox.exe
PID 1936 wrote to memory of 1020	1936	cmstp.exe	Firefox.exe
PID 1936 wrote to memory of 1020	1936	cmstp.exe	Firefox.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

MT103 PAYMENT COPY_PDF.execmstp.exe

pid	process
1752	MT103 PAYMENT COPY_PDF.exe
1752	MT103 PAYMENT COPY_PDF.exe
1752	MT103 PAYMENT COPY_PDF.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe
1936	cmstp.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516

C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1752

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1872

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1864

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1888

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1880

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1896

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1912

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1908

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1928

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1920

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1944

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
- System policy modification
- Adds policy Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1936

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"
3⤵
PID:1952

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe

Download Submit
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logim.jpeg

Download Submit
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logrf.ini

Download Submit
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logri.ini

Download Submit
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logrv.ini

Download Submit
\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe

Download Submit
memory/1020-11-0x0000000000000000-mapping.dmp

Download
memory/1020-12-0x000000013F290000-0x000000013F323000-memory.dmp

Filesize
588KB

Download
memory/1752-1-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1752-2-0x000000000041E2D0-mapping.dmp

Download
memory/1936-4-0x0000000000000000-mapping.dmp

Download
memory/1936-10-0x0000000003240000-0x000000000330E000-memory.dmp

Filesize
824KB

Download
memory/1936-9-0x0000000076A70000-0x0000000076B8D000-memory.dmp

Filesize
1.1MB

Download
memory/1936-8-0x0000000077030000-0x000000007703C000-memory.dmp

Filesize
48KB

Download
memory/1936-7-0x0000000003010000-0x0000000003148000-memory.dmp

Filesize
1.2MB

Download
memory/1936-5-0x0000000000E20000-0x0000000000E38000-memory.dmp

Filesize
96KB

Download
memory/1952-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads