Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows7_x64 -
resource
win7 -
submitted
15-07-2020 13:44
Static task
static1
Behavioral task
behavioral1
Sample
MT103 PAYMENT COPY_PDF.exe
Resource
win7
Behavioral task
behavioral2
Sample
MT103 PAYMENT COPY_PDF.exe
Resource
win10
General
-
Target
MT103 PAYMENT COPY_PDF.exe
-
Size
369KB
-
MD5
20a2543a7a37a75b93924dd83c03743d
-
SHA1
dacf53a9ae5c29a1d33fb2bf064ede984a0ad379
-
SHA256
8c55df1fdc1ac49e2c0a3b5b77bd044d842d2f6e38bd5f782d93853a560140fb
-
SHA512
3c49d4b09b5510e9a2ea24e75c9bf694a006cd31b9d06546aa08ac369cb8464916c40c7d0db566ef82d4b147e265582f5d081c26f3b6ad9e99f6c792c9be0d10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exepid process 1516 MT103 PAYMENT COPY_PDF.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
cmstp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cmstp.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
cmstp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmstp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YJRPUFWH5L = "C:\\Program Files (x86)\\Mgzvh\\IconCachewnd0n4.exe" cmstp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exeMT103 PAYMENT COPY_PDF.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1516 MT103 PAYMENT COPY_PDF.exe Token: SeDebugPrivilege 1752 MT103 PAYMENT COPY_PDF.exe Token: SeDebugPrivilege 1936 cmstp.exe Token: SeShutdownPrivilege 1212 Explorer.EXE -
Executes dropped EXE 1 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exepid process 1752 MT103 PAYMENT COPY_PDF.exe -
Processes:
cmstp.exedescription ioc process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe -
Drops file in Program Files directory 1 IoCs
Processes:
cmstp.exedescription ioc process File opened for modification C:\Program Files (x86)\Mgzvh\IconCachewnd0n4.exe cmstp.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exeMT103 PAYMENT COPY_PDF.execmstp.exepid process 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1516 MT103 PAYMENT COPY_PDF.exe 1752 MT103 PAYMENT COPY_PDF.exe 1752 MT103 PAYMENT COPY_PDF.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exeMT103 PAYMENT COPY_PDF.execmstp.exedescription pid process target process PID 1516 set thread context of 1752 1516 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 1752 set thread context of 1212 1752 MT103 PAYMENT COPY_PDF.exe Explorer.EXE PID 1936 set thread context of 1212 1936 cmstp.exe Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exeExplorer.EXEcmstp.exedescription pid process target process PID 1516 wrote to memory of 1752 1516 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 1516 wrote to memory of 1752 1516 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 1516 wrote to memory of 1752 1516 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 1516 wrote to memory of 1752 1516 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 1516 wrote to memory of 1752 1516 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 1516 wrote to memory of 1752 1516 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 1516 wrote to memory of 1752 1516 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 1212 wrote to memory of 1936 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1936 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1936 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1936 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1936 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1936 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1936 1212 Explorer.EXE cmstp.exe PID 1936 wrote to memory of 1952 1936 cmstp.exe cmd.exe PID 1936 wrote to memory of 1952 1936 cmstp.exe cmd.exe PID 1936 wrote to memory of 1952 1936 cmstp.exe cmd.exe PID 1936 wrote to memory of 1952 1936 cmstp.exe cmd.exe PID 1936 wrote to memory of 1020 1936 cmstp.exe Firefox.exe PID 1936 wrote to memory of 1020 1936 cmstp.exe Firefox.exe PID 1936 wrote to memory of 1020 1936 cmstp.exe Firefox.exe PID 1936 wrote to memory of 1020 1936 cmstp.exe Firefox.exe PID 1936 wrote to memory of 1020 1936 cmstp.exe Firefox.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
MT103 PAYMENT COPY_PDF.execmstp.exepid process 1752 MT103 PAYMENT COPY_PDF.exe 1752 MT103 PAYMENT COPY_PDF.exe 1752 MT103 PAYMENT COPY_PDF.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe 1936 cmstp.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- System policy modification
- Adds policy Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logim.jpeg
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logrf.ini
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logri.ini
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logrv.ini
-
\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe
-
memory/1020-11-0x0000000000000000-mapping.dmp
-
memory/1020-12-0x000000013F290000-0x000000013F323000-memory.dmpFilesize
588KB
-
memory/1752-1-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1752-2-0x000000000041E2D0-mapping.dmp
-
memory/1936-4-0x0000000000000000-mapping.dmp
-
memory/1936-10-0x0000000003240000-0x000000000330E000-memory.dmpFilesize
824KB
-
memory/1936-9-0x0000000076A70000-0x0000000076B8D000-memory.dmpFilesize
1.1MB
-
memory/1936-8-0x0000000077030000-0x000000007703C000-memory.dmpFilesize
48KB
-
memory/1936-7-0x0000000003010000-0x0000000003148000-memory.dmpFilesize
1.2MB
-
memory/1936-5-0x0000000000E20000-0x0000000000E38000-memory.dmpFilesize
96KB
-
memory/1952-6-0x0000000000000000-mapping.dmp