Analysis
-
max time kernel
145s -
max time network
131s -
platform
windows10_x64 -
resource
win10 -
submitted
31-07-2020 09:25
Static task
static1
Behavioral task
behavioral1
Sample
Confirmation voucher.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
Confirmation voucher.exe
-
Size
1.1MB
-
MD5
7c239ebd95edce558af5ab4ba444a20e
-
SHA1
72b95da770016af3be66101db42c191d60685d7f
-
SHA256
0cd1ca47d2e04de65562e1ba4d8ce4545ee486999f8f0eb7adc880c7fb7fc9b8
-
SHA512
bf4ad36a62ef6583dc82674767fcadffa23d5667d664e08c36cc3e05a3368ac269463dfd446be5f00db07e2918c8705190398a97a4b538ab4c61705262d5542d
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
okxjgnm.pifRegSvcs.exeRegSvcs.exepid process 1692 okxjgnm.pif 628 RegSvcs.exe 552 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
RegSvcs.exeExplorer.EXEcmstp.exedescription pid process Token: SeDebugPrivilege 628 RegSvcs.exe Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeDebugPrivilege 860 cmstp.exe Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.execmstp.exepid process 628 RegSvcs.exe 628 RegSvcs.exe 628 RegSvcs.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 1 IoCs
Processes:
cmstp.exedescription ioc process File opened for modification C:\Program Files (x86)\Tid-hdx6p\ujop_rp8yvy4dbt.exe cmstp.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cmstp.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmstp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZB_LG8L0VF = "C:\\Program Files (x86)\\Tid-hdx6p\\ujop_rp8yvy4dbt.exe" cmstp.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Confirmation voucher.exeokxjgnm.pifExplorer.EXEcmstp.exedescription pid process target process PID 3020 wrote to memory of 1692 3020 Confirmation voucher.exe okxjgnm.pif PID 3020 wrote to memory of 1692 3020 Confirmation voucher.exe okxjgnm.pif PID 3020 wrote to memory of 1692 3020 Confirmation voucher.exe okxjgnm.pif PID 1692 wrote to memory of 552 1692 okxjgnm.pif RegSvcs.exe PID 1692 wrote to memory of 552 1692 okxjgnm.pif RegSvcs.exe PID 1692 wrote to memory of 552 1692 okxjgnm.pif RegSvcs.exe PID 1692 wrote to memory of 628 1692 okxjgnm.pif RegSvcs.exe PID 1692 wrote to memory of 628 1692 okxjgnm.pif RegSvcs.exe PID 1692 wrote to memory of 628 1692 okxjgnm.pif RegSvcs.exe PID 1692 wrote to memory of 628 1692 okxjgnm.pif RegSvcs.exe PID 1692 wrote to memory of 628 1692 okxjgnm.pif RegSvcs.exe PID 1692 wrote to memory of 628 1692 okxjgnm.pif RegSvcs.exe PID 3000 wrote to memory of 860 3000 Explorer.EXE cmstp.exe PID 3000 wrote to memory of 860 3000 Explorer.EXE cmstp.exe PID 3000 wrote to memory of 860 3000 Explorer.EXE cmstp.exe PID 860 wrote to memory of 472 860 cmstp.exe cmd.exe PID 860 wrote to memory of 472 860 cmstp.exe cmd.exe PID 860 wrote to memory of 472 860 cmstp.exe cmd.exe PID 860 wrote to memory of 3904 860 cmstp.exe cmd.exe PID 860 wrote to memory of 3904 860 cmstp.exe cmd.exe PID 860 wrote to memory of 3904 860 cmstp.exe cmd.exe PID 860 wrote to memory of 3828 860 cmstp.exe Firefox.exe PID 860 wrote to memory of 3828 860 cmstp.exe Firefox.exe PID 860 wrote to memory of 3828 860 cmstp.exe Firefox.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
okxjgnm.pifRegSvcs.execmstp.exedescription pid process target process PID 1692 set thread context of 628 1692 okxjgnm.pif RegSvcs.exe PID 628 set thread context of 3000 628 RegSvcs.exe Explorer.EXE PID 860 set thread context of 3000 860 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
RegSvcs.execmstp.exepid process 628 RegSvcs.exe 628 RegSvcs.exe 628 RegSvcs.exe 628 RegSvcs.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe 860 cmstp.exe -
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/628-5-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/628-5-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/628-6-0x000000000041E300-mapping.dmp formbook behavioral2/memory/860-11-0x0000000000000000-mapping.dmp formbook -
Processes:
cmstp.exedescription ioc process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirmation voucher.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation voucher.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\52828230\okxjgnm.pif"C:\Users\Admin\AppData\Roaming\52828230\okxjgnm.pif" xllpdbhw.ifs3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
-
C:\Users\Admin\AppData\Roaming\52828230\bbdkgohw.ico
-
C:\Users\Admin\AppData\Roaming\52828230\okxjgnm.pif
-
C:\Users\Admin\AppData\Roaming\52828230\okxjgnm.pif
-
C:\Users\Admin\AppData\Roaming\52828230\xllpdbhw.ifs
-
memory/472-14-0x0000000000000000-mapping.dmp
-
memory/628-5-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/628-6-0x000000000041E300-mapping.dmp
-
memory/860-11-0x0000000000000000-mapping.dmp
-
memory/860-13-0x00000000003F0000-0x0000000000406000-memory.dmpFilesize
88KB
-
memory/860-12-0x00000000003F0000-0x0000000000406000-memory.dmpFilesize
88KB
-
memory/860-15-0x00000000055E0000-0x00000000056D3000-memory.dmpFilesize
972KB
-
memory/860-18-0x0000000003230000-0x000000000330A000-memory.dmpFilesize
872KB
-
memory/1692-0-0x0000000000000000-mapping.dmp
-
memory/3828-19-0x0000000000000000-mapping.dmp
-
memory/3828-21-0x00007FF78E720000-0x00007FF78E7B3000-memory.dmpFilesize
588KB
-
memory/3828-20-0x00007FF78E720000-0x00007FF78E7B3000-memory.dmpFilesize
588KB
-
memory/3828-22-0x00007FF78E720000-0x00007FF78E7B3000-memory.dmpFilesize
588KB
-
memory/3904-16-0x0000000000000000-mapping.dmp