Analysis
- max time kernel
153s - max time network
33s - platform
windows7_x64 - resource
win7v200722 - submitted
14/10/2020, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT SWIFT ADVICE.exe
Resource
win7v200722
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PAYMENT SWIFT ADVICE.exe
Resource
win10
0 signatures
0 seconds
General
- Target PAYMENT SWIFT ADVICE.exe
- Size 5.5MB
- Sample201014-lb3mkymx5j
- SHA256 c62efee952c1bb4ff8e9fd28f3e477180010f8be162e6ddf8b8bfb42c78dfe2a
- MD5 42f83346f095d3d4c0351a9e36f7341e
- SHA1 0ba85429cca551d03f7d0e367c091dd7dfc58989
- SHA512 c70f5451163b239ebf1721d549a9585174b70fa01ca287324c7c736296b503d7f69322564494962a540fcad963fb019cbc3e4a2d3b1a7fd48728e53c4e03847b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs
- Executes dropped EXE 8 IoCs
pid Process 1840 PAYMENT SWIFT ADVICE.exe 1904 icsys.ico.exe 1960 wininit.exe 1808 svchost.exe 2008 spoolsv.exe 1768 PAYMENT SWIFT ADVICE.exe 1868 PAYMENT SWIFT ADVICE.exe 1008 PAYMENT SWIFT ADVICE.exe - Loads dropped DLL 7 IoCs
pid Process 748 PAYMENT SWIFT ADVICE.exe 748 PAYMENT SWIFT ADVICE.exe 1904 icsys.ico.exe 1960 wininit.exe 1840 PAYMENT SWIFT ADVICE.exe 1840 PAYMENT SWIFT ADVICE.exe 1840 PAYMENT SWIFT ADVICE.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PAYMENT SWIFT ADVICE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" PAYMENT SWIFT ADVICE.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" PAYMENT SWIFT ADVICE.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PAYMENT SWIFT ADVICE.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1840 set thread context of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\wininit.exe wininit.exe File opened for modification \??\c:\windows\wininit.exe spoolsv.exe File created \??\c:\windows\wininit.exe icsys.ico.exe File opened for modification \??\c:\windows\wininit.exe icsys.ico.exe File opened for modification \??\c:\windows\RCX73C9.tmp icsys.ico.exe - Suspicious behavior: EnumeratesProcesses 965 IoCs
pid Process 1904 icsys.ico.exe 1904 icsys.ico.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 2008 spoolsv.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1808 svchost.exe 1960 wininit.exe 1808 svchost.exe 1808 svchost.exe 1960 wininit.exe 1960 wininit.exe 1808 svchost.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1840 PAYMENT SWIFT ADVICE.exe 1840 PAYMENT SWIFT ADVICE.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1840 PAYMENT SWIFT ADVICE.exe 1840 PAYMENT SWIFT ADVICE.exe 1840 PAYMENT SWIFT ADVICE.exe 1840 PAYMENT SWIFT ADVICE.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe 1960 wininit.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1960 wininit.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1840 PAYMENT SWIFT ADVICE.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1960 wininit.exe - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 748 wrote to memory of 1840 748 PAYMENT SWIFT ADVICE.exe 25 PID 748 wrote to memory of 1840 748 PAYMENT SWIFT ADVICE.exe 25 PID 748 wrote to memory of 1840 748 PAYMENT SWIFT ADVICE.exe 25 PID 748 wrote to memory of 1840 748 PAYMENT SWIFT ADVICE.exe 25 PID 748 wrote to memory of 1904 748 PAYMENT SWIFT ADVICE.exe 26 PID 748 wrote to memory of 1904 748 PAYMENT SWIFT ADVICE.exe 26 PID 748 wrote to memory of 1904 748 PAYMENT SWIFT ADVICE.exe 26 PID 748 wrote to memory of 1904 748 PAYMENT SWIFT ADVICE.exe 26 PID 1904 wrote to memory of 1960 1904 icsys.ico.exe 27 PID 1904 wrote to memory of 1960 1904 icsys.ico.exe 27 PID 1904 wrote to memory of 1960 1904 icsys.ico.exe 27 PID 1904 wrote to memory of 1960 1904 icsys.ico.exe 27 PID 1904 wrote to memory of 1808 1904 icsys.ico.exe 28 PID 1904 wrote to memory of 1808 1904 icsys.ico.exe 28 PID 1904 wrote to memory of 1808 1904 icsys.ico.exe 28 PID 1904 wrote to memory of 1808 1904 icsys.ico.exe 28 PID 1960 wrote to memory of 2008 1960 wininit.exe 30 PID 1960 wrote to memory of 2008 1960 wininit.exe 30 PID 1960 wrote to memory of 2008 1960 wininit.exe 30 PID 1960 wrote to memory of 2008 1960 wininit.exe 30 PID 1840 wrote to memory of 1768 1840 PAYMENT SWIFT ADVICE.exe 35 PID 1840 wrote to memory of 1768 1840 PAYMENT SWIFT ADVICE.exe 35 PID 1840 wrote to memory of 1768 1840 PAYMENT SWIFT ADVICE.exe 35 PID 1840 wrote to memory of 1768 1840 PAYMENT SWIFT ADVICE.exe 35 PID 1840 wrote to memory of 1868 1840 PAYMENT SWIFT ADVICE.exe 36 PID 1840 wrote to memory of 1868 1840 PAYMENT SWIFT ADVICE.exe 36 PID 1840 wrote to memory of 1868 1840 PAYMENT SWIFT ADVICE.exe 36 PID 1840 wrote to memory of 1868 1840 PAYMENT SWIFT ADVICE.exe 36 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 PID 1840 wrote to memory of 1008 1840 PAYMENT SWIFT ADVICE.exe 37 - System policy modification 1 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" PAYMENT SWIFT ADVICE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" PAYMENT SWIFT ADVICE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" PAYMENT SWIFT ADVICE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" PAYMENT SWIFT ADVICE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" PAYMENT SWIFT ADVICE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" PAYMENT SWIFT ADVICE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" icsys.ico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT SWIFT ADVICE.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT SWIFT ADVICE.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:748 -
C:\Users\Admin\AppData\Local\Temp\PAYMENT SWIFT ADVICE.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT SWIFT ADVICE.exe "2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\PAYMENT SWIFT ADVICE.exe"{path}"3⤵
- Executes dropped EXE
PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT SWIFT ADVICE.exe"{path}"3⤵
- Executes dropped EXE
PID:1868
-
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT SWIFT ADVICE.exe"{path}"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System policy modification
PID:1008
-
-
-
C:\Users\Admin\AppData\Local\Temp\icsys.ico.exeC:\Users\Admin\AppData\Local\Temp\icsys.ico.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1904 -
\??\c:\windows\wininit.exec:\windows\wininit.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1960 -
C:\Users\Admin\appdata\roaming\spoolsv.exe"C:\Users\Admin\appdata\roaming\spoolsv.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:2008
-
-
-
\??\c:\users\admin\appdata\local\svchost.exec:\users\admin\appdata\local\svchost.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1808
-
-