8642bef0da90b39eff7e2f28570d28aa2a9aaabcd181c9f64bcfbdd331a606f1

Analysis

max time kernel
101s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
03/12/2020, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Salary_PMT.exe
Size 824KB
Sample201203-bfmjgpp1rx
SHA256 8642bef0da90b39eff7e2f28570d28aa2a9aaabcd181c9f64bcfbdd331a606f1
MD5 fe30745c46bc28ce6886c5c67324973e
SHA1 a804cd0cbbce08e3e736b73f922f6c45d0b113a5
SHA512 ec006790e1e0f69d4132c0f636844c7683e2e2621d97b52f4e68b747d0833559130a4fe74298c539cb1e423969b4689e8c2366542ebdd3bdf86dba20de7d559d
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\jXVxOnf = "C:\\Users\\Admin\\AppData\\Roaming\\jXVxOnf\\jXVxOnf.exe"	Salary_PMT.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 1612	1580	Salary_PMT.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1612	Salary_PMT.exe
1612	Salary_PMT.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	Salary_PMT.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1612	1580	Salary_PMT.exe	29
PID 1580 wrote to memory of 1612	1580	Salary_PMT.exe	29
PID 1580 wrote to memory of 1612	1580	Salary_PMT.exe	29
PID 1580 wrote to memory of 1612	1580	Salary_PMT.exe	29
PID 1580 wrote to memory of 1612	1580	Salary_PMT.exe	29
PID 1580 wrote to memory of 1612	1580	Salary_PMT.exe	29
PID 1580 wrote to memory of 1612	1580	Salary_PMT.exe	29
PID 1580 wrote to memory of 1612	1580	Salary_PMT.exe	29
PID 1580 wrote to memory of 1612	1580	Salary_PMT.exe	29

C:\Users\Admin\AppData\Local\Temp\Salary_PMT.exe
"C:\Users\Admin\AppData\Local\Temp\Salary_PMT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\Salary_PMT.exe
  "C:\Users\Admin\AppData\Local\Temp\Salary_PMT.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-2-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Download

memory/1580-3-0x0000000001390000-0x0000000001391000-memory.dmp

Download

memory/1580-5-0x0000000025720000-0x0000000045708000-memory.dmp

Download

memory/1580-6-0x00000000012D0000-0x000000000131C000-memory.dmp

Download

memory/1580-7-0x00000000004F0000-0x00000000004F8000-memory.dmp

Download

memory/1580-9-0x0000000004990000-0x00000000049C9000-memory.dmp

Download

memory/1612-10-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1612-12-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1612-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1612-14-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Download