Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-02-2021 07:20
Static task
static1
Behavioral task
behavioral1
Sample
Mortgage Description.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Mortgage Description.exe
Resource
win10v20201028
General
-
Target
Mortgage Description.exe
-
Size
864KB
-
MD5
82ff2d4182e8d49b1553cfec4739011c
-
SHA1
f1605f87331b2c980db3757adcfafb065e318f67
-
SHA256
b57d694b6d1f9e0634953e8f5c1e4faf84fb50be806a8887dd5b31bfd58a167f
-
SHA512
85e5e7fab18b096d334d3bf7625e071690f89cd4dffb6c46d30d15f1ec190bfc11c08b8f261d7f59db93fd90e56b4fb84e9efbf99cb779fb6844d4a80772a188
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
Spread Sheet Reader.exeInstallUtil.exeReader Runtime Processes.exeReader Runtime Processes.exepid process 1544 Spread Sheet Reader.exe 1088 InstallUtil.exe 1620 Reader Runtime Processes.exe 1628 Reader Runtime Processes.exe -
Loads dropped DLL 4 IoCs
Processes:
Mortgage Description.exeSpread Sheet Reader.exeReader Runtime Processes.exepid process 1944 Mortgage Description.exe 1544 Spread Sheet Reader.exe 1544 Spread Sheet Reader.exe 1620 Reader Runtime Processes.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sheet Proffesional Reader = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Spread Sheet Reader.exe" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Spread Sheet Reader.exedescription pid process target process PID 1544 set thread context of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
Mortgage Description.exeSpread Sheet Reader.exeReader Runtime Processes.exeReader Runtime Processes.exepid process 1944 Mortgage Description.exe 1944 Mortgage Description.exe 1944 Mortgage Description.exe 1544 Spread Sheet Reader.exe 1544 Spread Sheet Reader.exe 1544 Spread Sheet Reader.exe 1544 Spread Sheet Reader.exe 1620 Reader Runtime Processes.exe 1628 Reader Runtime Processes.exe 1628 Reader Runtime Processes.exe 1628 Reader Runtime Processes.exe 1544 Spread Sheet Reader.exe 1544 Spread Sheet Reader.exe 1544 Spread Sheet Reader.exe 1544 Spread Sheet Reader.exe 1544 Spread Sheet Reader.exe 1544 Spread Sheet Reader.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Mortgage Description.exeSpread Sheet Reader.exeReader Runtime Processes.exeReader Runtime Processes.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1944 Mortgage Description.exe Token: SeDebugPrivilege 1544 Spread Sheet Reader.exe Token: SeDebugPrivilege 1620 Reader Runtime Processes.exe Token: SeDebugPrivilege 1628 Reader Runtime Processes.exe Token: SeDebugPrivilege 1088 InstallUtil.exe Token: SeDebugPrivilege 1088 InstallUtil.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
Mortgage Description.execmd.exeSpread Sheet Reader.exeReader Runtime Processes.exedescription pid process target process PID 1944 wrote to memory of 1648 1944 Mortgage Description.exe cmd.exe PID 1944 wrote to memory of 1648 1944 Mortgage Description.exe cmd.exe PID 1944 wrote to memory of 1648 1944 Mortgage Description.exe cmd.exe PID 1944 wrote to memory of 1648 1944 Mortgage Description.exe cmd.exe PID 1648 wrote to memory of 396 1648 cmd.exe reg.exe PID 1648 wrote to memory of 396 1648 cmd.exe reg.exe PID 1648 wrote to memory of 396 1648 cmd.exe reg.exe PID 1648 wrote to memory of 396 1648 cmd.exe reg.exe PID 1944 wrote to memory of 1544 1944 Mortgage Description.exe Spread Sheet Reader.exe PID 1944 wrote to memory of 1544 1944 Mortgage Description.exe Spread Sheet Reader.exe PID 1944 wrote to memory of 1544 1944 Mortgage Description.exe Spread Sheet Reader.exe PID 1944 wrote to memory of 1544 1944 Mortgage Description.exe Spread Sheet Reader.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1088 1544 Spread Sheet Reader.exe InstallUtil.exe PID 1544 wrote to memory of 1620 1544 Spread Sheet Reader.exe Reader Runtime Processes.exe PID 1544 wrote to memory of 1620 1544 Spread Sheet Reader.exe Reader Runtime Processes.exe PID 1544 wrote to memory of 1620 1544 Spread Sheet Reader.exe Reader Runtime Processes.exe PID 1544 wrote to memory of 1620 1544 Spread Sheet Reader.exe Reader Runtime Processes.exe PID 1620 wrote to memory of 1628 1620 Reader Runtime Processes.exe Reader Runtime Processes.exe PID 1620 wrote to memory of 1628 1620 Reader Runtime Processes.exe Reader Runtime Processes.exe PID 1620 wrote to memory of 1628 1620 Reader Runtime Processes.exe Reader Runtime Processes.exe PID 1620 wrote to memory of 1628 1620 Reader Runtime Processes.exe Reader Runtime Processes.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mortgage Description.exe"C:\Users\Admin\AppData\Local\Temp\Mortgage Description.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sheet Proffesional Reader" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Sheet Proffesional Reader" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe"C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe"C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.txtMD5
81fe48422a5aca121bffe862ef653c2c
SHA1f9c6c07d496f497436dcda0dc088b67e77a0b1c0
SHA256433cd76ff66b7632a77af2406b308c71cedc12262c7127cd99259bf4a896d8cf
SHA51277524c72262381b6c6378c29951eb62dfe7d63ff43885e603321d399ae4a3c02abcd53f5f284c022c3b055cdebe2936349ad20146ff16f3d93c05fd44f1b2490
-
C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.txtMD5
1a6f667ee6257f8d2812ed66360fe370
SHA122acfd7c19ac25adb097a25791c55a103db420f7
SHA2560eebf38e1710df30fa2fb8bd3846382e697e2c47884969100defe535067eb956
SHA5121928c333efb9e50dc334aba25e79e36b3e99f8e56e83c6a93a912c5bbf5646c87162feb4c93e4121236c9846dbca3bf0e8abf6ebf8125feb58fefa7ad592db57
-
C:\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.txtMD5
6ea5574d05de04872c46f08584c1654f
SHA10e2ca5e9dac7b2343c56e76cfc6cbd3b81ec210e
SHA2566aab8e3dbacd7221571f70b999dfe0afbafdb4b943fc03d904dd8f7a33477447
SHA5127a564ae0689ff0102e55770bd528cf8f21afcfc102f236e1ecb2512d7d7a3a448d3313b4ac34b67f5e76384c3934c6d3ae76ab88ea59d5ce42e59216cb8fd52e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exeMD5
82ff2d4182e8d49b1553cfec4739011c
SHA1f1605f87331b2c980db3757adcfafb065e318f67
SHA256b57d694b6d1f9e0634953e8f5c1e4faf84fb50be806a8887dd5b31bfd58a167f
SHA51285e5e7fab18b096d334d3bf7625e071690f89cd4dffb6c46d30d15f1ec190bfc11c08b8f261d7f59db93fd90e56b4fb84e9efbf99cb779fb6844d4a80772a188
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exeMD5
82ff2d4182e8d49b1553cfec4739011c
SHA1f1605f87331b2c980db3757adcfafb065e318f67
SHA256b57d694b6d1f9e0634953e8f5c1e4faf84fb50be806a8887dd5b31bfd58a167f
SHA51285e5e7fab18b096d334d3bf7625e071690f89cd4dffb6c46d30d15f1ec190bfc11c08b8f261d7f59db93fd90e56b4fb84e9efbf99cb779fb6844d4a80772a188
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
\Users\Admin\AppData\Local\Temp\Reader Runtime Processes.exeMD5
0e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Spread Sheet Reader.exeMD5
82ff2d4182e8d49b1553cfec4739011c
SHA1f1605f87331b2c980db3757adcfafb065e318f67
SHA256b57d694b6d1f9e0634953e8f5c1e4faf84fb50be806a8887dd5b31bfd58a167f
SHA51285e5e7fab18b096d334d3bf7625e071690f89cd4dffb6c46d30d15f1ec190bfc11c08b8f261d7f59db93fd90e56b4fb84e9efbf99cb779fb6844d4a80772a188
-
memory/396-10-0x0000000000000000-mapping.dmp
-
memory/1088-27-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1088-31-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1088-30-0x00000000736B0000-0x0000000073D9E000-memory.dmpFilesize
6MB
-
memory/1088-28-0x0000000000408D4E-mapping.dmp
-
memory/1088-50-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/1544-16-0x00000000736B0000-0x0000000073D9E000-memory.dmpFilesize
6MB
-
memory/1544-17-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/1544-24-0x0000000001F30000-0x0000000001F31000-memory.dmpFilesize
4KB
-
memory/1544-23-0x0000000001F20000-0x0000000001F2B000-memory.dmpFilesize
44KB
-
memory/1544-19-0x0000000004520000-0x0000000004521000-memory.dmpFilesize
4KB
-
memory/1544-13-0x0000000000000000-mapping.dmp
-
memory/1620-35-0x0000000000000000-mapping.dmp
-
memory/1620-38-0x00000000736B0000-0x0000000073D9E000-memory.dmpFilesize
6MB
-
memory/1620-39-0x0000000001360000-0x0000000001361000-memory.dmpFilesize
4KB
-
memory/1628-43-0x0000000000000000-mapping.dmp
-
memory/1628-45-0x00000000736B0000-0x0000000073D9E000-memory.dmpFilesize
6MB
-
memory/1648-9-0x0000000000000000-mapping.dmp
-
memory/1944-2-0x00000000742C0000-0x00000000749AE000-memory.dmpFilesize
6MB
-
memory/1944-3-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/1944-8-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/1944-7-0x00000000009A0000-0x00000000009BE000-memory.dmpFilesize
120KB
-
memory/1944-5-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/1944-11-0x0000000002251000-0x0000000002252000-memory.dmpFilesize
4KB