Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-02-2021 06:59
Static task
static1
Behavioral task
behavioral1
Sample
Payment Confirmation.exe
Resource
win7v20201028
General
-
Target
Payment Confirmation.exe
-
Size
888KB
-
MD5
800b9d7f3a47c5a18da78cb6a54f90be
-
SHA1
67c825ca6d8f430fdfc4cbca78c442600db7ccf0
-
SHA256
e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233
-
SHA512
3f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
cvcvsdf.execvcvsdf.exepid process 2720 cvcvsdf.exe 2844 cvcvsdf.exe -
Processes:
resource yara_rule behavioral2/memory/2844-9-0x0000000000400000-0x00000000004B8000-memory.dmp upx behavioral2/memory/2844-12-0x0000000000400000-0x00000000004B8000-memory.dmp upx -
Drops startup file 2 IoCs
Processes:
Payment Confirmation.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe Payment Confirmation.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe Payment Confirmation.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cvcvsdf.exedescription pid process target process PID 2720 set thread context of 2844 2720 cvcvsdf.exe cvcvsdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
cvcvsdf.exedescription pid process Token: SeIncreaseQuotaPrivilege 2844 cvcvsdf.exe Token: SeSecurityPrivilege 2844 cvcvsdf.exe Token: SeTakeOwnershipPrivilege 2844 cvcvsdf.exe Token: SeLoadDriverPrivilege 2844 cvcvsdf.exe Token: SeSystemProfilePrivilege 2844 cvcvsdf.exe Token: SeSystemtimePrivilege 2844 cvcvsdf.exe Token: SeProfSingleProcessPrivilege 2844 cvcvsdf.exe Token: SeIncBasePriorityPrivilege 2844 cvcvsdf.exe Token: SeCreatePagefilePrivilege 2844 cvcvsdf.exe Token: SeBackupPrivilege 2844 cvcvsdf.exe Token: SeRestorePrivilege 2844 cvcvsdf.exe Token: SeShutdownPrivilege 2844 cvcvsdf.exe Token: SeDebugPrivilege 2844 cvcvsdf.exe Token: SeSystemEnvironmentPrivilege 2844 cvcvsdf.exe Token: SeChangeNotifyPrivilege 2844 cvcvsdf.exe Token: SeRemoteShutdownPrivilege 2844 cvcvsdf.exe Token: SeUndockPrivilege 2844 cvcvsdf.exe Token: SeManageVolumePrivilege 2844 cvcvsdf.exe Token: SeImpersonatePrivilege 2844 cvcvsdf.exe Token: SeCreateGlobalPrivilege 2844 cvcvsdf.exe Token: 33 2844 cvcvsdf.exe Token: 34 2844 cvcvsdf.exe Token: 35 2844 cvcvsdf.exe Token: 36 2844 cvcvsdf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Payment Confirmation.execvcvsdf.exepid process 1144 Payment Confirmation.exe 2720 cvcvsdf.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Payment Confirmation.execvcvsdf.exedescription pid process target process PID 1144 wrote to memory of 2720 1144 Payment Confirmation.exe cvcvsdf.exe PID 1144 wrote to memory of 2720 1144 Payment Confirmation.exe cvcvsdf.exe PID 1144 wrote to memory of 2720 1144 Payment Confirmation.exe cvcvsdf.exe PID 2720 wrote to memory of 2844 2720 cvcvsdf.exe cvcvsdf.exe PID 2720 wrote to memory of 2844 2720 cvcvsdf.exe cvcvsdf.exe PID 2720 wrote to memory of 2844 2720 cvcvsdf.exe cvcvsdf.exe PID 2720 wrote to memory of 2844 2720 cvcvsdf.exe cvcvsdf.exe PID 2720 wrote to memory of 2844 2720 cvcvsdf.exe cvcvsdf.exe PID 2720 wrote to memory of 2844 2720 cvcvsdf.exe cvcvsdf.exe PID 2720 wrote to memory of 2844 2720 cvcvsdf.exe cvcvsdf.exe PID 2720 wrote to memory of 2844 2720 cvcvsdf.exe cvcvsdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exeMD5
800b9d7f3a47c5a18da78cb6a54f90be
SHA167c825ca6d8f430fdfc4cbca78c442600db7ccf0
SHA256e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233
SHA5123f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exeMD5
800b9d7f3a47c5a18da78cb6a54f90be
SHA167c825ca6d8f430fdfc4cbca78c442600db7ccf0
SHA256e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233
SHA5123f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exeMD5
800b9d7f3a47c5a18da78cb6a54f90be
SHA167c825ca6d8f430fdfc4cbca78c442600db7ccf0
SHA256e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233
SHA5123f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87
-
memory/2720-4-0x0000000000000000-mapping.dmp
-
memory/2844-9-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2844-10-0x00000000004B67A0-mapping.dmp
-
memory/2844-12-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2844-13-0x0000000000780000-0x0000000000781000-memory.dmpFilesize
4KB