Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 07:41
Static task
static1
Behavioral task
behavioral1
Sample
Payment Slip.exe
Resource
win7v20201028
General
-
Target
Payment Slip.exe
-
Size
505KB
-
MD5
2ca388f576c09252531a51474cdf74ae
-
SHA1
2d8f4f340bf642fc0f2565a20ed079cc669e18b3
-
SHA256
4f450fcf02d7006fd4fbea8c2cad999397672d44864f1e8c504633ce53c3d53d
-
SHA512
373f3f9690c9061922ea95ec24c86c87a586125949e1368268b018185be44db6cc273cec9e42821f857b733d9bbe6462e5b8ba37149f577597dcaa33f1f0e791
Malware Config
Extracted
formbook
4.1
http://www.the-techs.info/chue/
wowmovies.today
magentos6.com
bi-nav.com
atlantahawks.sucks
wluabjy.icu
kevableinsights.com
lavidaenaustralia.com
stonermadeapparel.net
sondein.com
cirquedusoleilartist.com
kanjitem.com
tomofalltrades.site
mecanico.guru
tech2020s.com
amesoneco.com
theawfulliar.com
californiaadugurus.com
rentalservicesolutions.com
fsxbhd.club
casino-seo.com
asknesto.com
get-rangextd.com
gkwill.com
juliegiles.net
pagosafreedom.com
wbpossiblellc.com
fhjfyutotyhfse.com
sexshopsatelite.com
shellykraftlaw.com
motherhenscoop.com
mboklanjar.com
redwoodcityswing.com
haier-mz.com
metalinjectionltd.asia
franquiaoriginal.com
mcronaldfood.com
mobilegymconcierge.com
haifu168.com
apeiro.life
thejosephnashvilletn.com
bensbrickstore.com
sanctumwell.com
beanexthomie.com
stylazhaircare.com
jordanvanvleet.com
jdwx400.com
francescoricco.com
gameshowsatschool.com
alqymist-monaco.com
infinitysportsmassage.com
algorithmrecruitment.com
tanyasubatang.com
impressivebackyard.com
wwwgocashwire.com
visual-pioneers.net
thememo-mobilebar.com
wagner-fahrschulegmbh.com
minterfortexas.com
codelopers.com
inyarsb.icu
ravenlightproductions.com
germiblock.com
coutinhoefelipeadv.com
diegobr1307.life
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1048-29-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1048-30-0x000000000041ED80-mapping.dmp formbook behavioral1/memory/840-40-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Nirsoft 13 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeAdvancedRun.exeAdvancedRun.exepid process 1532 AdvancedRun.exe 1792 AdvancedRun.exe 1800 AdvancedRun.exe 1700 AdvancedRun.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 368 cmd.exe -
Loads dropped DLL 8 IoCs
Processes:
Payment Slip.exeAdvancedRun.exeAdvancedRun.exepid process 1968 Payment Slip.exe 1968 Payment Slip.exe 1532 AdvancedRun.exe 1532 AdvancedRun.exe 1968 Payment Slip.exe 1968 Payment Slip.exe 1800 AdvancedRun.exe 1800 AdvancedRun.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Payment Slip.exePayment Slip.exesvchost.exedescription pid process target process PID 1968 set thread context of 1048 1968 Payment Slip.exe Payment Slip.exe PID 1048 set thread context of 1388 1048 Payment Slip.exe Explorer.EXE PID 1048 set thread context of 1388 1048 Payment Slip.exe Explorer.EXE PID 840 set thread context of 1388 840 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeAdvancedRun.exeAdvancedRun.exePayment Slip.exePayment Slip.exesvchost.exepid process 1532 AdvancedRun.exe 1532 AdvancedRun.exe 1792 AdvancedRun.exe 1792 AdvancedRun.exe 1800 AdvancedRun.exe 1800 AdvancedRun.exe 1700 AdvancedRun.exe 1700 AdvancedRun.exe 1968 Payment Slip.exe 1968 Payment Slip.exe 1048 Payment Slip.exe 1048 Payment Slip.exe 1048 Payment Slip.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Payment Slip.exesvchost.exepid process 1048 Payment Slip.exe 1048 Payment Slip.exe 1048 Payment Slip.exe 1048 Payment Slip.exe 840 svchost.exe 840 svchost.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeAdvancedRun.exeAdvancedRun.exePayment Slip.exePayment Slip.exesvchost.exedescription pid process Token: SeDebugPrivilege 1532 AdvancedRun.exe Token: SeImpersonatePrivilege 1532 AdvancedRun.exe Token: SeDebugPrivilege 1792 AdvancedRun.exe Token: SeImpersonatePrivilege 1792 AdvancedRun.exe Token: SeDebugPrivilege 1800 AdvancedRun.exe Token: SeImpersonatePrivilege 1800 AdvancedRun.exe Token: SeDebugPrivilege 1700 AdvancedRun.exe Token: SeImpersonatePrivilege 1700 AdvancedRun.exe Token: SeDebugPrivilege 1968 Payment Slip.exe Token: SeDebugPrivilege 1048 Payment Slip.exe Token: SeDebugPrivilege 840 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1388 Explorer.EXE 1388 Explorer.EXE 1388 Explorer.EXE 1388 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1388 Explorer.EXE 1388 Explorer.EXE 1388 Explorer.EXE 1388 Explorer.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
Payment Slip.exeAdvancedRun.exeAdvancedRun.exeExplorer.EXEsvchost.exedescription pid process target process PID 1968 wrote to memory of 1532 1968 Payment Slip.exe AdvancedRun.exe PID 1968 wrote to memory of 1532 1968 Payment Slip.exe AdvancedRun.exe PID 1968 wrote to memory of 1532 1968 Payment Slip.exe AdvancedRun.exe PID 1968 wrote to memory of 1532 1968 Payment Slip.exe AdvancedRun.exe PID 1532 wrote to memory of 1792 1532 AdvancedRun.exe AdvancedRun.exe PID 1532 wrote to memory of 1792 1532 AdvancedRun.exe AdvancedRun.exe PID 1532 wrote to memory of 1792 1532 AdvancedRun.exe AdvancedRun.exe PID 1532 wrote to memory of 1792 1532 AdvancedRun.exe AdvancedRun.exe PID 1968 wrote to memory of 1800 1968 Payment Slip.exe AdvancedRun.exe PID 1968 wrote to memory of 1800 1968 Payment Slip.exe AdvancedRun.exe PID 1968 wrote to memory of 1800 1968 Payment Slip.exe AdvancedRun.exe PID 1968 wrote to memory of 1800 1968 Payment Slip.exe AdvancedRun.exe PID 1800 wrote to memory of 1700 1800 AdvancedRun.exe AdvancedRun.exe PID 1800 wrote to memory of 1700 1800 AdvancedRun.exe AdvancedRun.exe PID 1800 wrote to memory of 1700 1800 AdvancedRun.exe AdvancedRun.exe PID 1800 wrote to memory of 1700 1800 AdvancedRun.exe AdvancedRun.exe PID 1968 wrote to memory of 1048 1968 Payment Slip.exe Payment Slip.exe PID 1968 wrote to memory of 1048 1968 Payment Slip.exe Payment Slip.exe PID 1968 wrote to memory of 1048 1968 Payment Slip.exe Payment Slip.exe PID 1968 wrote to memory of 1048 1968 Payment Slip.exe Payment Slip.exe PID 1968 wrote to memory of 1048 1968 Payment Slip.exe Payment Slip.exe PID 1968 wrote to memory of 1048 1968 Payment Slip.exe Payment Slip.exe PID 1968 wrote to memory of 1048 1968 Payment Slip.exe Payment Slip.exe PID 1388 wrote to memory of 840 1388 Explorer.EXE svchost.exe PID 1388 wrote to memory of 840 1388 Explorer.EXE svchost.exe PID 1388 wrote to memory of 840 1388 Explorer.EXE svchost.exe PID 1388 wrote to memory of 840 1388 Explorer.EXE svchost.exe PID 840 wrote to memory of 368 840 svchost.exe cmd.exe PID 840 wrote to memory of 368 840 svchost.exe cmd.exe PID 840 wrote to memory of 368 840 svchost.exe cmd.exe PID 840 wrote to memory of 368 840 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 15324⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 18004⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/368-38-0x0000000000000000-mapping.dmp
-
memory/840-39-0x0000000000B40000-0x0000000000B48000-memory.dmpFilesize
32KB
-
memory/840-37-0x0000000000000000-mapping.dmp
-
memory/840-40-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/840-41-0x0000000000780000-0x0000000000A83000-memory.dmpFilesize
3.0MB
-
memory/840-42-0x00000000005D0000-0x0000000000663000-memory.dmpFilesize
588KB
-
memory/1048-30-0x000000000041ED80-mapping.dmp
-
memory/1048-35-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/1048-33-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/1048-32-0x0000000000A60000-0x0000000000D63000-memory.dmpFilesize
3.0MB
-
memory/1048-29-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1388-34-0x0000000006D40000-0x0000000006E95000-memory.dmpFilesize
1.3MB
-
memory/1388-43-0x00000000065A0000-0x000000000665C000-memory.dmpFilesize
752KB
-
memory/1388-36-0x00000000040D0000-0x00000000041C4000-memory.dmpFilesize
976KB
-
memory/1532-12-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB
-
memory/1532-10-0x0000000000000000-mapping.dmp
-
memory/1700-26-0x0000000000000000-mapping.dmp
-
memory/1792-16-0x0000000000000000-mapping.dmp
-
memory/1800-21-0x0000000000000000-mapping.dmp
-
memory/1968-2-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/1968-7-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/1968-6-0x0000000001F50000-0x0000000001FA3000-memory.dmpFilesize
332KB
-
memory/1968-5-0x0000000000300000-0x0000000000302000-memory.dmpFilesize
8KB
-
memory/1968-3-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB