Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-04-2021 04:01
Static task
static1
Behavioral task
behavioral1
Sample
EXTRACTOSERFINANZA149952705997730013733597462.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
EXTRACTOSERFINANZA149952705997730013733597462.exe
Resource
win10v20210408
General
-
Target
EXTRACTOSERFINANZA149952705997730013733597462.exe
-
Size
175KB
-
MD5
7949066c49b82ebce27756a69ee28fee
-
SHA1
20fee757b2258d7a7ed27f1c147753082dbc8548
-
SHA256
dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
-
SHA512
9ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exePxxoServicesTrialNet1.exepid process 2308 PxxoServicesTrialNet1.exe 4052 PxxoServicesTrialNet1.exe 3988 PxxoServicesTrialNet1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
EXTRACTOSERFINANZA149952705997730013733597462.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ EXTRACTOSERFINANZA149952705997730013733597462.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" EXTRACTOSERFINANZA149952705997730013733597462.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
EXTRACTOSERFINANZA149952705997730013733597462.exePxxoServicesTrialNet1.exedescription pid process target process PID 416 set thread context of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 2308 set thread context of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
EXTRACTOSERFINANZA149952705997730013733597462.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings EXTRACTOSERFINANZA149952705997730013733597462.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 2308 PxxoServicesTrialNet1.exe 2308 PxxoServicesTrialNet1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
EXTRACTOSERFINANZA149952705997730013733597462.exePxxoServicesTrialNet1.exedescription pid process Token: SeDebugPrivilege 416 EXTRACTOSERFINANZA149952705997730013733597462.exe Token: SeDebugPrivilege 2308 PxxoServicesTrialNet1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 3988 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
EXTRACTOSERFINANZA149952705997730013733597462.exeEXTRACTOSERFINANZA149952705997730013733597462.exeWScript.execmd.exePxxoServicesTrialNet1.exedescription pid process target process PID 416 wrote to memory of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 416 wrote to memory of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 416 wrote to memory of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 416 wrote to memory of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 416 wrote to memory of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 416 wrote to memory of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 416 wrote to memory of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 416 wrote to memory of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 416 wrote to memory of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 416 wrote to memory of 2936 416 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 2936 wrote to memory of 728 2936 EXTRACTOSERFINANZA149952705997730013733597462.exe WScript.exe PID 2936 wrote to memory of 728 2936 EXTRACTOSERFINANZA149952705997730013733597462.exe WScript.exe PID 2936 wrote to memory of 728 2936 EXTRACTOSERFINANZA149952705997730013733597462.exe WScript.exe PID 728 wrote to memory of 2100 728 WScript.exe cmd.exe PID 728 wrote to memory of 2100 728 WScript.exe cmd.exe PID 728 wrote to memory of 2100 728 WScript.exe cmd.exe PID 2100 wrote to memory of 2308 2100 cmd.exe PxxoServicesTrialNet1.exe PID 2100 wrote to memory of 2308 2100 cmd.exe PxxoServicesTrialNet1.exe PID 2100 wrote to memory of 2308 2100 cmd.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 4052 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 4052 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 4052 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2308 wrote to memory of 3988 2308 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA149952705997730013733597462.exe"C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA149952705997730013733597462.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA149952705997730013733597462.exe"C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA149952705997730013733597462.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\8B4AfWf1OubMD5
12cd7d6a182fe1d255219bfc2442ef5e
SHA10cacc2650c8b23914942f0afd240f0c20609d2d5
SHA256718938ba08f5b63b2328627ff7a6999ac8062556bdcf7a1ed8ec369991a6a594
SHA5126a4deec2a8ffb9426c45426dd785f83b15a250139193f2fd424c3b62c605de508d2fc5574f4e6175011457d76bfc54079e9af18ce930bfec413ff1a7deead8f6
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
7949066c49b82ebce27756a69ee28fee
SHA120fee757b2258d7a7ed27f1c147753082dbc8548
SHA256dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
SHA5129ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
7949066c49b82ebce27756a69ee28fee
SHA120fee757b2258d7a7ed27f1c147753082dbc8548
SHA256dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
SHA5129ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
7949066c49b82ebce27756a69ee28fee
SHA120fee757b2258d7a7ed27f1c147753082dbc8548
SHA256dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
SHA5129ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
7949066c49b82ebce27756a69ee28fee
SHA120fee757b2258d7a7ed27f1c147753082dbc8548
SHA256dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
SHA5129ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
-
memory/416-119-0x00000000058D0000-0x00000000058F7000-memory.dmpFilesize
156KB
-
memory/416-114-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB
-
memory/416-118-0x0000000005660000-0x0000000005B5E000-memory.dmpFilesize
5.0MB
-
memory/416-117-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/416-116-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/728-123-0x0000000000000000-mapping.dmp
-
memory/2100-125-0x0000000000000000-mapping.dmp
-
memory/2308-135-0x0000000005400000-0x00000000058FE000-memory.dmpFilesize
5.0MB
-
memory/2308-126-0x0000000000000000-mapping.dmp
-
memory/2936-122-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2936-121-0x0000000000413FA4-mapping.dmp
-
memory/2936-120-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3988-138-0x0000000000413FA4-mapping.dmp
-
memory/3988-140-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB