109bd7aa6730a6b04f730b3fcf4f19b9ea9d9e2cb465315dabc2c6f3519ba5f6

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7v20210408
submitted
15/06/2021, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PaymentCopy2021_pdf.exe
Size 187KB
Sample210615-wepsbs95ca
SHA256 109bd7aa6730a6b04f730b3fcf4f19b9ea9d9e2cb465315dabc2c6f3519ba5f6
MD5 8a7e0364daaf595bedd885a5cd28ce08
SHA1 87f5455f672f10af97f475cade5b3dfea44dfa2e
SHA512 d238ff6eb139c90e5a7b0e3317b153a22e7d07bbeed02c6a086104b9d940f476bcee12f44a3d43df1df4c43570be727bb63502516fc239bc600b789c2a556e89
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
1828	PaymentCopy2021_pdf.exe
1828	PaymentCopy2021_pdf.exe
1680	PaymentCopy2021_pdf.exe
1680	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
1668	PaymentCopy2021_pdf.exe
1668	PaymentCopy2021_pdf.exe
1644	PaymentCopy2021_pdf.exe
1644	PaymentCopy2021_pdf.exe
1972	PaymentCopy2021_pdf.exe
1972	PaymentCopy2021_pdf.exe
548	PaymentCopy2021_pdf.exe
548	PaymentCopy2021_pdf.exe
1952	PaymentCopy2021_pdf.exe
1952	PaymentCopy2021_pdf.exe
1260	PaymentCopy2021_pdf.exe
1260	PaymentCopy2021_pdf.exe
1308	PaymentCopy2021_pdf.exe
1308	PaymentCopy2021_pdf.exe
1664	PaymentCopy2021_pdf.exe
1664	PaymentCopy2021_pdf.exe
1708	PaymentCopy2021_pdf.exe
1708	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
1200	PaymentCopy2021_pdf.exe
1200	PaymentCopy2021_pdf.exe
860	PaymentCopy2021_pdf.exe
860	PaymentCopy2021_pdf.exe
828	PaymentCopy2021_pdf.exe
828	PaymentCopy2021_pdf.exe
620	PaymentCopy2021_pdf.exe
620	PaymentCopy2021_pdf.exe
1964	PaymentCopy2021_pdf.exe
1964	PaymentCopy2021_pdf.exe
1624	PaymentCopy2021_pdf.exe
1624	PaymentCopy2021_pdf.exe
1312	PaymentCopy2021_pdf.exe
1312	PaymentCopy2021_pdf.exe
1836	PaymentCopy2021_pdf.exe
1836	PaymentCopy2021_pdf.exe
1632	PaymentCopy2021_pdf.exe
1632	PaymentCopy2021_pdf.exe
964	PaymentCopy2021_pdf.exe
964	PaymentCopy2021_pdf.exe
1620	PaymentCopy2021_pdf.exe
1620	PaymentCopy2021_pdf.exe
1016	PaymentCopy2021_pdf.exe
1016	PaymentCopy2021_pdf.exe
1844	PaymentCopy2021_pdf.exe
1844	PaymentCopy2021_pdf.exe
744	PaymentCopy2021_pdf.exe
744	PaymentCopy2021_pdf.exe
796	PaymentCopy2021_pdf.exe
796	PaymentCopy2021_pdf.exe
1060	PaymentCopy2021_pdf.exe
1060	PaymentCopy2021_pdf.exe
1300	PaymentCopy2021_pdf.exe
1300	PaymentCopy2021_pdf.exe
1120	PaymentCopy2021_pdf.exe
1120	PaymentCopy2021_pdf.exe
1968	PaymentCopy2021_pdf.exe
1968	PaymentCopy2021_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1828	PaymentCopy2021_pdf.exe
1828	PaymentCopy2021_pdf.exe
1828	PaymentCopy2021_pdf.exe
1828	PaymentCopy2021_pdf.exe
1680	PaymentCopy2021_pdf.exe
1680	PaymentCopy2021_pdf.exe
1680	PaymentCopy2021_pdf.exe
1680	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
1668	PaymentCopy2021_pdf.exe
1668	PaymentCopy2021_pdf.exe
1668	PaymentCopy2021_pdf.exe
1668	PaymentCopy2021_pdf.exe
1644	PaymentCopy2021_pdf.exe
1644	PaymentCopy2021_pdf.exe
1644	PaymentCopy2021_pdf.exe
1644	PaymentCopy2021_pdf.exe
1972	PaymentCopy2021_pdf.exe
1972	PaymentCopy2021_pdf.exe
1972	PaymentCopy2021_pdf.exe
1972	PaymentCopy2021_pdf.exe
548	PaymentCopy2021_pdf.exe
548	PaymentCopy2021_pdf.exe
548	PaymentCopy2021_pdf.exe
548	PaymentCopy2021_pdf.exe
1952	PaymentCopy2021_pdf.exe
1952	PaymentCopy2021_pdf.exe
1952	PaymentCopy2021_pdf.exe
1952	PaymentCopy2021_pdf.exe
1260	PaymentCopy2021_pdf.exe
1260	PaymentCopy2021_pdf.exe
1260	PaymentCopy2021_pdf.exe
1260	PaymentCopy2021_pdf.exe
1308	PaymentCopy2021_pdf.exe
1308	PaymentCopy2021_pdf.exe
1308	PaymentCopy2021_pdf.exe
1308	PaymentCopy2021_pdf.exe
1664	PaymentCopy2021_pdf.exe
1664	PaymentCopy2021_pdf.exe
1664	PaymentCopy2021_pdf.exe
1664	PaymentCopy2021_pdf.exe
1708	PaymentCopy2021_pdf.exe
1708	PaymentCopy2021_pdf.exe
1708	PaymentCopy2021_pdf.exe
1708	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
1200	PaymentCopy2021_pdf.exe
1200	PaymentCopy2021_pdf.exe
1200	PaymentCopy2021_pdf.exe
1200	PaymentCopy2021_pdf.exe
860	PaymentCopy2021_pdf.exe
860	PaymentCopy2021_pdf.exe
860	PaymentCopy2021_pdf.exe
860	PaymentCopy2021_pdf.exe
828	PaymentCopy2021_pdf.exe
828	PaymentCopy2021_pdf.exe
828	PaymentCopy2021_pdf.exe
828	PaymentCopy2021_pdf.exe

Suspicious behavior: MapViewOfSection 59 IoCs

pid	Process
1828	PaymentCopy2021_pdf.exe
1680	PaymentCopy2021_pdf.exe
1680	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
1668	PaymentCopy2021_pdf.exe
1644	PaymentCopy2021_pdf.exe
1972	PaymentCopy2021_pdf.exe
548	PaymentCopy2021_pdf.exe
1952	PaymentCopy2021_pdf.exe
1260	PaymentCopy2021_pdf.exe
1308	PaymentCopy2021_pdf.exe
1664	PaymentCopy2021_pdf.exe
1708	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
996	PaymentCopy2021_pdf.exe
1200	PaymentCopy2021_pdf.exe
860	PaymentCopy2021_pdf.exe
828	PaymentCopy2021_pdf.exe
620	PaymentCopy2021_pdf.exe
1964	PaymentCopy2021_pdf.exe
1624	PaymentCopy2021_pdf.exe
1312	PaymentCopy2021_pdf.exe
1836	PaymentCopy2021_pdf.exe
1632	PaymentCopy2021_pdf.exe
964	PaymentCopy2021_pdf.exe
1620	PaymentCopy2021_pdf.exe
1620	PaymentCopy2021_pdf.exe
1016	PaymentCopy2021_pdf.exe
1016	PaymentCopy2021_pdf.exe
1844	PaymentCopy2021_pdf.exe
744	PaymentCopy2021_pdf.exe
796	PaymentCopy2021_pdf.exe
1060	PaymentCopy2021_pdf.exe
1300	PaymentCopy2021_pdf.exe
1120	PaymentCopy2021_pdf.exe
1968	PaymentCopy2021_pdf.exe
1968	PaymentCopy2021_pdf.exe
1040	PaymentCopy2021_pdf.exe
1040	PaymentCopy2021_pdf.exe
1516	PaymentCopy2021_pdf.exe
1588	PaymentCopy2021_pdf.exe
1556	PaymentCopy2021_pdf.exe
1828	PaymentCopy2021_pdf.exe
1352	PaymentCopy2021_pdf.exe
1836	PaymentCopy2021_pdf.exe
1836	PaymentCopy2021_pdf.exe
1608	PaymentCopy2021_pdf.exe
1608	PaymentCopy2021_pdf.exe
1632	PaymentCopy2021_pdf.exe
944	PaymentCopy2021_pdf.exe
1664	PaymentCopy2021_pdf.exe
1664	PaymentCopy2021_pdf.exe
1748	PaymentCopy2021_pdf.exe
1748	PaymentCopy2021_pdf.exe
1652	PaymentCopy2021_pdf.exe
1652	PaymentCopy2021_pdf.exe
1912	PaymentCopy2021_pdf.exe
1504	PaymentCopy2021_pdf.exe
1504	PaymentCopy2021_pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1308	1828	PaymentCopy2021_pdf.exe	26
PID 1828 wrote to memory of 1308	1828	PaymentCopy2021_pdf.exe	26
PID 1828 wrote to memory of 1308	1828	PaymentCopy2021_pdf.exe	26
PID 1828 wrote to memory of 1308	1828	PaymentCopy2021_pdf.exe	26
PID 1828 wrote to memory of 1308	1828	PaymentCopy2021_pdf.exe	26
PID 1828 wrote to memory of 1680	1828	PaymentCopy2021_pdf.exe	30
PID 1828 wrote to memory of 1680	1828	PaymentCopy2021_pdf.exe	30
PID 1828 wrote to memory of 1680	1828	PaymentCopy2021_pdf.exe	30
PID 1828 wrote to memory of 1680	1828	PaymentCopy2021_pdf.exe	30
PID 1680 wrote to memory of 1620	1680	PaymentCopy2021_pdf.exe	31
PID 1680 wrote to memory of 1620	1680	PaymentCopy2021_pdf.exe	31
PID 1680 wrote to memory of 1620	1680	PaymentCopy2021_pdf.exe	31
PID 1680 wrote to memory of 1620	1680	PaymentCopy2021_pdf.exe	31
PID 1680 wrote to memory of 1620	1680	PaymentCopy2021_pdf.exe	31
PID 1680 wrote to memory of 996	1680	PaymentCopy2021_pdf.exe	32
PID 1680 wrote to memory of 996	1680	PaymentCopy2021_pdf.exe	32
PID 1680 wrote to memory of 996	1680	PaymentCopy2021_pdf.exe	32
PID 1680 wrote to memory of 996	1680	PaymentCopy2021_pdf.exe	32
PID 996 wrote to memory of 308	996	PaymentCopy2021_pdf.exe	33
PID 996 wrote to memory of 308	996	PaymentCopy2021_pdf.exe	33
PID 996 wrote to memory of 308	996	PaymentCopy2021_pdf.exe	33
PID 996 wrote to memory of 308	996	PaymentCopy2021_pdf.exe	33
PID 996 wrote to memory of 308	996	PaymentCopy2021_pdf.exe	33
PID 996 wrote to memory of 1668	996	PaymentCopy2021_pdf.exe	34
PID 996 wrote to memory of 1668	996	PaymentCopy2021_pdf.exe	34
PID 996 wrote to memory of 1668	996	PaymentCopy2021_pdf.exe	34
PID 996 wrote to memory of 1668	996	PaymentCopy2021_pdf.exe	34
PID 1668 wrote to memory of 1848	1668	PaymentCopy2021_pdf.exe	35
PID 1668 wrote to memory of 1848	1668	PaymentCopy2021_pdf.exe	35
PID 1668 wrote to memory of 1848	1668	PaymentCopy2021_pdf.exe	35
PID 1668 wrote to memory of 1848	1668	PaymentCopy2021_pdf.exe	35
PID 1668 wrote to memory of 1848	1668	PaymentCopy2021_pdf.exe	35
PID 1668 wrote to memory of 1644	1668	PaymentCopy2021_pdf.exe	36
PID 1668 wrote to memory of 1644	1668	PaymentCopy2021_pdf.exe	36
PID 1668 wrote to memory of 1644	1668	PaymentCopy2021_pdf.exe	36
PID 1668 wrote to memory of 1644	1668	PaymentCopy2021_pdf.exe	36
PID 1644 wrote to memory of 684	1644	PaymentCopy2021_pdf.exe	37
PID 1644 wrote to memory of 684	1644	PaymentCopy2021_pdf.exe	37
PID 1644 wrote to memory of 684	1644	PaymentCopy2021_pdf.exe	37
PID 1644 wrote to memory of 684	1644	PaymentCopy2021_pdf.exe	37
PID 1644 wrote to memory of 684	1644	PaymentCopy2021_pdf.exe	37
PID 1644 wrote to memory of 1972	1644	PaymentCopy2021_pdf.exe	38
PID 1644 wrote to memory of 1972	1644	PaymentCopy2021_pdf.exe	38
PID 1644 wrote to memory of 1972	1644	PaymentCopy2021_pdf.exe	38
PID 1644 wrote to memory of 1972	1644	PaymentCopy2021_pdf.exe	38
PID 1972 wrote to memory of 984	1972	PaymentCopy2021_pdf.exe	39
PID 1972 wrote to memory of 984	1972	PaymentCopy2021_pdf.exe	39
PID 1972 wrote to memory of 984	1972	PaymentCopy2021_pdf.exe	39
PID 1972 wrote to memory of 984	1972	PaymentCopy2021_pdf.exe	39
PID 1972 wrote to memory of 984	1972	PaymentCopy2021_pdf.exe	39
PID 1972 wrote to memory of 548	1972	PaymentCopy2021_pdf.exe	40
PID 1972 wrote to memory of 548	1972	PaymentCopy2021_pdf.exe	40
PID 1972 wrote to memory of 548	1972	PaymentCopy2021_pdf.exe	40
PID 1972 wrote to memory of 548	1972	PaymentCopy2021_pdf.exe	40
PID 548 wrote to memory of 1288	548	PaymentCopy2021_pdf.exe	41
PID 548 wrote to memory of 1288	548	PaymentCopy2021_pdf.exe	41
PID 548 wrote to memory of 1288	548	PaymentCopy2021_pdf.exe	41
PID 548 wrote to memory of 1288	548	PaymentCopy2021_pdf.exe	41
PID 548 wrote to memory of 1288	548	PaymentCopy2021_pdf.exe	41
PID 548 wrote to memory of 1952	548	PaymentCopy2021_pdf.exe	42
PID 548 wrote to memory of 1952	548	PaymentCopy2021_pdf.exe	42
PID 548 wrote to memory of 1952	548	PaymentCopy2021_pdf.exe	42
PID 548 wrote to memory of 1952	548	PaymentCopy2021_pdf.exe	42
PID 1952 wrote to memory of 1172	1952	PaymentCopy2021_pdf.exe	43

C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
  2⤵
  PID:1308
- C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
      4⤵
      PID:308
  - - C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1668
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        5⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        5⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        6⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        7⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        7⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        8⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        8⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        9⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        9⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1260
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        10⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        10⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1308
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        11⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        11⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1664
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        12⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        12⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1708
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        13⤵
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        13⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:996
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        14⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        14⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1200
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        15⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        15⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:860
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        16⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        16⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:828
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        17⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        17⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:620
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        18⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        18⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1964
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        19⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        19⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1624
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        20⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        20⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1312
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        21⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        21⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1836
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        22⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        22⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1632
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        23⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        23⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:964
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        24⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        24⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1620
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        25⤵
        
        PID:308
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        25⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1016
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        26⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        26⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1844
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        27⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        27⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:744
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        28⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        28⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:796
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        29⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        29⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1060
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        30⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        30⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1300
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        31⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        31⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1120
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        32⤵
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        32⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1968
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        33⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        33⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1040
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        34⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        34⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1516
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        35⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        35⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1588
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        36⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        36⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1556
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        37⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        37⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1828
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        38⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        38⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1352
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        39⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        39⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1836
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        40⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        40⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1608
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        41⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        41⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1632
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        42⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        42⤵
        Suspicious behavior: MapViewOfSection
        
        PID:944
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        43⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        43⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1664
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        44⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        44⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1748
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        45⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        45⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1652
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        46⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        46⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1912
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        47⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        47⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1504
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PaymentCopy2021_pdf.exe"
        48⤵
        
        PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1828-60-0x0000000075511000-0x0000000075513000-memory.dmp

Download