Analysis
-
max time kernel
150s -
max time network
39s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-09-2021 14:14
Static task
static1
Behavioral task
behavioral1
Sample
Payment Slip.exe
Resource
win7v20210408
0 signatures
0 seconds
General
-
Target
Payment Slip.exe
-
Size
831KB
-
MD5
3d0d9c87ea732caf417afa0b8af62267
-
SHA1
dfb1e57a9cf498310cb7287f4b5792cbcd8b3974
-
SHA256
95b6ba2be30399f87d20e021bee29f0eb46773b67407f3ed9987d22610d5249d
-
SHA512
e7db51cd7baf84cf65ebead15c3e56ca9e381866a4edc7e945affe4f64f53bef08519037a5e4fc2ef8f8034e91b240b5d3511a2cdec08e308e8e473a7430a83b
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Payment Slip.exepid process 1080 Payment Slip.exe 1080 Payment Slip.exe 1080 Payment Slip.exe 1080 Payment Slip.exe 1080 Payment Slip.exe 1080 Payment Slip.exe 1080 Payment Slip.exe 1080 Payment Slip.exe 1080 Payment Slip.exe 1080 Payment Slip.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Payment Slip.exedescription pid process Token: SeDebugPrivilege 1080 Payment Slip.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Payment Slip.exedescription pid process target process PID 1080 wrote to memory of 908 1080 Payment Slip.exe schtasks.exe PID 1080 wrote to memory of 908 1080 Payment Slip.exe schtasks.exe PID 1080 wrote to memory of 908 1080 Payment Slip.exe schtasks.exe PID 1080 wrote to memory of 908 1080 Payment Slip.exe schtasks.exe PID 1080 wrote to memory of 1044 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1044 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1044 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1044 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1536 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1536 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1536 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1536 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 580 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 580 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 580 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 580 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1964 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1964 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1964 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1964 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1956 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1956 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1956 1080 Payment Slip.exe Payment Slip.exe PID 1080 wrote to memory of 1956 1080 Payment Slip.exe Payment Slip.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uVxomBuy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4CF6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/908-66-0x0000000000000000-mapping.dmp
-
memory/1080-60-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1080-62-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/1080-63-0x0000000000300000-0x0000000000307000-memory.dmpFilesize
28KB
-
memory/1080-64-0x0000000005B00000-0x0000000005B5F000-memory.dmpFilesize
380KB
-
memory/1080-65-0x00000000006D0000-0x00000000006FF000-memory.dmpFilesize
188KB