Analysis
-
max time kernel
119s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
08-02-2022 03:12
Static task
static1
Behavioral task
behavioral1
Sample
INV.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
INV.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral3
Sample
PACKING LISTS.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
PACKING LISTS.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
PICS.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
PICS.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
QUOTATION.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
QUOTATION.exe
Resource
win10v2004-en-20220112
General
-
Target
PICS.exe
-
Size
614KB
-
MD5
d58af35ac0ce272e393f814bc485cf04
-
SHA1
3cc3b71d1231b4434aab5f4d04ad1ce6321ca44c
-
SHA256
d6544a0b973c2a4a5ee527a2aa91ea58825b12e3c32e7d93052b4256127f9d0f
-
SHA512
cf424b7c441b652fae1f6221b277cc263fcf11465fd618d2115fb5840c73947923175b295c2701482ecb8cb43a9dd03ba1d7d97bbf131371cfe0b78edd34cde0
Malware Config
Signatures
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral6/memory/3608-186-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral6/memory/3608-186-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView -
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral6/memory/3608-186-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft -
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" RegAsm.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 42 whatismyipaddress.com 44 whatismyipaddress.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PICS.exedescription pid process target process PID 4576 set thread context of 3608 4576 PICS.exe RegAsm.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Powershell.exepid process 3496 Powershell.exe 3496 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Powershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 3496 Powershell.exe Token: SeDebugPrivilege 3608 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 3608 RegAsm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PICS.exedescription pid process target process PID 4576 wrote to memory of 3496 4576 PICS.exe Powershell.exe PID 4576 wrote to memory of 3496 4576 PICS.exe Powershell.exe PID 4576 wrote to memory of 3496 4576 PICS.exe Powershell.exe PID 4576 wrote to memory of 3608 4576 PICS.exe RegAsm.exe PID 4576 wrote to memory of 3608 4576 PICS.exe RegAsm.exe PID 4576 wrote to memory of 3608 4576 PICS.exe RegAsm.exe PID 4576 wrote to memory of 3608 4576 PICS.exe RegAsm.exe PID 4576 wrote to memory of 3608 4576 PICS.exe RegAsm.exe PID 4576 wrote to memory of 3608 4576 PICS.exe RegAsm.exe PID 4576 wrote to memory of 3608 4576 PICS.exe RegAsm.exe PID 4576 wrote to memory of 3608 4576 PICS.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PICS.exe"C:\Users\Admin\AppData\Local\Temp\PICS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\PICS.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-211-0x0000016AB91F0000-0x0000016AB91F4000-memory.dmpFilesize
16KB
-
memory/3496-190-0x0000000005420000-0x0000000005486000-memory.dmpFilesize
408KB
-
memory/3496-307-0x0000000006230000-0x000000000624E000-memory.dmpFilesize
120KB
-
memory/3496-189-0x00000000050E0000-0x0000000005102000-memory.dmpFilesize
136KB
-
memory/3496-488-0x00000000068F0000-0x0000000006912000-memory.dmpFilesize
136KB
-
memory/3496-487-0x00000000068D0000-0x00000000068EA000-memory.dmpFilesize
104KB
-
memory/3496-182-0x0000000002A40000-0x0000000002A76000-memory.dmpFilesize
216KB
-
memory/3496-183-0x0000000075190000-0x0000000075940000-memory.dmpFilesize
7.7MB
-
memory/3496-184-0x00000000029B0000-0x0000000002A40000-memory.dmpFilesize
576KB
-
memory/3496-185-0x00000000029B0000-0x0000000002A40000-memory.dmpFilesize
576KB
-
memory/3496-486-0x00000000075E0000-0x0000000007676000-memory.dmpFilesize
600KB
-
memory/3496-187-0x0000000005680000-0x0000000005CA8000-memory.dmpFilesize
6.2MB
-
memory/3496-191-0x0000000005490000-0x00000000054F6000-memory.dmpFilesize
408KB
-
memory/3528-489-0x0000018D87F30000-0x0000018D87F40000-memory.dmpFilesize
64KB
-
memory/3528-490-0x0000018D87F90000-0x0000018D87FA0000-memory.dmpFilesize
64KB
-
memory/3528-491-0x0000018D8AC90000-0x0000018D8AC94000-memory.dmpFilesize
16KB
-
memory/3608-192-0x0000000005790000-0x000000000582C000-memory.dmpFilesize
624KB
-
memory/3608-193-0x0000000005820000-0x000000000582A000-memory.dmpFilesize
40KB
-
memory/3608-194-0x0000000005B00000-0x0000000005B56000-memory.dmpFilesize
344KB
-
memory/3608-311-0x0000000005790000-0x000000000582C000-memory.dmpFilesize
624KB
-
memory/3608-188-0x0000000075190000-0x0000000075940000-memory.dmpFilesize
7.7MB
-
memory/3608-186-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/4576-467-0x0000000005350000-0x00000000058F4000-memory.dmpFilesize
5.6MB
-
memory/4576-131-0x0000000075190000-0x0000000075940000-memory.dmpFilesize
7.7MB
-
memory/4576-180-0x0000000005690000-0x000000000572C000-memory.dmpFilesize
624KB
-
memory/4576-179-0x0000000005350000-0x00000000058F4000-memory.dmpFilesize
5.6MB
-
memory/4576-130-0x0000000000B40000-0x0000000000BE0000-memory.dmpFilesize
640KB
-
memory/4576-132-0x0000000005900000-0x0000000005EA4000-memory.dmpFilesize
5.6MB
-
memory/4576-178-0x00000000055F0000-0x0000000005682000-memory.dmpFilesize
584KB