Analysis
- max time kernel
188s - max time network
209s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
11/02/2022, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
UPDATED PRICE LIST INQ.___Pdf.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
UPDATED PRICE LIST INQ.___Pdf.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target UPDATED PRICE LIST INQ.___Pdf.exe
- Size 521KB
- Sample220211-h2n7hsdhfl
- SHA256 3336b511b906b02bae8c9addc0896660dbe98cc95a01acf0b18a9020953cb13e
- MD5 84b957afaffae87fbe2207eee7841d67
- SHA1 a1ad278aea85e25eeacf53b43b7644d31ada8f1c
- SHA512 22925ffffb28a2ef1ce343e42576f9ea16c9f918fee39181f2d9fda72e6858344e6af08e4b8e377d643579ff7770248165686a0b13918103f31f7d79cfed473f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
edf6
Decoy
-
uni-mia.com
-
abo-alzberr.space
-
answertitles.com
-
thebootyteasisterhood.com
-
aberdaresafarihotels.com
-
smartcrowd.xyz
-
smotivesport.com
-
vulcan-grandclub.com
-
krankenpflegerjobsheutede.com
-
newviewannarbor.com
-
crazyverse.pro
-
meghalayanessence.com
-
genttherapy.com
-
kyros-consulting.com
-
architectureforhealing.com
-
farmgirlcatandplantcare.com
-
wellgardentrepriseinc.com
-
domedeckdesign.com
-
traicayquangngai.com
-
donerightpublishing.com
-
gongkemuningfree.xyz
-
desirsdeluxe.com
-
dvsettlements.com
-
aroma-herb-surya.com
-
eshopbooth.com
-
wxaipuer.com
-
c3g6s9ar.com
-
nropes.com
-
barrieux.com
-
garageair.website
-
emmetaverse.com
-
lewisgeneralservices.com
-
eventdirective.com
-
infinityforeigntrade.com
-
j92088.com
-
celestialdrone.art
-
pistoletmassag.space
-
merinocasado.com
-
coinbaseprologin.website
-
beachpleaseflorida.com
-
jmanstore.com
-
xn--3bsz6nxrz20tenav44a.com
-
alstartnpasumo6.xyz
-
edge-lord.com
-
cabinsatluray.com
-
mydavisdisposal.com
-
myzoclub.com
-
colonelabrams.com
-
medicalqlxbvx.online
-
certagq.info
-
purplezorb.com
-
us-em.xyz
-
cghnwiprivate.com
-
logisticsdaiphat.com
-
versionlayer.com
-
novatel-networks.net
-
ourlittlecornerofparadise.com
-
decadrachmae.info
-
shopping-kart.com
-
zycycl.com
-
patrakka.pro
-
rbotce.top
-
puppyaccountabilityprogram.com
-
alz.fund
-
hybridlover.com
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1648 created 776 1648 WerFault.exe 74 - Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/776-134-0x0000000000400000-0x000000000044A000-memory.dmp xloader behavioral2/memory/776-137-0x0000000000400000-0x000000000044A000-memory.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 3500 ziuqbapt.exe 776 ziuqbapt.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxulfhfnmr = "C:\\Users\\Admin\\AppData\\Roaming\\frssiw\\eqxyo.exe" ziuqbapt.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3500 set thread context of 776 3500 ziuqbapt.exe 74 - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 1760 776 WerFault.exe 74 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe - Modifies data under HKEY_USERS 45 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4128" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132892139161579639" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.033905" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1760 WerFault.exe Token: SeBackupPrivilege 1760 WerFault.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 812 wrote to memory of 3500 812 UPDATED PRICE LIST INQ.___Pdf.exe 71 PID 812 wrote to memory of 3500 812 UPDATED PRICE LIST INQ.___Pdf.exe 71 PID 812 wrote to memory of 3500 812 UPDATED PRICE LIST INQ.___Pdf.exe 71 PID 3500 wrote to memory of 776 3500 ziuqbapt.exe 74 PID 3500 wrote to memory of 776 3500 ziuqbapt.exe 74 PID 3500 wrote to memory of 776 3500 ziuqbapt.exe 74 PID 3500 wrote to memory of 776 3500 ziuqbapt.exe 74 PID 3500 wrote to memory of 776 3500 ziuqbapt.exe 74 PID 3500 wrote to memory of 776 3500 ziuqbapt.exe 74 PID 3500 wrote to memory of 776 3500 ziuqbapt.exe 74 PID 3500 wrote to memory of 776 3500 ziuqbapt.exe 74 PID 3500 wrote to memory of 776 3500 ziuqbapt.exe 74 PID 3500 wrote to memory of 776 3500 ziuqbapt.exe 74 PID 776 wrote to memory of 1760 776 ziuqbapt.exe 80 PID 776 wrote to memory of 1760 776 ziuqbapt.exe 80 PID 776 wrote to memory of 1760 776 ziuqbapt.exe 80 PID 1648 wrote to memory of 776 1648 WerFault.exe 74 PID 1648 wrote to memory of 776 1648 WerFault.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\UPDATED PRICE LIST INQ.___Pdf.exe"C:\Users\Admin\AppData\Local\Temp\UPDATED PRICE LIST INQ.___Pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\ziuqbapt.exeC:\Users\Admin\AppData\Local\Temp\ziuqbapt.exe C:\Users\Admin\AppData\Local\Temp\vmpkmfaz2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\ziuqbapt.exeC:\Users\Admin\AppData\Local\Temp\ziuqbapt.exe C:\Users\Admin\AppData\Local\Temp\vmpkmfaz3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 8124⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2356
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 776 -ip 7761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:1648