Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
27-07-2022 18:18
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT ADVISE PO#N-R2630005JULY.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
PAYMENT ADVISE PO#N-R2630005JULY.exe
Resource
win10v2004-20220721-en
General
-
Target
PAYMENT ADVISE PO#N-R2630005JULY.exe
-
Size
463KB
-
MD5
68ca13260b23abea2b5a97cc12a2819a
-
SHA1
396996761ea6febc579113d0abc3436aa7f74bb3
-
SHA256
cb24ed92a870498ac3f974711a6894ff0f89d4efa1eb3c0c7d90a8554754f99f
-
SHA512
a5db697dd597ebe64cc5a8a1e877a690e90e280ca7c119f04057e91d147450076c9e658a4c6d02bfe36199c20d635ceafb30d1191b587ea10386db2222c6c6e5
Malware Config
Extracted
bitrat
1.38
103.153.79.240:1234
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
DrNZO6y8k5N0YbXW.exepid process 592 DrNZO6y8k5N0YbXW.exe -
Loads dropped DLL 4 IoCs
Processes:
InstallUtil.exepid process 1780 InstallUtil.exe 1780 InstallUtil.exe 1780 InstallUtil.exe 1780 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PAYMENT ADVISE PO#N-R2630005JULY.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jjzyqctrp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Qyglyhif\\Jjzyqctrp.exe\"" PAYMENT ADVISE PO#N-R2630005JULY.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
DrNZO6y8k5N0YbXW.exepid process 592 DrNZO6y8k5N0YbXW.exe 592 DrNZO6y8k5N0YbXW.exe 592 DrNZO6y8k5N0YbXW.exe 592 DrNZO6y8k5N0YbXW.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PAYMENT ADVISE PO#N-R2630005JULY.exedescription pid process target process PID 996 set thread context of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exePAYMENT ADVISE PO#N-R2630005JULY.exepid process 1180 powershell.exe 996 PAYMENT ADVISE PO#N-R2630005JULY.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exePAYMENT ADVISE PO#N-R2630005JULY.exeDrNZO6y8k5N0YbXW.exedescription pid process Token: SeDebugPrivilege 1180 powershell.exe Token: SeDebugPrivilege 996 PAYMENT ADVISE PO#N-R2630005JULY.exe Token: SeDebugPrivilege 592 DrNZO6y8k5N0YbXW.exe Token: SeShutdownPrivilege 592 DrNZO6y8k5N0YbXW.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
DrNZO6y8k5N0YbXW.exepid process 592 DrNZO6y8k5N0YbXW.exe 592 DrNZO6y8k5N0YbXW.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
PAYMENT ADVISE PO#N-R2630005JULY.exeInstallUtil.exedescription pid process target process PID 996 wrote to memory of 1180 996 PAYMENT ADVISE PO#N-R2630005JULY.exe powershell.exe PID 996 wrote to memory of 1180 996 PAYMENT ADVISE PO#N-R2630005JULY.exe powershell.exe PID 996 wrote to memory of 1180 996 PAYMENT ADVISE PO#N-R2630005JULY.exe powershell.exe PID 996 wrote to memory of 1180 996 PAYMENT ADVISE PO#N-R2630005JULY.exe powershell.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 996 wrote to memory of 1780 996 PAYMENT ADVISE PO#N-R2630005JULY.exe InstallUtil.exe PID 1780 wrote to memory of 592 1780 InstallUtil.exe DrNZO6y8k5N0YbXW.exe PID 1780 wrote to memory of 592 1780 InstallUtil.exe DrNZO6y8k5N0YbXW.exe PID 1780 wrote to memory of 592 1780 InstallUtil.exe DrNZO6y8k5N0YbXW.exe PID 1780 wrote to memory of 592 1780 InstallUtil.exe DrNZO6y8k5N0YbXW.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE PO#N-R2630005JULY.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE PO#N-R2630005JULY.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\DrNZO6y8k5N0YbXW.exe"C:\Users\Admin\AppData\Local\Temp\DrNZO6y8k5N0YbXW.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:592
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DrNZO6y8k5N0YbXW.exeFilesize
3.8MB
MD5086686330159cbeae2d5c94b25967fa9
SHA119f3571b45823fcf1b1c05cdd25f1c98c45c712a
SHA256f93e5dfa75e3edfabc8bd414b9beaa735ccd8a91b12f9c57bb923aa5c3232e9d
SHA5129ff98a9211162972fcbb277ce1d5cffea39303a25e7209b8a8a3d7ed0e135630b3dee122323c725022a078c462634b34c82ace4baf3680cedc1865f9c27dbba5
-
\Users\Admin\AppData\Local\Temp\DrNZO6y8k5N0YbXW.exeFilesize
3.8MB
MD5086686330159cbeae2d5c94b25967fa9
SHA119f3571b45823fcf1b1c05cdd25f1c98c45c712a
SHA256f93e5dfa75e3edfabc8bd414b9beaa735ccd8a91b12f9c57bb923aa5c3232e9d
SHA5129ff98a9211162972fcbb277ce1d5cffea39303a25e7209b8a8a3d7ed0e135630b3dee122323c725022a078c462634b34c82ace4baf3680cedc1865f9c27dbba5
-
\Users\Admin\AppData\Local\Temp\DrNZO6y8k5N0YbXW.exeFilesize
3.8MB
MD5086686330159cbeae2d5c94b25967fa9
SHA119f3571b45823fcf1b1c05cdd25f1c98c45c712a
SHA256f93e5dfa75e3edfabc8bd414b9beaa735ccd8a91b12f9c57bb923aa5c3232e9d
SHA5129ff98a9211162972fcbb277ce1d5cffea39303a25e7209b8a8a3d7ed0e135630b3dee122323c725022a078c462634b34c82ace4baf3680cedc1865f9c27dbba5
-
\Users\Admin\AppData\Local\Temp\DrNZO6y8k5N0YbXW.exeFilesize
3.8MB
MD5086686330159cbeae2d5c94b25967fa9
SHA119f3571b45823fcf1b1c05cdd25f1c98c45c712a
SHA256f93e5dfa75e3edfabc8bd414b9beaa735ccd8a91b12f9c57bb923aa5c3232e9d
SHA5129ff98a9211162972fcbb277ce1d5cffea39303a25e7209b8a8a3d7ed0e135630b3dee122323c725022a078c462634b34c82ace4baf3680cedc1865f9c27dbba5
-
\Users\Admin\AppData\Local\Temp\DrNZO6y8k5N0YbXW.exeFilesize
3.8MB
MD5086686330159cbeae2d5c94b25967fa9
SHA119f3571b45823fcf1b1c05cdd25f1c98c45c712a
SHA256f93e5dfa75e3edfabc8bd414b9beaa735ccd8a91b12f9c57bb923aa5c3232e9d
SHA5129ff98a9211162972fcbb277ce1d5cffea39303a25e7209b8a8a3d7ed0e135630b3dee122323c725022a078c462634b34c82ace4baf3680cedc1865f9c27dbba5
-
memory/592-83-0x0000000000000000-mapping.dmp
-
memory/996-57-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/996-56-0x00000000047D0000-0x0000000004862000-memory.dmpFilesize
584KB
-
memory/996-54-0x0000000000BE0000-0x0000000000C5A000-memory.dmpFilesize
488KB
-
memory/996-55-0x0000000002060000-0x00000000020D4000-memory.dmpFilesize
464KB
-
memory/1180-62-0x000000006E370000-0x000000006E91B000-memory.dmpFilesize
5.7MB
-
memory/1180-61-0x000000006E370000-0x000000006E91B000-memory.dmpFilesize
5.7MB
-
memory/1180-60-0x000000006E370000-0x000000006E91B000-memory.dmpFilesize
5.7MB
-
memory/1180-58-0x0000000000000000-mapping.dmp
-
memory/1780-69-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1780-73-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1780-74-0x000000000040AE9E-mapping.dmp
-
memory/1780-77-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1780-78-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1780-71-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1780-70-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1780-68-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1780-66-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1780-64-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1780-84-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1780-63-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB