e2ada17298bdb93977b0f7c57907bc7077437c43b813d8ba3e81f2e93b3bec5d

General

Target

ANANOHYJ-PAYMENT-RECEIPT.exe
Size

300.0MB
MD5

dba3209d9c78a3bf216ba69f483af62c
SHA1

68b017f099f31c1e631283007cfa25513d2ae924
SHA256

e2ada17298bdb93977b0f7c57907bc7077437c43b813d8ba3e81f2e93b3bec5d
SHA512

42b5d35c9d0f43ce2e438bda6e686b57ec906ab2588ed0f5862948134e73c8e1649d1f895d46dcea58147523861ac1faa7669fb4c0b7d3d30586bbf07ad82ef7

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

wdfvbn.exewdfvbn.exewdfvbn.exe

pid process

2976 wdfvbn.exe
4584 wdfvbn.exe
4928 wdfvbn.exe

pid	process
2976	wdfvbn.exe
4584	wdfvbn.exe
4928	wdfvbn.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/456-133-0x0000000000B00000-0x0000000000EE4000-memory.dmp	upx
behavioral2/memory/456-134-0x0000000000B00000-0x0000000000EE4000-memory.dmp	upx
behavioral2/memory/1812-144-0x00000000008A0000-0x0000000000C84000-memory.dmp	upx
behavioral2/memory/1812-146-0x00000000008A0000-0x0000000000C84000-memory.dmp	upx
behavioral2/memory/1724-154-0x0000000000DC0000-0x00000000011A4000-memory.dmp	upx
behavioral2/memory/1724-155-0x0000000000DC0000-0x00000000011A4000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D1D7EDA4-5F18-4235-B841-168197C09B7B}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A66A4E50-34C4-4426-B77B-3A21EF6376C9}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ANANOHYJ-PAYMENT-RECEIPT.exewdfvbn.exewdfvbn.exe

description	pid	process	target process
PID 4400 set thread context of 456	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	vbc.exe
PID 2976 set thread context of 1812	2976	wdfvbn.exe	vbc.exe
PID 4584 set thread context of 1724	4584	wdfvbn.exe	vbc.exe

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

2080 456 WerFault.exe vbc.exe
4588 1812 WerFault.exe vbc.exe
3596 1724 WerFault.exe vbc.exe

pid	pid_target	process	target process
2080	456	WerFault.exe	vbc.exe
4588	1812	WerFault.exe	vbc.exe
3596	1724	WerFault.exe	vbc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1708 schtasks.exe
5044 schtasks.exe
400 schtasks.exe

pid	process
1708	schtasks.exe
5044	schtasks.exe
400	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

ANANOHYJ-PAYMENT-RECEIPT.exewdfvbn.exewdfvbn.exewdfvbn.exe

description	pid	process
Token: SeDebugPrivilege	4400	ANANOHYJ-PAYMENT-RECEIPT.exe
Token: SeDebugPrivilege	2976	wdfvbn.exe
Token: SeDebugPrivilege	4584	wdfvbn.exe
Token: SeDebugPrivilege	4928	wdfvbn.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

ANANOHYJ-PAYMENT-RECEIPT.execmd.exewdfvbn.execmd.exewdfvbn.execmd.exe

description	pid	process	target process
PID 4400 wrote to memory of 456	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	vbc.exe
PID 4400 wrote to memory of 456	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	vbc.exe
PID 4400 wrote to memory of 456	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	vbc.exe
PID 4400 wrote to memory of 456	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	vbc.exe
PID 4400 wrote to memory of 456	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	vbc.exe
PID 4400 wrote to memory of 456	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	vbc.exe
PID 4400 wrote to memory of 456	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	vbc.exe
PID 4400 wrote to memory of 4760	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	cmd.exe
PID 4400 wrote to memory of 4760	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	cmd.exe
PID 4400 wrote to memory of 4760	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	cmd.exe
PID 4400 wrote to memory of 908	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	cmd.exe
PID 4400 wrote to memory of 908	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	cmd.exe
PID 4400 wrote to memory of 908	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	cmd.exe
PID 4400 wrote to memory of 968	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	cmd.exe
PID 4400 wrote to memory of 968	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	cmd.exe
PID 4400 wrote to memory of 968	4400	ANANOHYJ-PAYMENT-RECEIPT.exe	cmd.exe
PID 908 wrote to memory of 5044	908	cmd.exe	schtasks.exe
PID 908 wrote to memory of 5044	908	cmd.exe	schtasks.exe
PID 908 wrote to memory of 5044	908	cmd.exe	schtasks.exe
PID 2976 wrote to memory of 1812	2976	wdfvbn.exe	vbc.exe
PID 2976 wrote to memory of 1812	2976	wdfvbn.exe	vbc.exe
PID 2976 wrote to memory of 1812	2976	wdfvbn.exe	vbc.exe
PID 2976 wrote to memory of 1812	2976	wdfvbn.exe	vbc.exe
PID 2976 wrote to memory of 1812	2976	wdfvbn.exe	vbc.exe
PID 2976 wrote to memory of 1812	2976	wdfvbn.exe	vbc.exe
PID 2976 wrote to memory of 1812	2976	wdfvbn.exe	vbc.exe
PID 2976 wrote to memory of 1844	2976	wdfvbn.exe	cmd.exe
PID 2976 wrote to memory of 1844	2976	wdfvbn.exe	cmd.exe
PID 2976 wrote to memory of 1844	2976	wdfvbn.exe	cmd.exe
PID 2976 wrote to memory of 1836	2976	wdfvbn.exe	cmd.exe
PID 2976 wrote to memory of 1836	2976	wdfvbn.exe	cmd.exe
PID 2976 wrote to memory of 1836	2976	wdfvbn.exe	cmd.exe
PID 2976 wrote to memory of 620	2976	wdfvbn.exe	cmd.exe
PID 2976 wrote to memory of 620	2976	wdfvbn.exe	cmd.exe
PID 2976 wrote to memory of 620	2976	wdfvbn.exe	cmd.exe
PID 1836 wrote to memory of 400	1836	cmd.exe	schtasks.exe
PID 1836 wrote to memory of 400	1836	cmd.exe	schtasks.exe
PID 1836 wrote to memory of 400	1836	cmd.exe	schtasks.exe
PID 4584 wrote to memory of 1724	4584	wdfvbn.exe	vbc.exe
PID 4584 wrote to memory of 1724	4584	wdfvbn.exe	vbc.exe
PID 4584 wrote to memory of 1724	4584	wdfvbn.exe	vbc.exe
PID 4584 wrote to memory of 1724	4584	wdfvbn.exe	vbc.exe
PID 4584 wrote to memory of 1724	4584	wdfvbn.exe	vbc.exe
PID 4584 wrote to memory of 1724	4584	wdfvbn.exe	vbc.exe
PID 4584 wrote to memory of 1724	4584	wdfvbn.exe	vbc.exe
PID 4584 wrote to memory of 3868	4584	wdfvbn.exe	cmd.exe
PID 4584 wrote to memory of 3868	4584	wdfvbn.exe	cmd.exe
PID 4584 wrote to memory of 3868	4584	wdfvbn.exe	cmd.exe
PID 4584 wrote to memory of 4980	4584	wdfvbn.exe	cmd.exe
PID 4584 wrote to memory of 4980	4584	wdfvbn.exe	cmd.exe
PID 4584 wrote to memory of 4980	4584	wdfvbn.exe	cmd.exe
PID 4584 wrote to memory of 4364	4584	wdfvbn.exe	cmd.exe
PID 4584 wrote to memory of 4364	4584	wdfvbn.exe	cmd.exe
PID 4584 wrote to memory of 4364	4584	wdfvbn.exe	cmd.exe
PID 4980 wrote to memory of 1708	4980	cmd.exe	schtasks.exe
PID 4980 wrote to memory of 1708	4980	cmd.exe	schtasks.exe
PID 4980 wrote to memory of 1708	4980	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\ANANOHYJ-PAYMENT-RECEIPT.exe
"C:\Users\Admin\AppData\Local\Temp\ANANOHYJ-PAYMENT-RECEIPT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 188
3⤵
- Program crash
PID:2080

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wdfvbn"
2⤵
PID:4760

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe'" /f
3⤵
- Creates scheduled task(s)
PID:5044

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ANANOHYJ-PAYMENT-RECEIPT.exe" "C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe"
2⤵
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 456 -ip 456
1⤵
PID:1588

C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe
C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 188
3⤵
- Program crash
PID:4588

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wdfvbn"
2⤵
PID:1844

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe'" /f
3⤵
- Creates scheduled task(s)
PID:400

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe" "C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe"
2⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1812 -ip 1812
1⤵
PID:2088

C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe
C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 188
3⤵
- Program crash
PID:3596

C:\Windows\SysWOW64\cmd.exe
"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wdfvbn"
2⤵
PID:3868

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe'" /f
3⤵
- Creates scheduled task(s)
PID:1708

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe" "C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe"
2⤵
PID:4364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1724 -ip 1724
1⤵
PID:5008

C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe
C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wdfvbn.exe.log
Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe
Filesize
300.0MB

MD5
dba3209d9c78a3bf216ba69f483af62c

SHA1
68b017f099f31c1e631283007cfa25513d2ae924

SHA256
e2ada17298bdb93977b0f7c57907bc7077437c43b813d8ba3e81f2e93b3bec5d

SHA512
42b5d35c9d0f43ce2e438bda6e686b57ec906ab2588ed0f5862948134e73c8e1649d1f895d46dcea58147523861ac1faa7669fb4c0b7d3d30586bbf07ad82ef7

Download Submit
C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe
Filesize
300.0MB

MD5
dba3209d9c78a3bf216ba69f483af62c

SHA1
68b017f099f31c1e631283007cfa25513d2ae924

SHA256
e2ada17298bdb93977b0f7c57907bc7077437c43b813d8ba3e81f2e93b3bec5d

SHA512
42b5d35c9d0f43ce2e438bda6e686b57ec906ab2588ed0f5862948134e73c8e1649d1f895d46dcea58147523861ac1faa7669fb4c0b7d3d30586bbf07ad82ef7

Download Submit
C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe
Filesize
300.0MB

MD5
dba3209d9c78a3bf216ba69f483af62c

SHA1
68b017f099f31c1e631283007cfa25513d2ae924

SHA256
e2ada17298bdb93977b0f7c57907bc7077437c43b813d8ba3e81f2e93b3bec5d

SHA512
42b5d35c9d0f43ce2e438bda6e686b57ec906ab2588ed0f5862948134e73c8e1649d1f895d46dcea58147523861ac1faa7669fb4c0b7d3d30586bbf07ad82ef7

Download Submit
C:\Users\Admin\AppData\Roaming\wdfvbn\wdfvbn.exe
Filesize
289.4MB

MD5
566135e9a517a204c2e8fb2f7332ecdc

SHA1
4cde0ea64922233cafe2eba489a79d67222e2022

SHA256
1b3da7f55427827f44cafce5301508fb6e2806c387e5044479778c8dde87624a

SHA512
9caf700b65d48617e6df09f2754a212c0c90908695b9be0aa33c2e7640e0529d20a91b51eab6dd3a775a51b63f281dfd358afe271b1781cf16165bc24cb1bdfe

Download Submit
memory/400-149-0x0000000000000000-mapping.dmp

Download
memory/456-131-0x0000000000000000-mapping.dmp

Download
memory/456-133-0x0000000000B00000-0x0000000000EE4000-memory.dmp

Filesize
3.9MB

Download
memory/456-134-0x0000000000B00000-0x0000000000EE4000-memory.dmp

Filesize
3.9MB

Download
memory/620-148-0x0000000000000000-mapping.dmp

Download
memory/908-136-0x0000000000000000-mapping.dmp

Download
memory/968-137-0x0000000000000000-mapping.dmp

Download
memory/1708-159-0x0000000000000000-mapping.dmp

Download
memory/1724-154-0x0000000000DC0000-0x00000000011A4000-memory.dmp

Filesize
3.9MB

Download
memory/1724-152-0x0000000000000000-mapping.dmp

Download
memory/1724-155-0x0000000000DC0000-0x00000000011A4000-memory.dmp

Filesize
3.9MB

Download
memory/1812-142-0x0000000000000000-mapping.dmp

Download
memory/1812-144-0x00000000008A0000-0x0000000000C84000-memory.dmp

Filesize
3.9MB

Download
memory/1812-146-0x00000000008A0000-0x0000000000C84000-memory.dmp

Filesize
3.9MB

Download
memory/1836-147-0x0000000000000000-mapping.dmp

Download
memory/1844-145-0x0000000000000000-mapping.dmp

Download
memory/2976-141-0x00000000006B0000-0x0000000000872000-memory.dmp

Filesize
1.8MB

Download
memory/3868-156-0x0000000000000000-mapping.dmp

Download
memory/4364-158-0x0000000000000000-mapping.dmp

Download
memory/4400-130-0x0000000000410000-0x00000000005D2000-memory.dmp

Filesize
1.8MB

Download
memory/4760-135-0x0000000000000000-mapping.dmp

Download
memory/4980-157-0x0000000000000000-mapping.dmp

Download
memory/5044-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads