Analysis
-
max time kernel
108s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
29-07-2022 20:55
Behavioral task
behavioral1
Sample
Tax Payment Invoice.exe
Resource
win7-20220718-en
General
-
Target
Tax Payment Invoice.exe
-
Size
740KB
-
MD5
bba7a2ee3cc8f1b19f25cf46a2c35b24
-
SHA1
f62736f38dc27ed47bd89c75eff750ef1d2fb8e4
-
SHA256
fbc0263ae8cef48b184cfee870c2f5f4ee3c5006ffb0090cc3f024486628a4eb
-
SHA512
0bbcc177b77f01d3e65faff0c0913562270b580cc86a3b944fb53750484e0231160f4947492ac34257df3cfbdab4ea080cc7826aa7ff5dac4d5fecc8bbaa512d
Malware Config
Extracted
kutaki
http://newloshree.xyz/work/kenny3.php
Signatures
-
Kutaki Executable 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe family_kutaki \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe family_kutaki C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe family_kutaki -
Executes dropped EXE 1 IoCs
Processes:
ch.exepid process 1100 ch.exe -
Drops startup file 2 IoCs
Processes:
Tax Payment Invoice.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe Tax Payment Invoice.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe Tax Payment Invoice.exe -
Loads dropped DLL 2 IoCs
Processes:
Tax Payment Invoice.exepid process 1208 Tax Payment Invoice.exe 1208 Tax Payment Invoice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 1912 DllHost.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
Tax Payment Invoice.exech.exepid process 1208 Tax Payment Invoice.exe 1208 Tax Payment Invoice.exe 1208 Tax Payment Invoice.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe 1100 ch.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Tax Payment Invoice.exedescription pid process target process PID 1208 wrote to memory of 1324 1208 Tax Payment Invoice.exe cmd.exe PID 1208 wrote to memory of 1324 1208 Tax Payment Invoice.exe cmd.exe PID 1208 wrote to memory of 1324 1208 Tax Payment Invoice.exe cmd.exe PID 1208 wrote to memory of 1324 1208 Tax Payment Invoice.exe cmd.exe PID 1208 wrote to memory of 1100 1208 Tax Payment Invoice.exe ch.exe PID 1208 wrote to memory of 1100 1208 Tax Payment Invoice.exe ch.exe PID 1208 wrote to memory of 1100 1208 Tax Payment Invoice.exe ch.exe PID 1208 wrote to memory of 1100 1208 Tax Payment Invoice.exe ch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax Payment Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Tax Payment Invoice.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp2⤵PID:1324
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1100
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
740KB
MD5bba7a2ee3cc8f1b19f25cf46a2c35b24
SHA1f62736f38dc27ed47bd89c75eff750ef1d2fb8e4
SHA256fbc0263ae8cef48b184cfee870c2f5f4ee3c5006ffb0090cc3f024486628a4eb
SHA5120bbcc177b77f01d3e65faff0c0913562270b580cc86a3b944fb53750484e0231160f4947492ac34257df3cfbdab4ea080cc7826aa7ff5dac4d5fecc8bbaa512d
-
Filesize
740KB
MD5bba7a2ee3cc8f1b19f25cf46a2c35b24
SHA1f62736f38dc27ed47bd89c75eff750ef1d2fb8e4
SHA256fbc0263ae8cef48b184cfee870c2f5f4ee3c5006ffb0090cc3f024486628a4eb
SHA5120bbcc177b77f01d3e65faff0c0913562270b580cc86a3b944fb53750484e0231160f4947492ac34257df3cfbdab4ea080cc7826aa7ff5dac4d5fecc8bbaa512d
-
Filesize
740KB
MD5bba7a2ee3cc8f1b19f25cf46a2c35b24
SHA1f62736f38dc27ed47bd89c75eff750ef1d2fb8e4
SHA256fbc0263ae8cef48b184cfee870c2f5f4ee3c5006ffb0090cc3f024486628a4eb
SHA5120bbcc177b77f01d3e65faff0c0913562270b580cc86a3b944fb53750484e0231160f4947492ac34257df3cfbdab4ea080cc7826aa7ff5dac4d5fecc8bbaa512d