Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
29-07-2022 20:55
Behavioral task
behavioral1
Sample
Tax Payment Invoice.exe
Resource
win7-20220718-en
General
-
Target
Tax Payment Invoice.exe
-
Size
740KB
-
MD5
bba7a2ee3cc8f1b19f25cf46a2c35b24
-
SHA1
f62736f38dc27ed47bd89c75eff750ef1d2fb8e4
-
SHA256
fbc0263ae8cef48b184cfee870c2f5f4ee3c5006ffb0090cc3f024486628a4eb
-
SHA512
0bbcc177b77f01d3e65faff0c0913562270b580cc86a3b944fb53750484e0231160f4947492ac34257df3cfbdab4ea080cc7826aa7ff5dac4d5fecc8bbaa512d
Malware Config
Extracted
kutaki
http://newloshree.xyz/work/kenny3.php
Signatures
-
Kutaki Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe family_kutaki C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe family_kutaki -
Executes dropped EXE 1 IoCs
Processes:
ch.exepid process 832 ch.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation cmd.exe -
Drops startup file 2 IoCs
Processes:
Tax Payment Invoice.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe Tax Payment Invoice.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe Tax Payment Invoice.exe -
Drops file in Windows directory 1 IoCs
Processes:
mspaint.exedescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mspaint.exepid process 3896 mspaint.exe 3896 mspaint.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
Tax Payment Invoice.exech.exemspaint.exepid process 2496 Tax Payment Invoice.exe 2496 Tax Payment Invoice.exe 2496 Tax Payment Invoice.exe 832 ch.exe 3896 mspaint.exe 832 ch.exe 832 ch.exe 3896 mspaint.exe 3896 mspaint.exe 3896 mspaint.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Tax Payment Invoice.execmd.exedescription pid process target process PID 2496 wrote to memory of 828 2496 Tax Payment Invoice.exe cmd.exe PID 2496 wrote to memory of 828 2496 Tax Payment Invoice.exe cmd.exe PID 2496 wrote to memory of 828 2496 Tax Payment Invoice.exe cmd.exe PID 2496 wrote to memory of 832 2496 Tax Payment Invoice.exe ch.exe PID 2496 wrote to memory of 832 2496 Tax Payment Invoice.exe ch.exe PID 2496 wrote to memory of 832 2496 Tax Payment Invoice.exe ch.exe PID 828 wrote to memory of 3896 828 cmd.exe mspaint.exe PID 828 wrote to memory of 3896 828 cmd.exe mspaint.exe PID 828 wrote to memory of 3896 828 cmd.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax Payment Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Tax Payment Invoice.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp"3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3896
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:832
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
740KB
MD5bba7a2ee3cc8f1b19f25cf46a2c35b24
SHA1f62736f38dc27ed47bd89c75eff750ef1d2fb8e4
SHA256fbc0263ae8cef48b184cfee870c2f5f4ee3c5006ffb0090cc3f024486628a4eb
SHA5120bbcc177b77f01d3e65faff0c0913562270b580cc86a3b944fb53750484e0231160f4947492ac34257df3cfbdab4ea080cc7826aa7ff5dac4d5fecc8bbaa512d
-
Filesize
740KB
MD5bba7a2ee3cc8f1b19f25cf46a2c35b24
SHA1f62736f38dc27ed47bd89c75eff750ef1d2fb8e4
SHA256fbc0263ae8cef48b184cfee870c2f5f4ee3c5006ffb0090cc3f024486628a4eb
SHA5120bbcc177b77f01d3e65faff0c0913562270b580cc86a3b944fb53750484e0231160f4947492ac34257df3cfbdab4ea080cc7826aa7ff5dac4d5fecc8bbaa512d