aa7436d336aa352db635976f19fe9f6fce9078608d3fdb4bbe1994f3425326ec

Analysis

max time kernel
150s
max time network
168s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
11/08/2022, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TNT Original Invoice.exe
Size 283KB
Sample220811-kfvtaadaap
SHA256 aa7436d336aa352db635976f19fe9f6fce9078608d3fdb4bbe1994f3425326ec
MD5 382b66f8a5dca1305cf1e5de83b7fdef
SHA1 6f091e5c2c085341e4b95b79b9d0f5738f3adb55
SHA512 66bdd0f4d4cb2d9a84f74620bf15ab8fc9337f311ff665e8187e36066924f7dedec7712eb5c227a82790429d9215207728807fafbf7b6e2892fa2324f4804373
MD5 SHA1 SHA512

Score

8^/10

spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	1288	cmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 1140	900	TNT Original Invoice.exe	26
PID 1140 set thread context of 1204	1140	cvtres.exe	15
PID 1288 set thread context of 1204	1288	cmstp.exe	15

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3762437355-3468409815-1164039494-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmstp.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1140	cvtres.exe
1140	cvtres.exe
1140	cvtres.exe
1140	cvtres.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1140	cvtres.exe
1140	cvtres.exe
1140	cvtres.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe
1288	cmstp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	cvtres.exe
Token: SeDebugPrivilege	1288	cmstp.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1140	900	TNT Original Invoice.exe	26
PID 900 wrote to memory of 1140	900	TNT Original Invoice.exe	26
PID 900 wrote to memory of 1140	900	TNT Original Invoice.exe	26
PID 900 wrote to memory of 1140	900	TNT Original Invoice.exe	26
PID 900 wrote to memory of 1140	900	TNT Original Invoice.exe	26
PID 900 wrote to memory of 1140	900	TNT Original Invoice.exe	26
PID 900 wrote to memory of 1140	900	TNT Original Invoice.exe	26
PID 1204 wrote to memory of 1288	1204	Explorer.EXE	27
PID 1204 wrote to memory of 1288	1204	Explorer.EXE	27
PID 1204 wrote to memory of 1288	1204	Explorer.EXE	27
PID 1204 wrote to memory of 1288	1204	Explorer.EXE	27
PID 1204 wrote to memory of 1288	1204	Explorer.EXE	27
PID 1204 wrote to memory of 1288	1204	Explorer.EXE	27
PID 1204 wrote to memory of 1288	1204	Explorer.EXE	27
PID 1288 wrote to memory of 2044	1288	cmstp.exe	29
PID 1288 wrote to memory of 2044	1288	cmstp.exe	29
PID 1288 wrote to memory of 2044	1288	cmstp.exe	29
PID 1288 wrote to memory of 2044	1288	cmstp.exe	29
PID 1288 wrote to memory of 2044	1288	cmstp.exe	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x00000000002E0000-0x0000000000328000-memory.dmp

Download

memory/900-55-0x00000000004F0000-0x0000000000526000-memory.dmp

Download

memory/900-56-0x0000000000570000-0x00000000005A8000-memory.dmp

Download

memory/900-57-0x00000000003A0000-0x00000000003A8000-memory.dmp

Download

memory/1140-66-0x000000000041F000-0x0000000000421000-memory.dmp

Download

memory/1140-61-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1140-64-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1140-65-0x0000000000990000-0x0000000000C93000-memory.dmp

Download

memory/1140-58-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1140-67-0x0000000000140000-0x0000000000150000-memory.dmp

Download

memory/1140-59-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1204-75-0x0000000004D00000-0x0000000004E4C000-memory.dmp

Download

memory/1204-68-0x0000000004BA0000-0x0000000004CF9000-memory.dmp

Download

memory/1204-77-0x0000000004D00000-0x0000000004E4C000-memory.dmp

Download

memory/1288-73-0x0000000001E90000-0x0000000002193000-memory.dmp

Download

memory/1288-72-0x0000000000090000-0x00000000000BB000-memory.dmp

Download

memory/1288-71-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/1288-74-0x0000000000370000-0x00000000003FF000-memory.dmp

Download

memory/1288-76-0x0000000000090000-0x00000000000BB000-memory.dmp

Download

memory/1288-70-0x0000000076091000-0x0000000076093000-memory.dmp

Download