aa7436d336aa352db635976f19fe9f6fce9078608d3fdb4bbe1994f3425326ec

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2022, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TNT Original Invoice.exe
Size 283KB
Sample220811-kfvtaadaap
SHA256 aa7436d336aa352db635976f19fe9f6fce9078608d3fdb4bbe1994f3425326ec
MD5 382b66f8a5dca1305cf1e5de83b7fdef
SHA1 6f091e5c2c085341e4b95b79b9d0f5738f3adb55
SHA512 66bdd0f4d4cb2d9a84f74620bf15ab8fc9337f311ff665e8187e36066924f7dedec7712eb5c227a82790429d9215207728807fafbf7b6e2892fa2324f4804373
MD5 SHA1 SHA512

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4112 set thread context of 4568	4112	TNT Original Invoice.exe	82
PID 4568 set thread context of 8	4568	cvtres.exe	49
PID 3608 set thread context of 8	3608	cmstp.exe	49

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmstp.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4568	cvtres.exe
4568	cvtres.exe
4568	cvtres.exe
4568	cvtres.exe
4568	cvtres.exe
4568	cvtres.exe
4568	cvtres.exe
4568	cvtres.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
8	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4568	cvtres.exe
4568	cvtres.exe
4568	cvtres.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe
3608	cmstp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	cvtres.exe
Token: SeDebugPrivilege	3608	cmstp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4568	4112	TNT Original Invoice.exe	82
PID 4112 wrote to memory of 4568	4112	TNT Original Invoice.exe	82
PID 4112 wrote to memory of 4568	4112	TNT Original Invoice.exe	82
PID 4112 wrote to memory of 4568	4112	TNT Original Invoice.exe	82
PID 4112 wrote to memory of 4568	4112	TNT Original Invoice.exe	82
PID 4112 wrote to memory of 4568	4112	TNT Original Invoice.exe	82
PID 8 wrote to memory of 3608	8	Explorer.EXE	83
PID 8 wrote to memory of 3608	8	Explorer.EXE	83
PID 8 wrote to memory of 3608	8	Explorer.EXE	83
PID 3608 wrote to memory of 4496	3608	cmstp.exe	90
PID 3608 wrote to memory of 4496	3608	cmstp.exe	90
PID 3608 wrote to memory of 4496	3608	cmstp.exe	90

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-147-0x0000000007DA0000-0x0000000007EBF000-memory.dmp

Download

memory/8-145-0x0000000007DA0000-0x0000000007EBF000-memory.dmp

Download

memory/8-137-0x0000000007780000-0x0000000007880000-memory.dmp

Download

memory/8-143-0x0000000007780000-0x0000000007880000-memory.dmp

Download

memory/3608-142-0x00000000029B0000-0x0000000002CFA000-memory.dmp

Download

memory/3608-146-0x0000000000A50000-0x0000000000A7B000-memory.dmp

Download

memory/3608-144-0x0000000002740000-0x00000000027CF000-memory.dmp

Download

memory/3608-140-0x00000000004D0000-0x00000000004E6000-memory.dmp

Download

memory/3608-141-0x0000000000A50000-0x0000000000A7B000-memory.dmp

Download

memory/4112-130-0x0000000000370000-0x00000000003B8000-memory.dmp

Download

memory/4568-135-0x000000000041F000-0x0000000000421000-memory.dmp

Download

memory/4568-139-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4568-136-0x00000000009F0000-0x0000000000A00000-memory.dmp

Download

memory/4568-134-0x0000000000EC0000-0x000000000120A000-memory.dmp

Download

memory/4568-132-0x0000000000400000-0x000000000042B000-memory.dmp

Download