Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2022 09:53
Static task
static1
Behavioral task
behavioral1
Sample
proof of payment.exe
Resource
win7-20220812-en
General
-
Target
proof of payment.exe
-
Size
661KB
-
MD5
af0b6c0b096bc0a9a6c6da19b3340a4c
-
SHA1
4bc68ca3cd282e9c711c6b9a452a425af4fdf8d8
-
SHA256
0b069c7e87aeb1802c8a83bf595bdf68040faf36bb5f607f4d1a20b8b8f45403
-
SHA512
b33da09ded4c519566e9277cc4b10c4f5553246dd587c74c6c212430b45d4c188221d65f4357a6a5ff97202e1429378dd903c7f23217a16acf876c0bf3ab0ba1
-
SSDEEP
12288:m5VF75e1ZsTyxRM2wfQy/FhucmJcTQJW0OkzKJfhd45/B:KVZ52ZX/OX9hDUcTOW5eAHW
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4288-144-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/4288-146-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/4288-149-0x0000000000400000-0x000000000042B000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
proof of payment.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation proof of payment.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
proof of payment.exedescription pid process target process PID 5044 set thread context of 4288 5044 proof of payment.exe proof of payment.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3476 powershell.exe 3476 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3476 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
proof of payment.exedescription pid process target process PID 5044 wrote to memory of 3476 5044 proof of payment.exe powershell.exe PID 5044 wrote to memory of 3476 5044 proof of payment.exe powershell.exe PID 5044 wrote to memory of 3476 5044 proof of payment.exe powershell.exe PID 5044 wrote to memory of 2272 5044 proof of payment.exe schtasks.exe PID 5044 wrote to memory of 2272 5044 proof of payment.exe schtasks.exe PID 5044 wrote to memory of 2272 5044 proof of payment.exe schtasks.exe PID 5044 wrote to memory of 4288 5044 proof of payment.exe proof of payment.exe PID 5044 wrote to memory of 4288 5044 proof of payment.exe proof of payment.exe PID 5044 wrote to memory of 4288 5044 proof of payment.exe proof of payment.exe PID 5044 wrote to memory of 4288 5044 proof of payment.exe proof of payment.exe PID 5044 wrote to memory of 4288 5044 proof of payment.exe proof of payment.exe PID 5044 wrote to memory of 4288 5044 proof of payment.exe proof of payment.exe PID 5044 wrote to memory of 4288 5044 proof of payment.exe proof of payment.exe PID 5044 wrote to memory of 4288 5044 proof of payment.exe proof of payment.exe PID 5044 wrote to memory of 4288 5044 proof of payment.exe proof of payment.exe PID 5044 wrote to memory of 4288 5044 proof of payment.exe proof of payment.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uVDXDtwcCw.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uVDXDtwcCw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2FE9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2FE9.tmpFilesize
1KB
MD587d0840da68451ae48d1cf58c9712329
SHA18afe356116f93cb188f0801eb46187e441015bda
SHA25622ba44b31708437abcd7903ad748e893844ed44a1c8e4eb804b44ffc1e9cdc17
SHA512d2b436057200c6988d533d615ded38ad35b07763a4887145f719a133bd02966a9d5f47a5a384f629d3e865cf35602689296acff460543c0221f44e28644633a5
-
memory/2272-139-0x0000000000000000-mapping.dmp
-
memory/3476-147-0x0000000005050000-0x0000000005072000-memory.dmpFilesize
136KB
-
memory/3476-157-0x0000000007620000-0x00000000076B6000-memory.dmpFilesize
600KB
-
memory/3476-148-0x0000000005980000-0x00000000059E6000-memory.dmpFilesize
408KB
-
memory/3476-154-0x00000000079E0000-0x000000000805A000-memory.dmpFilesize
6.5MB
-
memory/3476-138-0x0000000000000000-mapping.dmp
-
memory/3476-159-0x00000000076E0000-0x00000000076FA000-memory.dmpFilesize
104KB
-
memory/3476-140-0x0000000002710000-0x0000000002746000-memory.dmpFilesize
216KB
-
memory/3476-158-0x00000000075D0000-0x00000000075DE000-memory.dmpFilesize
56KB
-
memory/3476-153-0x0000000006640000-0x000000000665E000-memory.dmpFilesize
120KB
-
memory/3476-152-0x0000000070B10000-0x0000000070B5C000-memory.dmpFilesize
304KB
-
memory/3476-142-0x00000000051E0000-0x0000000005808000-memory.dmpFilesize
6.2MB
-
memory/3476-151-0x0000000006660000-0x0000000006692000-memory.dmpFilesize
200KB
-
memory/3476-160-0x00000000076C0000-0x00000000076C8000-memory.dmpFilesize
32KB
-
memory/3476-155-0x00000000073A0000-0x00000000073BA000-memory.dmpFilesize
104KB
-
memory/3476-156-0x0000000007410000-0x000000000741A000-memory.dmpFilesize
40KB
-
memory/3476-150-0x00000000060A0000-0x00000000060BE000-memory.dmpFilesize
120KB
-
memory/4288-146-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4288-144-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4288-143-0x0000000000000000-mapping.dmp
-
memory/4288-149-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5044-133-0x0000000005A30000-0x0000000005FD4000-memory.dmpFilesize
5.6MB
-
memory/5044-137-0x00000000096A0000-0x0000000009706000-memory.dmpFilesize
408KB
-
memory/5044-136-0x0000000009600000-0x000000000969C000-memory.dmpFilesize
624KB
-
memory/5044-135-0x0000000005660000-0x000000000566A000-memory.dmpFilesize
40KB
-
memory/5044-134-0x0000000005570000-0x0000000005602000-memory.dmpFilesize
584KB
-
memory/5044-132-0x0000000000C80000-0x0000000000D2A000-memory.dmpFilesize
680KB