Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2022 09:53
Static task
static1
Behavioral task
behavioral1
Sample
proof of payment.exe
Resource
win7-20220812-en
General
-
Target
proof of payment.exe
-
Size
661KB
-
MD5
af0b6c0b096bc0a9a6c6da19b3340a4c
-
SHA1
4bc68ca3cd282e9c711c6b9a452a425af4fdf8d8
-
SHA256
0b069c7e87aeb1802c8a83bf595bdf68040faf36bb5f607f4d1a20b8b8f45403
-
SHA512
b33da09ded4c519566e9277cc4b10c4f5553246dd587c74c6c212430b45d4c188221d65f4357a6a5ff97202e1429378dd903c7f23217a16acf876c0bf3ab0ba1
-
SSDEEP
12288:m5VF75e1ZsTyxRM2wfQy/FhucmJcTQJW0OkzKJfhd45/B:KVZ52ZX/OX9hDUcTOW5eAHW
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4180-148-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/4180-146-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/4180-150-0x0000000000400000-0x000000000042B000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
proof of payment.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation proof of payment.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
proof of payment.exedescription pid process target process PID 5048 set thread context of 4180 5048 proof of payment.exe proof of payment.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeproof of payment.exepid process 4820 powershell.exe 5048 proof of payment.exe 5048 proof of payment.exe 4820 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeproof of payment.exedescription pid process Token: SeDebugPrivilege 4820 powershell.exe Token: SeDebugPrivilege 5048 proof of payment.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
proof of payment.exedescription pid process target process PID 5048 wrote to memory of 4820 5048 proof of payment.exe powershell.exe PID 5048 wrote to memory of 4820 5048 proof of payment.exe powershell.exe PID 5048 wrote to memory of 4820 5048 proof of payment.exe powershell.exe PID 5048 wrote to memory of 1200 5048 proof of payment.exe schtasks.exe PID 5048 wrote to memory of 1200 5048 proof of payment.exe schtasks.exe PID 5048 wrote to memory of 1200 5048 proof of payment.exe schtasks.exe PID 5048 wrote to memory of 4804 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4804 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4804 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4180 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4180 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4180 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4180 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4180 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4180 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4180 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4180 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4180 5048 proof of payment.exe proof of payment.exe PID 5048 wrote to memory of 4180 5048 proof of payment.exe proof of payment.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uVDXDtwcCw.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uVDXDtwcCw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp21E0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp21E0.tmpFilesize
1KB
MD5b67549034aeeef8775602f32e61998c0
SHA1898dd8aea4e711439b9acaa316c9a4e7728aea23
SHA256fd0ff61376684df68c755c89dd505e7674a70ce91a7cee855799ab483baf0382
SHA512ec81aadedb895f5a15d758696237ba11b697c9480e28b042027ecd0200866d29538c64354a98ccce192e828cc4f2394ce20ba22ed896088b7ec26539d76fbe60
-
memory/1200-139-0x0000000000000000-mapping.dmp
-
memory/4180-150-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4180-146-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4180-148-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4180-145-0x0000000000000000-mapping.dmp
-
memory/4804-143-0x0000000000000000-mapping.dmp
-
memory/4820-149-0x0000000006120000-0x0000000006186000-memory.dmpFilesize
408KB
-
memory/4820-156-0x0000000007B00000-0x0000000007B1A000-memory.dmpFilesize
104KB
-
memory/4820-138-0x0000000000000000-mapping.dmp
-
memory/4820-142-0x00000000058C0000-0x0000000005EE8000-memory.dmpFilesize
6.2MB
-
memory/4820-161-0x0000000007E20000-0x0000000007E28000-memory.dmpFilesize
32KB
-
memory/4820-144-0x0000000005850000-0x0000000005872000-memory.dmpFilesize
136KB
-
memory/4820-160-0x0000000007E40000-0x0000000007E5A000-memory.dmpFilesize
104KB
-
memory/4820-159-0x0000000007D30000-0x0000000007D3E000-memory.dmpFilesize
56KB
-
memory/4820-158-0x0000000007D80000-0x0000000007E16000-memory.dmpFilesize
600KB
-
memory/4820-157-0x0000000007B70000-0x0000000007B7A000-memory.dmpFilesize
40KB
-
memory/4820-140-0x0000000002EE0000-0x0000000002F16000-memory.dmpFilesize
216KB
-
memory/4820-151-0x00000000067F0000-0x000000000680E000-memory.dmpFilesize
120KB
-
memory/4820-152-0x0000000006DD0000-0x0000000006E02000-memory.dmpFilesize
200KB
-
memory/4820-153-0x0000000070AC0000-0x0000000070B0C000-memory.dmpFilesize
304KB
-
memory/4820-154-0x0000000006DB0000-0x0000000006DCE000-memory.dmpFilesize
120KB
-
memory/4820-155-0x0000000008150000-0x00000000087CA000-memory.dmpFilesize
6.5MB
-
memory/5048-133-0x0000000005B70000-0x0000000006114000-memory.dmpFilesize
5.6MB
-
memory/5048-134-0x0000000005660000-0x00000000056F2000-memory.dmpFilesize
584KB
-
memory/5048-135-0x0000000005640000-0x000000000564A000-memory.dmpFilesize
40KB
-
memory/5048-132-0x0000000000C10000-0x0000000000CBA000-memory.dmpFilesize
680KB
-
memory/5048-136-0x0000000009590000-0x000000000962C000-memory.dmpFilesize
624KB
-
memory/5048-137-0x0000000009630000-0x0000000009696000-memory.dmpFilesize
408KB