Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
21-09-2022 10:44
Static task
static1
Behavioral task
behavioral1
Sample
付款副本 $44,620.exe
Resource
win7-20220901-en
General
-
Target
付款副本 $44,620.exe
-
Size
288KB
-
MD5
f3cdb6d084eb1476923a99f04b868329
-
SHA1
943949819b8354ec72c6d7bc2990e60960cc983c
-
SHA256
53867ae1994d09f07b882ff96d80fc9d38b50e3aae70054985e07b20634ac14f
-
SHA512
d0d03f489f2163bb3b133bdc42b7b809ba88baeeeebe7541fca3380b59412ba88f87890e78c9fe5fb1398826f303f1d2b3f00e2cf98259a9a018409a7d2a2528
-
SSDEEP
6144:oQTBRm0/hGz940BNWWCmxKg5VzHUgaRv4w8DX4yyHO3APeyUqhIG:/Q0pKHGKKgzz0gaupYHO8eyUqZ
Malware Config
Extracted
formbook
dwdp
jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=
ke1Wv1l26dZZxDikX9dU3s6k8+w=
+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==
GHXPhYzwXcKgZwqBb/kejm7rfobj
yalW64iE8+aXs70=
MD83dBR0KSF4fizgRhAM
Xti3uNm2JDWgssPgRhAM
X7gYbv5uJhpvjdI0Qg==
ydxGznbNJ3tCCLAX4arq4nweMuQ=
Ca+fvtST8OBbosPgRhAM
kG1QegD8mU/E/hLw1t0=
g9FFFjEC5C2IvR/BhbSrpw==
PCkpeg38W0aPdg1rav1DFnVASw==
vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7
G7WYirSZS9EYob8=
WbEWaOVIAPlSNNc4LsfL53weMuQ=
hnyAvEY4n3rTKS4g5mHKxR0=
JN7b0uCqVrQydMl7JNw=
XTki/RASDK6BCW0q8sU=
DQMBWA9wJyOKqqGSmGHKxR0=
nJmd4HyE8g0mfqI=
6dfYKMvIhrcUa8l7JNw=
rUlBWHBUCn1c8CQA8PXzeVzrfobj
58Kt4lz9o6QF
cL0w6PZmKlfE8RoS5TDZMyH0
2Lyico9qDju7nr2X
b374NM2N3g0mfqI=
bVEtbg0KgZj533zw7n631TknAk9sHT4=
ZuNZIBhiw04fmLueUhJMOeZf+ilfHy8=
GBxm5ITLhl5XQOlF4DDZMyH0
6zulYX1WAoNl0vXmhkauyDcT8kdhBi0=
pZeodP1cQf3SyQtfUQ==
wsAZpF7WPbCJEDQt62HKxR0=
1A1vRW5BJHzzXsl7JNw=
ubG/Epl9PIb7Xtot5mHKxR0=
ExcR7v/y1XBW6wjRx722VlHrfobj
tvtepCyscmPvrsCd
QM28Ja5N8A0mfqI=
/UuzOsQY+8WgidZJSA==
pk0ZWgUKfY4STnqImJ/ZMyH0
0/4UFT1EL86yidZJSA==
mLH6x//qm+bQvFjJpKLZMyH0
yFLYqcdEtlNQ+ovii1iGrw==
CQUKN8PsFUSwtsPgRhAM
d1JHSBRgO1zvrsCd
EX/80uRL4gztasl7JNw=
VjpQXmhQEpTVRtNISg==
icUPYOYDaj6XzNmfS4jiZkwfc3aMc3m7
YbwogyCIP+zDssTgRhAM
liKeXXL3XdW2idZJSA==
DpZxgK191uNXWDttEgV8qQ==
yCQSTlcofmfvrsCd
0HdbxU5gWZTXChULh3d8uA==
wulP5XjDdoXs8AHdilE/176mQyLJgQ==
ftUzeAdbDsGQTdNB8DTZMyH0
LyYshzZrwiL1rjbYaRIb
FxUI3fDvJSiI4+zJw9Q=
tso/3IMC7yKg1ff08AVG7tGEWT+1Rdqz
2R+QH6SM7g0mfqI=
lshW53vMIIyAR+95LXaOoAb2U3WMc3m7
JGv37fpftjotxk/Fi1iGrw==
QTswdBsMz2xN4nHfi1iGrw==
ATODSoRwHZylR6dFP0+MJBU=
TWfBPutYujsoxlzNi1iGrw==
fedefarmatour.online
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
systray.exepid process 320 systray.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
付款副本 $44,620.execvtres.exesystray.exedescription pid process target process PID 1056 set thread context of 1924 1056 付款副本 $44,620.exe cvtres.exe PID 1924 set thread context of 1368 1924 cvtres.exe Explorer.EXE PID 320 set thread context of 1368 320 systray.exe Explorer.EXE -
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
cvtres.exesystray.exepid process 1924 cvtres.exe 1924 cvtres.exe 1924 cvtres.exe 1924 cvtres.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
cvtres.exesystray.exepid process 1924 cvtres.exe 1924 cvtres.exe 1924 cvtres.exe 320 systray.exe 320 systray.exe 320 systray.exe 320 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cvtres.exesystray.exedescription pid process Token: SeDebugPrivilege 1924 cvtres.exe Token: SeDebugPrivilege 320 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
付款副本 $44,620.exeExplorer.EXEsystray.exedescription pid process target process PID 1056 wrote to memory of 1924 1056 付款副本 $44,620.exe cvtres.exe PID 1056 wrote to memory of 1924 1056 付款副本 $44,620.exe cvtres.exe PID 1056 wrote to memory of 1924 1056 付款副本 $44,620.exe cvtres.exe PID 1056 wrote to memory of 1924 1056 付款副本 $44,620.exe cvtres.exe PID 1056 wrote to memory of 1924 1056 付款副本 $44,620.exe cvtres.exe PID 1056 wrote to memory of 1924 1056 付款副本 $44,620.exe cvtres.exe PID 1056 wrote to memory of 1924 1056 付款副本 $44,620.exe cvtres.exe PID 1368 wrote to memory of 320 1368 Explorer.EXE systray.exe PID 1368 wrote to memory of 320 1368 Explorer.EXE systray.exe PID 1368 wrote to memory of 320 1368 Explorer.EXE systray.exe PID 1368 wrote to memory of 320 1368 Explorer.EXE systray.exe PID 320 wrote to memory of 1148 320 systray.exe Firefox.exe PID 320 wrote to memory of 1148 320 systray.exe Firefox.exe PID 320 wrote to memory of 1148 320 systray.exe Firefox.exe PID 320 wrote to memory of 1148 320 systray.exe Firefox.exe PID 320 wrote to memory of 1148 320 systray.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\付款副本 $44,620.exe"C:\Users\Admin\AppData\Local\Temp\付款副本 $44,620.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
1.0MB
MD5ce5c15b5092877974d5b6476ad1cb2d7
SHA176a6fc307d1524081cba1886d312df97c9dd658f
SHA2561f1a186ea26bd2462ea2a9cf35a816b92caf0897fdf332af3a61569e0ba97b24
SHA512bb9ced38c63d2a29e18c38f60020cfdf0161384cd4ad6328352626643becdf49f6b4bef47012391720344fdd8ad520aa802dcbbed15b5026d27eb93b0a839c90
-
memory/320-69-0x0000000000000000-mapping.dmp
-
memory/320-75-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/320-73-0x0000000000900000-0x000000000098F000-memory.dmpFilesize
572KB
-
memory/320-72-0x0000000000AA0000-0x0000000000DA3000-memory.dmpFilesize
3.0MB
-
memory/320-71-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/320-70-0x0000000000E10000-0x0000000000E15000-memory.dmpFilesize
20KB
-
memory/1056-55-0x0000000000460000-0x000000000046C000-memory.dmpFilesize
48KB
-
memory/1056-56-0x0000000000570000-0x0000000000578000-memory.dmpFilesize
32KB
-
memory/1056-54-0x0000000000DB0000-0x0000000000DFA000-memory.dmpFilesize
296KB
-
memory/1368-74-0x0000000007150000-0x00000000072C7000-memory.dmpFilesize
1.5MB
-
memory/1368-76-0x0000000007150000-0x00000000072C7000-memory.dmpFilesize
1.5MB
-
memory/1368-68-0x0000000007020000-0x0000000007144000-memory.dmpFilesize
1.1MB
-
memory/1368-79-0x000007FF14AB0000-0x000007FF14ABA000-memory.dmpFilesize
40KB
-
memory/1368-78-0x000007FEF6600000-0x000007FEF6743000-memory.dmpFilesize
1.3MB
-
memory/1924-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1924-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1924-61-0x00000000004012B0-mapping.dmp
-
memory/1924-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1924-57-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1924-65-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1924-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1924-67-0x0000000000120000-0x0000000000130000-memory.dmpFilesize
64KB
-
memory/1924-66-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB