Analysis
-
max time kernel
179s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 17:02
Static task
static1
Behavioral task
behavioral1
Sample
Document Payment.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Document Payment.js
Resource
win10v2004-20220812-en
General
-
Target
Document Payment.js
-
Size
252KB
-
MD5
76c1c36c47ced1f2e3c9528b4a45fc42
-
SHA1
bf8e742e9e99d7814988dadc809847c624d098ed
-
SHA256
abb0ca8ed8cb040eb69d4837c26fca5efe130711346859b86641b45da7de31b6
-
SHA512
066c4d3508b3c3c816c0909eb1c20fed76d908b4f94fa36e36dff2711515f63ae41cad0bc5a971fa4bda2162014f853fb4d8a9fa809d14afb9fd56a0d834fe8a
-
SSDEEP
1536:B4QRV0AphDu3651pCC6T5IYx9btSutuiLL5dve/OC67OMOMM8hMM/0m6tWcSukqE:BnTeK1qRfOgkKtlQi
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
Document Payment.exeNote.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Chrome\\Google.exe\"," Document Payment.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Chrome\\Google.exe\"," Note.exe -
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3232-154-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral2/memory/3232-157-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral2/memory/3232-160-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral2/memory/3576-172-0x0000000000400000-0x0000000000444000-memory.dmp netwire -
Executes dropped EXE 7 IoCs
Processes:
Document Payment.exeDocument Payment.exeDocument Payment.exeDocument Payment.exeDocument Payment.exeNote.exeNote.exepid process 4508 Document Payment.exe 260 Document Payment.exe 4348 Document Payment.exe 1336 Document Payment.exe 3232 Document Payment.exe 2392 Note.exe 3576 Note.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exeDocument Payment.exeDocument Payment.exeNote.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Document Payment.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Document Payment.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Note.exe -
Drops startup file 1 IoCs
Processes:
Note.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad.lnk Note.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Note.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Note.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\)Ô‡OûPN»t@÷áh = "C:\\Users\\Admin\\AppData\\Roaming\\Gooogle\\Note.exe" Note.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Document Payment.exeNote.exedescription pid process target process PID 4508 set thread context of 3232 4508 Document Payment.exe Document Payment.exe PID 2392 set thread context of 3576 2392 Note.exe Note.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exeDocument Payment.exepowershell.exepid process 2328 powershell.exe 2328 powershell.exe 4508 Document Payment.exe 4508 Document Payment.exe 4508 Document Payment.exe 4508 Document Payment.exe 4508 Document Payment.exe 4508 Document Payment.exe 4656 powershell.exe 4656 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Document Payment.exepowershell.exeNote.exepowershell.exedescription pid process Token: SeDebugPrivilege 4508 Document Payment.exe Token: SeDebugPrivilege 2328 powershell.exe Token: SeDebugPrivilege 2392 Note.exe Token: SeDebugPrivilege 4656 powershell.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
wscript.exeDocument Payment.exeDocument Payment.exeNote.exedescription pid process target process PID 4708 wrote to memory of 4508 4708 wscript.exe Document Payment.exe PID 4708 wrote to memory of 4508 4708 wscript.exe Document Payment.exe PID 4708 wrote to memory of 4508 4708 wscript.exe Document Payment.exe PID 4508 wrote to memory of 2328 4508 Document Payment.exe powershell.exe PID 4508 wrote to memory of 2328 4508 Document Payment.exe powershell.exe PID 4508 wrote to memory of 2328 4508 Document Payment.exe powershell.exe PID 4508 wrote to memory of 260 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 260 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 260 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 4348 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 4348 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 4348 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 1336 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 1336 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 1336 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 4508 wrote to memory of 3232 4508 Document Payment.exe Document Payment.exe PID 3232 wrote to memory of 2392 3232 Document Payment.exe Note.exe PID 3232 wrote to memory of 2392 3232 Document Payment.exe Note.exe PID 3232 wrote to memory of 2392 3232 Document Payment.exe Note.exe PID 2392 wrote to memory of 4656 2392 Note.exe powershell.exe PID 2392 wrote to memory of 4656 2392 Note.exe powershell.exe PID 2392 wrote to memory of 4656 2392 Note.exe powershell.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe PID 2392 wrote to memory of 3576 2392 Note.exe Note.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Document Payment.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Document Payment.exe"C:\Users\Admin\AppData\Roaming\Document Payment.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Document Payment.exe"C:\Users\Admin\AppData\Roaming\Document Payment.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Document Payment.exe"C:\Users\Admin\AppData\Roaming\Document Payment.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Document Payment.exe"C:\Users\Admin\AppData\Roaming\Document Payment.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Document Payment.exe"C:\Users\Admin\AppData\Roaming\Document Payment.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Gooogle\Note.exe"C:\Users\Admin\AppData\Roaming\Gooogle\Note.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Gooogle\Note.exeC:\Users\Admin\AppData\Roaming\Gooogle\Note.exe5⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5feee6cbc4e014617a0fa16c3ac74d9b1
SHA1d95ed1dc8073b93a6a2500b2bd241042e321a145
SHA256b06d4d58984c08a0691c9ad438d0c7c3ce1798dd1bf2e28ba0c1503c6ec36b43
SHA512ca45659f58314ea1af5d248bff391902ab69670b15d48f01033abd1f708fca2b703f73f39e0374c187b29aa49d9f816d861cc3379c82403ac4873426c3c10411
-
C:\Users\Admin\AppData\Roaming\Chrome\Google.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\Document Payment.exeFilesize
189KB
MD555737658022dfde028de54f8f34c9c56
SHA1922890a964cb16b18174561bab63e27f248ed7c1
SHA256c5cba4155b3dd74151724b3571101881fcd756af12b95a14538843845c9fde35
SHA5126099080c7f12ee87ccc7964154d922215aab24d2c6c3e36c1de322597083c0f8d28ffd7fa0434436ee45d2c9bc0ebb047f736ed8d1124fee1eb1b6ccf5c825ba
-
C:\Users\Admin\AppData\Roaming\Document Payment.exeFilesize
189KB
MD555737658022dfde028de54f8f34c9c56
SHA1922890a964cb16b18174561bab63e27f248ed7c1
SHA256c5cba4155b3dd74151724b3571101881fcd756af12b95a14538843845c9fde35
SHA5126099080c7f12ee87ccc7964154d922215aab24d2c6c3e36c1de322597083c0f8d28ffd7fa0434436ee45d2c9bc0ebb047f736ed8d1124fee1eb1b6ccf5c825ba
-
C:\Users\Admin\AppData\Roaming\Document Payment.exeFilesize
189KB
MD555737658022dfde028de54f8f34c9c56
SHA1922890a964cb16b18174561bab63e27f248ed7c1
SHA256c5cba4155b3dd74151724b3571101881fcd756af12b95a14538843845c9fde35
SHA5126099080c7f12ee87ccc7964154d922215aab24d2c6c3e36c1de322597083c0f8d28ffd7fa0434436ee45d2c9bc0ebb047f736ed8d1124fee1eb1b6ccf5c825ba
-
C:\Users\Admin\AppData\Roaming\Document Payment.exeFilesize
189KB
MD555737658022dfde028de54f8f34c9c56
SHA1922890a964cb16b18174561bab63e27f248ed7c1
SHA256c5cba4155b3dd74151724b3571101881fcd756af12b95a14538843845c9fde35
SHA5126099080c7f12ee87ccc7964154d922215aab24d2c6c3e36c1de322597083c0f8d28ffd7fa0434436ee45d2c9bc0ebb047f736ed8d1124fee1eb1b6ccf5c825ba
-
C:\Users\Admin\AppData\Roaming\Document Payment.exeFilesize
189KB
MD555737658022dfde028de54f8f34c9c56
SHA1922890a964cb16b18174561bab63e27f248ed7c1
SHA256c5cba4155b3dd74151724b3571101881fcd756af12b95a14538843845c9fde35
SHA5126099080c7f12ee87ccc7964154d922215aab24d2c6c3e36c1de322597083c0f8d28ffd7fa0434436ee45d2c9bc0ebb047f736ed8d1124fee1eb1b6ccf5c825ba
-
C:\Users\Admin\AppData\Roaming\Document Payment.exeFilesize
189KB
MD555737658022dfde028de54f8f34c9c56
SHA1922890a964cb16b18174561bab63e27f248ed7c1
SHA256c5cba4155b3dd74151724b3571101881fcd756af12b95a14538843845c9fde35
SHA5126099080c7f12ee87ccc7964154d922215aab24d2c6c3e36c1de322597083c0f8d28ffd7fa0434436ee45d2c9bc0ebb047f736ed8d1124fee1eb1b6ccf5c825ba
-
C:\Users\Admin\AppData\Roaming\Gooogle\Note.exeFilesize
189KB
MD555737658022dfde028de54f8f34c9c56
SHA1922890a964cb16b18174561bab63e27f248ed7c1
SHA256c5cba4155b3dd74151724b3571101881fcd756af12b95a14538843845c9fde35
SHA5126099080c7f12ee87ccc7964154d922215aab24d2c6c3e36c1de322597083c0f8d28ffd7fa0434436ee45d2c9bc0ebb047f736ed8d1124fee1eb1b6ccf5c825ba
-
C:\Users\Admin\AppData\Roaming\Gooogle\Note.exeFilesize
189KB
MD555737658022dfde028de54f8f34c9c56
SHA1922890a964cb16b18174561bab63e27f248ed7c1
SHA256c5cba4155b3dd74151724b3571101881fcd756af12b95a14538843845c9fde35
SHA5126099080c7f12ee87ccc7964154d922215aab24d2c6c3e36c1de322597083c0f8d28ffd7fa0434436ee45d2c9bc0ebb047f736ed8d1124fee1eb1b6ccf5c825ba
-
C:\Users\Admin\AppData\Roaming\Gooogle\Note.exeFilesize
189KB
MD555737658022dfde028de54f8f34c9c56
SHA1922890a964cb16b18174561bab63e27f248ed7c1
SHA256c5cba4155b3dd74151724b3571101881fcd756af12b95a14538843845c9fde35
SHA5126099080c7f12ee87ccc7964154d922215aab24d2c6c3e36c1de322597083c0f8d28ffd7fa0434436ee45d2c9bc0ebb047f736ed8d1124fee1eb1b6ccf5c825ba
-
memory/260-147-0x0000000000000000-mapping.dmp
-
memory/1336-151-0x0000000000000000-mapping.dmp
-
memory/2328-141-0x00000000051D0000-0x00000000057F8000-memory.dmpFilesize
6.2MB
-
memory/2328-140-0x0000000002820000-0x0000000002856000-memory.dmpFilesize
216KB
-
memory/2328-139-0x0000000000000000-mapping.dmp
-
memory/2328-145-0x0000000007640000-0x0000000007CBA000-memory.dmpFilesize
6.5MB
-
memory/2328-144-0x0000000005DE0000-0x0000000005DFE000-memory.dmpFilesize
120KB
-
memory/2328-143-0x0000000005800000-0x0000000005866000-memory.dmpFilesize
408KB
-
memory/2328-146-0x00000000062E0000-0x00000000062FA000-memory.dmpFilesize
104KB
-
memory/2328-142-0x00000000050B0000-0x0000000005116000-memory.dmpFilesize
408KB
-
memory/2392-158-0x0000000000000000-mapping.dmp
-
memory/3232-153-0x0000000000000000-mapping.dmp
-
memory/3232-157-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3232-160-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3232-154-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3576-167-0x0000000000000000-mapping.dmp
-
memory/3576-172-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4348-149-0x0000000000000000-mapping.dmp
-
memory/4508-132-0x0000000000000000-mapping.dmp
-
memory/4508-138-0x00000000062D0000-0x00000000062F2000-memory.dmpFilesize
136KB
-
memory/4508-137-0x0000000006320000-0x00000000063B2000-memory.dmpFilesize
584KB
-
memory/4508-136-0x0000000005210000-0x00000000057B4000-memory.dmpFilesize
5.6MB
-
memory/4508-135-0x0000000000340000-0x0000000000374000-memory.dmpFilesize
208KB
-
memory/4656-162-0x0000000000000000-mapping.dmp