Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
08-12-2022 20:27
Static task
static1
Behavioral task
behavioral1
Sample
Betalningsaviseringsanmärkning - 0000274553.cab.exe
Resource
win7-20220901-en
General
-
Target
Betalningsaviseringsanmärkning - 0000274553.cab.exe
-
Size
535KB
-
MD5
5c6d494467d89ff50a77cc878c8c9539
-
SHA1
11618f354cc30d7a5716a687b9384138a0f46b5b
-
SHA256
306e86d6c586c3a6a52ed61b426b1e2520671b95b54510fb3faede2f499801d0
-
SHA512
6ed42edf100c076f422231c55e5df1ca9d1dda8c139fe7a19748f97685469c2a3042b9b23d222ea26c68a216c596b5084d4dc16238382cc7c3d0bad9e82c9394
-
SSDEEP
6144:/kw+0xk6e96C2U/2aqg9JBP/gr0TdFpyI7a5SQ/GBQDLJCoF7PdcUFauRugGcSnu:slzAKpgCb7kSQKQXJ7tF34gNV
Malware Config
Extracted
formbook
m9ae
nWTQpX6TYm6dfT3Lcw==
7JaBLgMm8EKn2AlTy5Ksj4Jq
yWRJIhE3viQgqEpZS3o=
ES9dFo0bytF8vlvRcg==
aX/aBZn29pD+cg==
lU64sYOZV7ZVpUy1ag==
9BpOCYAPv8L8TyIFAiTp2PSqLg==
uEJ2RyQ1BcBXfFr8kT5Z1KV0
oVM42Ury9pD+cg==
0Zl3VkcuKaY+
OjZeGI8dw67Z6eWtnOoBfoI=
ytwFn9j4i+N8nKYRSgcfh3xn5LU=
xMb1+YkOyxmbxJ53JsP7Pg==
HODQpzTBS1gVoi4X0hStKQ==
fQ417ycwD+ziKt1u0hStKQ==
nsApOqE62sA8uS735uCXVP+YcrQ=
4aobG3oZ3AHqTPs=
P2LEwJatZbQZUTayTW0=
/bopO7NR6clCfT3Lcw==
bBxRRkFY01R+20pZS3o=
enylSY//R0Euo5Hc
s3hoHGn+blzIzLD2XcWsj4Jq
MvZlcWyHEnNHRGHB
qDJgM38Zlp2BriDZBnI=
JlaRDbpPJo43fT3Lcw==
aZgM/YERpLJOfT3Lcw==
dgcdTgcuKaY+
N12TQ5X0uI7/dA==
85d5Cn4gEuXNHOY=
XGyjNRUvzkzpFEb98NiZYf+YcrQ=
nUc1kamtJHlHRGHB
M+1WZ6NvT6VHRGHB
k1iSQqU6E3biHW3Ev1x/
yoeZZ9suKaY+
yiqErKzdOA==
I8FYQ4Mx9pD+cg==
e3sMggibmaRHRGHB
YBxPTjVYD4c2WVRYdfxP9f/w5W+IU0g=
A6GFXmNsA4y3ByPuEXU=
RkSck9R+79lCe5vEv1x/
c4Hf8OWx18LuWN4pPnA=
IK6UOZcpvKTL2/PbBHI=
dpbLY0FV8mxHRGHB
RoTt48Dgi/aZtJ/Ev1x/
4/FRPhpH3TPGD0uYB7Yf2PSqLg==
5A5CBZYyzanG52lgk7V7K8G4gdDu5w==
p8IpCMzdxqyj2UpZS3o=
cToa+3QRpLJOfT3Lcw==
Lat9/Yk19pD+cg==
CrjklYWQN6tXfIjEv1x/
SfQyB+TxpJSt20pZS3o=
eTEdrAOeVYJ4Cx6WSxqnYGgz01Yv7w==
NP7rnOJz7QXxQfk=
hrYdLa1V+exp20UX0hStKQ==
R+gl+MvhTQHqTPs=
CC6YqK+3hWJYpEseExvt2PSqLg==
VmybWD1f6EIreDUVP47Yw5la3rI=
Sgv5moChVKcQSZYjwYWyvbeuMw==
rtxt7QYo5mxHRGHB
cH/l/4Ecn61OfT3Lcw==
T4iddmuQEGhd1NwMviZm
cyH/sQGRb8s6e5vEv1x/
Y3DL3M3XS86ftJ7Ev1x/
U2jGyqnCYcDDJt3mAjZDxf+YcrQ=
spirituallyzen.com
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
tqlhmoflq.exetqlhmoflq.exepid process 1624 tqlhmoflq.exe 552 tqlhmoflq.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tqlhmoflq.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation tqlhmoflq.exe -
Loads dropped DLL 3 IoCs
Processes:
Betalningsaviseringsanmärkning - 0000274553.cab.exetqlhmoflq.exewuapp.exepid process 1672 Betalningsaviseringsanmärkning - 0000274553.cab.exe 1624 tqlhmoflq.exe 560 wuapp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tqlhmoflq.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\qjakvdcpmud = "C:\\Users\\Admin\\AppData\\Roaming\\xtgsdlfsmuyw\\gbcpcfqjpc.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\tqlhmoflq.exe\" C:\\Users\\Admin\\AppDat" tqlhmoflq.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tqlhmoflq.exetqlhmoflq.exewuapp.exedescription pid process target process PID 1624 set thread context of 552 1624 tqlhmoflq.exe tqlhmoflq.exe PID 552 set thread context of 1236 552 tqlhmoflq.exe Explorer.EXE PID 560 set thread context of 1236 560 wuapp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
wuapp.exedescription ioc process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wuapp.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
tqlhmoflq.exewuapp.exepid process 552 tqlhmoflq.exe 552 tqlhmoflq.exe 552 tqlhmoflq.exe 552 tqlhmoflq.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
tqlhmoflq.exetqlhmoflq.exewuapp.exepid process 1624 tqlhmoflq.exe 552 tqlhmoflq.exe 552 tqlhmoflq.exe 552 tqlhmoflq.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe 560 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tqlhmoflq.exewuapp.exedescription pid process Token: SeDebugPrivilege 552 tqlhmoflq.exe Token: SeDebugPrivilege 560 wuapp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Betalningsaviseringsanmärkning - 0000274553.cab.exetqlhmoflq.exeExplorer.EXEwuapp.exedescription pid process target process PID 1672 wrote to memory of 1624 1672 Betalningsaviseringsanmärkning - 0000274553.cab.exe tqlhmoflq.exe PID 1672 wrote to memory of 1624 1672 Betalningsaviseringsanmärkning - 0000274553.cab.exe tqlhmoflq.exe PID 1672 wrote to memory of 1624 1672 Betalningsaviseringsanmärkning - 0000274553.cab.exe tqlhmoflq.exe PID 1672 wrote to memory of 1624 1672 Betalningsaviseringsanmärkning - 0000274553.cab.exe tqlhmoflq.exe PID 1624 wrote to memory of 552 1624 tqlhmoflq.exe tqlhmoflq.exe PID 1624 wrote to memory of 552 1624 tqlhmoflq.exe tqlhmoflq.exe PID 1624 wrote to memory of 552 1624 tqlhmoflq.exe tqlhmoflq.exe PID 1624 wrote to memory of 552 1624 tqlhmoflq.exe tqlhmoflq.exe PID 1624 wrote to memory of 552 1624 tqlhmoflq.exe tqlhmoflq.exe PID 1236 wrote to memory of 560 1236 Explorer.EXE wuapp.exe PID 1236 wrote to memory of 560 1236 Explorer.EXE wuapp.exe PID 1236 wrote to memory of 560 1236 Explorer.EXE wuapp.exe PID 1236 wrote to memory of 560 1236 Explorer.EXE wuapp.exe PID 1236 wrote to memory of 560 1236 Explorer.EXE wuapp.exe PID 1236 wrote to memory of 560 1236 Explorer.EXE wuapp.exe PID 1236 wrote to memory of 560 1236 Explorer.EXE wuapp.exe PID 560 wrote to memory of 1280 560 wuapp.exe Firefox.exe PID 560 wrote to memory of 1280 560 wuapp.exe Firefox.exe PID 560 wrote to memory of 1280 560 wuapp.exe Firefox.exe PID 560 wrote to memory of 1280 560 wuapp.exe Firefox.exe PID 560 wrote to memory of 1280 560 wuapp.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Betalningsaviseringsanmärkning - 0000274553.cab.exe"C:\Users\Admin\AppData\Local\Temp\Betalningsaviseringsanmärkning - 0000274553.cab.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tqlhmoflq.exe"C:\Users\Admin\AppData\Local\Temp\tqlhmoflq.exe" C:\Users\Admin\AppData\Local\Temp\pmxskx.hap3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tqlhmoflq.exe"C:\Users\Admin\AppData\Local\Temp\tqlhmoflq.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\glolpx.dFilesize
185KB
MD58da1a70786ac6e4f3dfb388eb1fd8afc
SHA15ba11c38ed1053aeaac158dff30a803a4d4410a8
SHA25663eb014dd1a10b91067357e5692397ab1464bf3b146ba9baf199fe48ec5ac7c6
SHA512b57314d2bd94d93b635f8c14aa67259915153b2aa238c1445e5d5b00a5cd6cd7dc250ea9ac499169ee85c99c9cf4e3e6bce986cfaa97c865afd2d6813d5efffc
-
C:\Users\Admin\AppData\Local\Temp\pmxskx.hapFilesize
7KB
MD5418b6039126a6cbb2921062ad20f4647
SHA1505d64913e58eedfdbe0adc5d88385d36f3470fd
SHA2566c069ae01b50d2553e568d274dbcb015f9ec95f3ef25283a7182f6c532cf9435
SHA5124cf5e5e57d0352231bddf83b3f335d6ca359cb48480fb974dfe0133eba8171a5745fa65e22b8cbdfcaafc6e77ac366ee0d71aea7bcc27682ae67bcf9434cadeb
-
C:\Users\Admin\AppData\Local\Temp\tqlhmoflq.exeFilesize
287KB
MD5b1710f487cd6c24bd3eaa637f90198ab
SHA10c9b0b875ffc7497a25236c50dd17e676c8aa098
SHA256443c686a4a3eae981c5dce9b6f56ec291aec1bc52fce378fca7f67c4723e9cb0
SHA51226b38d31b5e4ca4dc84749428cb443669547a5e0300479aa83c6ca4072aaef34fca3bf3d53b86a6b01268d378a62432cdd2c22b90fcb16473803d6fc48eeb3c9
-
C:\Users\Admin\AppData\Local\Temp\tqlhmoflq.exeFilesize
287KB
MD5b1710f487cd6c24bd3eaa637f90198ab
SHA10c9b0b875ffc7497a25236c50dd17e676c8aa098
SHA256443c686a4a3eae981c5dce9b6f56ec291aec1bc52fce378fca7f67c4723e9cb0
SHA51226b38d31b5e4ca4dc84749428cb443669547a5e0300479aa83c6ca4072aaef34fca3bf3d53b86a6b01268d378a62432cdd2c22b90fcb16473803d6fc48eeb3c9
-
C:\Users\Admin\AppData\Local\Temp\tqlhmoflq.exeFilesize
287KB
MD5b1710f487cd6c24bd3eaa637f90198ab
SHA10c9b0b875ffc7497a25236c50dd17e676c8aa098
SHA256443c686a4a3eae981c5dce9b6f56ec291aec1bc52fce378fca7f67c4723e9cb0
SHA51226b38d31b5e4ca4dc84749428cb443669547a5e0300479aa83c6ca4072aaef34fca3bf3d53b86a6b01268d378a62432cdd2c22b90fcb16473803d6fc48eeb3c9
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
841KB
MD55fc6cd5d5ca1489d2a3c361717359a95
SHA15c630e232cd5761e7a611e41515be4afa3e7a141
SHA25685c8b8a648c56cf5f063912e0e26ecebb90e0caf2f442fd5cdd8287301fe7e81
SHA5125f9124a721f6b463d4f980920e87925098aa753b0fa2a59a3ff48b48d2b1a45d760fd46445414d84fb66321181cd2c82a4194361811114c15e35b42f838ab792
-
\Users\Admin\AppData\Local\Temp\tqlhmoflq.exeFilesize
287KB
MD5b1710f487cd6c24bd3eaa637f90198ab
SHA10c9b0b875ffc7497a25236c50dd17e676c8aa098
SHA256443c686a4a3eae981c5dce9b6f56ec291aec1bc52fce378fca7f67c4723e9cb0
SHA51226b38d31b5e4ca4dc84749428cb443669547a5e0300479aa83c6ca4072aaef34fca3bf3d53b86a6b01268d378a62432cdd2c22b90fcb16473803d6fc48eeb3c9
-
\Users\Admin\AppData\Local\Temp\tqlhmoflq.exeFilesize
287KB
MD5b1710f487cd6c24bd3eaa637f90198ab
SHA10c9b0b875ffc7497a25236c50dd17e676c8aa098
SHA256443c686a4a3eae981c5dce9b6f56ec291aec1bc52fce378fca7f67c4723e9cb0
SHA51226b38d31b5e4ca4dc84749428cb443669547a5e0300479aa83c6ca4072aaef34fca3bf3d53b86a6b01268d378a62432cdd2c22b90fcb16473803d6fc48eeb3c9
-
memory/552-67-0x0000000000860000-0x0000000000B63000-memory.dmpFilesize
3.0MB
-
memory/552-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/552-66-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/552-68-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/552-69-0x00000000000F0000-0x0000000000100000-memory.dmpFilesize
64KB
-
memory/552-63-0x00000000004012B0-mapping.dmp
-
memory/560-74-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/560-75-0x0000000000860000-0x00000000008EF000-memory.dmpFilesize
572KB
-
memory/560-71-0x0000000000000000-mapping.dmp
-
memory/560-72-0x0000000000D20000-0x0000000000D2B000-memory.dmpFilesize
44KB
-
memory/560-73-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1236-70-0x00000000040A0000-0x0000000004162000-memory.dmpFilesize
776KB
-
memory/1236-76-0x0000000005F10000-0x000000000606C000-memory.dmpFilesize
1.4MB
-
memory/1236-78-0x0000000005F10000-0x000000000606C000-memory.dmpFilesize
1.4MB
-
memory/1624-56-0x0000000000000000-mapping.dmp
-
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB